Installed SKILL.md frontmatter has unquoted description with an embedded colon, breaking strict YAML parsers (e.g. npx skills ls -g) #1554

Version

codebase-memory-mcp 0.10.0

Platform

Windows (x64)

Install channel

GitHub release archive / install.sh / install.ps1

Binary variant

standard

What happened, and what did you expect?

After codebase-memory-mcp install, the generated skill file emitted by the installer has an unquoted description whose value contains a colon. For example, on Windows the installer writes ~/.agents/skills/codebase-memory/SKILL.md with this frontmatter (literal, line 2 — the value includes Triggers on:):

---
name: codebase-memory
description: Use the codebase knowledge graph for structural code queries. Triggers on: explore the codebase, understand the architecture, what functions exist, ... how to use search_graph.
---

In strict-compact-flow mode (the default for most YAML parsers, including js-yaml's load and npx skills's frontmatter reader), a : followed by a space inside an unquoted scalar is interpreted as a nested-mapping indicator, so the file is rejected with:

YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14:
        name: codebase-memory
                 ^

npx skills ls -g prints that warning, and downstream agents that index skills strictly (Zed, Claude Code, Cursor, OpenCode, Kiro, etc.) silently drop codebase-memory from their skill list. Manual workaround is to wrap line 2 in double quotes:

description: "Use the codebase knowledge graph for structural code queries. Triggers on: ... how to use search_graph."

After that, npx skills ls -g no longer warns and the skill becomes visible to every tool that uses strict parsing.

Expected: the installer should emit description as a quoted scalar (either single or double quotes), so that embedded colons do not collide with the YAML compact-flow grammar.

Reproduction

1. Clean any prior install: codebase-memory-mcp uninstall -y and remove %USERPROFILE%\.agents\skills\codebase-memory and %USERPROFILE%\.pi\agent\skills\codebase-memory (paths on macOS/Linux are ~/.agents/skills/codebase-memory and ~/.pi/agent/skills/codebase-memory).
2. Re-run: codebase-memory-mcp install -y.
3. Inspect %USERPROFILE%\.agents\skills\codebase-memory\SKILL.md (or its non-Windows equivalent). Line 2 reads description: Use the codebase ... Triggers on: ... — unquoted, with an embedded colon.
4. Run npx skills ls -g. Observe: YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14:.
5. Edit line 2 to description: "Use the codebase ... Triggers on: ..." (just wrap the value in double quotes). Re-run npx skills ls -g — warning gone, skill now visible to all strict parsers.

The only diff between the broken generated output and the working manual fix is wrapping the value in double quotes. No content change is needed.

Logs

YAML parse error: Nested mappings are not allowed in compact mappings at line 2, column 14:
        name: codebase-memory
                 ^

(The same warning is emitted by js-yaml when load() is called on the file directly, and by any consumer that uses a strict-compact-flow YAML frontmatter reader.)

Diagnostics trajectory (memory / performance / leak issues)

N/A — authoring bug in a generated config file, not a runtime / memory / leak issue.

Project scale (if relevant)

N/A

Confirmations

• I searched existing issues and this is not a duplicate.
• My reproduction uses shareable code (a dummy snippet or a public OSS repository), not proprietary code.