v0.6.1

Added

• inject: always frontmatter — Mark any file in shared/ with inject: always to have it prepended to every context response, before truncation.
• Stale context warning — context tool emits a stale_context: true flag and a markdown warning when the context file's updated date is more than 30 days old.

Changed

• Stale session cleanup — Sessions that exceed the TTL are now deleted from the registry instead of being marked "stale". The resume tool no longer surfaces interrupted sessions (they were unreliable indicators).
• Session status type — Removed "stale" from the Session.status union; only "active" and "completed" remain.

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.6.0...v0.6.1

v0.6.0

What's Changed

Structured Session Notes

Session complete now accepts structured fields: completed, partially_completed, blocked, verification_run, commands_to_resume. Session notes render as machine-actionable sections. Resume surfaces blocked items and commands to resume.

New MCP Tools

• snapshot_repo_state — Snapshot current git state (branch, dirty files, last commit) into the vault for cross-session continuity.
• env_facts — Store and query stable environment facts (auth backend, env file locations, local URLs, required env vars). Not for secrets.
• cred_refs — Store pointers to where credentials are documented, not the credentials themselves.
• rollback — Manage rollback checkpoints with commit hash, purpose, scope, and follow-up tracking.
• capture — Batch-capture multiple insights from a conversation into individual vault items in one call.
• template — Pre-filled templates for 12 vault item types (adr, prd, decision, learning, spec, rfc, roadmap, competitive-analysis, incident, research, vision, strategy).

Vault Item Versioning

Overwriting a vault file via write --mode overwrite automatically snapshots the previous version to _versions/.

Secret Detection Guardrails

write command scans content for potential secrets (API keys, tokens, private keys, webhook secrets) and logs warnings. Does not block writes.

Improved Search

Search now returns up to 3 matches per file (was 1) and deduplicates by path, surfacing better snippets. Session outcomes are indexed more aggressively.

v0.5.1

What's Changed

Freeform Content Types

Vault type field now accepts any lowercase slug (e.g. prd, vision, roadmap, rfc, competitive-analysis) instead of a rigid enum of 12 types. Validation uses /^[a-z][a-z0-9-]*$/ — anything that looks like a slug is valid.

New MCP Tools

• link — Create forward links between vault notes via [[wikilinks]]. Integrates with existing graph_related for bidirectional graph traversal.
• extract — Extract decisions, learnings, or other items from a monolithic document into individual vault files with auto-numbering and backlinks.

Brainstorm Skill Discovery

superskill init now discovers workflow skills (brainstorming, planning, design, code-review, testing) beyond stack-specific skills. The router also recognizes brainstorm, research, investigate, discover, plan, design, prototype, spike as explore-phase tasks.

Draft/Published Workflow

New published frontmatter status for draft-to-published lifecycle.

v0.4.0

Added

• Skill scanner — Discovers installed SKILL.md files from ~/.claude/skills/, ~/.cursor/skills/, and other standard directories. Works with skills installed via npx skills add (skills.sh ecosystem) or manual installation.
• Local skill merging — Scanned local skills are merged into the registry at startup. Trigger matcher scores against both built-in and locally installed skills.

Changed

• Repositioned as runtime intelligence layer — SuperSkill is no longer positioned as a package manager. It's the routing layer that sits on top of the Agent Skills ecosystem (skills.sh). "skills.sh is where you find skills. SuperSkill is what loads the right one at the right time."
• README rewritten — New positioning, skills.sh integration documented, clearer value proposition
• Tool description updated — "Runtime skill router" replaces "skill package manager"
• Skill awareness block — Shows installed skill count when local skills are detected
• Package description updated across package.json, plugin.json, MCP server

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.3.0...v0.4.0

v0.3.0

Added

• Central skill registry — Runtime JSON registry at registry/index.json replaces hardcoded TypeScript catalog. 87 skills, 28 domains, 9 sources, 3 profiles. Adding a new skill is now a JSON edit, not a code change. (#2, #17)
• Trigger-based skill matching — Keyword scoring with lightweight stemming replaces regex-based TASK_DOMAIN_MAP. All 28 domains now discoverable by LLMs via dynamic tool description. Fixes "UX design" tasks returning "No matching superskill". (#4)
• Session-aware skill memory — In-process cache remembers activated skills so repeat calls with similar tasks return instantly without re-fetching. (#5)
• Registry loader — registry-loader.ts loads registry from user override (~/.superskill/registry/index.json) or bundled fallback. Schema validation, memory caching.

Changed

• web-discovery.ts refactored — 438-line mixed-concern file decomposed into 4 focused modules: text-utils.ts, url-utils.ts, security-scanner.ts, github-client.ts
• catalog.ts rewritten — Now a facade over the registry with getter functions (getCatalog(), getDomains(), getDomainPriority()). Static exports kept as fallbacks for backward compatibility.
• Tool description dynamic — superskill MCP tool description now lists all 28 domain names so LLMs know the full capability surface
• License simplified — AGPL-3.0-or-later only, removed commercial dual-license

Testing

• 832 tests across 57 files, 90%+ coverage on all new code
• 20 regression tests ensuring TASK_DOMAIN_MAP parity with trigger scoring
• Registry data integrity tests (valid sources, domains, triggers, profiles)

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.2.7...v0.3.0

v0.2.7

Added

• Prefetch core skills on install — 8 core skills (brainstorming, planning, TDD, code review, debugging, security, verification, shipping) fetched from source repos during npm install and cached at ~/.superskill/cache/ for offline availability (#6)
• Local analytics — Privacy-first skill activation tracking at ~/.superskill/analytics.json. Tracks activations, match methods, failed searches, and web discovery attempts. Auto-rotates at 1000 entries. (#9)
• Contributing guide — Release discipline, PR workflow, skill submission process, test patterns, and security guidelines (#8)

Fixed

• Security scanner false positive — Role-play instructions ("you are now acting as X") moved from hard block to soft warning. Skills legitimately adopt personas; only memory wipe instructions remain blocked.

Changed

• README overhaul — Repositioned as product storefront. One-liner value prop, 3-step setup, collapsible skill catalog, supported tools table. Removed internal implementation details. (#13)
• marketplace.ts split — 809-line god file decomposed into 5 focused modules: activate.ts, resolve.ts, generate.ts, manifest.ts, helpers.ts. Barrel re-export preserves backward compatibility.

Performance

• Web discovery caching — Results cached at ~/.superskill/discovery-cache.json with 24h TTL, max 100 entries with LRU eviction. Avoids GitHub API rate limits on repeated searches.

Testing

• 11 integration tests for the full activation flow — direct skill_id load, domain activation, task trigger matching, multi-domain, web discovery fallback, GitHub URL loading, 3-per-domain cap, manifest generation

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.2.6...v0.2.7

v0.2.6

Fixed

• Web discovery search — Repo search now uses in:name,description,readme instead of restrictive topic filters. deanpeters/Product-Manager-Skills (2340 stars) and similar repos now discoverable
• Code search — Uses filename:SKILL qualifier instead of language:markdown for more accurate results

Added

• Security scanning for community skills — All discovered skills are scanned before loading for prompt injection, identity hijacking, data exfiltration, destructive commands, and script injection. Hard blocks on dangerous content, soft warnings on suspicious patterns
• 50KB size cap on skill files to prevent oversized payloads

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.2.5...v0.2.6

v0.2.5

Added

• Web Discovery — When no skill matches in the catalog, superskill searches GitHub for community skills instead of giving up. Results include trust signals (stars, freshness, source repo) and require user confirmation before loading
• Full domain coverage — Task matching expanded from 11 to 28 domains. Skills in Go, Python, Django, Swift, Docker, content-business, 3D animation, and more are now discoverable

Fixed

• Invisible skills bug — Tool description and task matching previously hardcoded 11 of 28 domains, making half the catalog invisible to LLMs
• Single skill per domain — Activating a domain now loads up to 3 skills (collision winner + alternatives) instead of just one
• False positive patterns — Tightened regex for go, eval, query, ship to prevent over-triggering

Changed

• Tool description — Replaced 15-line domain taxonomy with 4-line verb-led trigger format
• task is now the primary param — domain accepted as optional alias

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.2.4...v0.2.5

v0.2.4

What's New

Plugin Discovery

• marketplace.json manifest for Claude Code plugin marketplace — install via /plugin install superskill
• Plugin MCP server uses npx superskill@latest for reliable out-of-the-box installs

Legacy Migration

• Setup automatically detects and removes old obsidian-mcp / obsidian-kb MCP entries
• Teardown cleans up all legacy entry names in addition to superskill

Architecture

• Design spec for evolving SuperSkill into a dynamic skill package manager — on-demand fetch, version-pinned caching, intelligent routing, and session-aware skill selection

---

Install: npm install -g superskill or via Claude Code /plugin install superskill

Full Changelog: v0.2.0...v0.2.4

v0.2.0 — SuperSkill

Highlights

The big rebrand: obsidian-mcp becomes SuperSkill — a universal skill marketplace and context optimizer for AI coding agents.

Skill Marketplace

• 87 skills cataloged from 9 repos (ECC, Superpowers, gstack, Anthropic, design repos)
• Collision detection across 12 domains with 55 competing skills
• 3 built-in profiles (ecc-first, superpowers-first, minimal) for resolution
• Layered generation: Core (~25k tokens), Extended (~50k), Reference (~31k) tiers sized to model context windows

Smart Activation

• superskill MCP tool — LLM picks domain based on user intent, loads expert methodology on demand
• Per-project filtering: auto-detects stack (Go, React, Django, etc.) and loads only relevant skills (68% bloat reduction)
• Stack detector (languages/frameworks), tool detector (Claude Code/Codex/OpenCode/Gemini), auto-profile selection

Claude Code Plugin

• .claude-plugin/plugin.json + .mcp.json for first-class plugin support
• Progressive disclosure: lightweight manifest + on-demand skill loading

Licensing

• Dual licensing: AGPL-3.0-or-later + Commercial license for businesses >$1M revenue
• SPDX headers on all 51 source files

---

Install: npm install -g superskill

Full Changelog: v0.1.2...v0.2.0