This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryFixed dashboard rendering leak of character offsets and updated adopter-facing documentation.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Bugfix | Medium |
Fixes dashboard rendering leak of character offsets in skill-source highlighter. Fixes dashboard rendering leak of character offsets in skill-source highlighter. Source: llm_adapter@2026-07-15 Confidence: high |
— |
Full changelog
Upgrade impact: none (additive). One dashboard rendering fix + docs; no runtime behavior change.
- Dashboard: fixed the skill-source security highlighter leaking character offsets into the rendered body. The approval-review source viewer was showing stray numbers glued to mutation ops and
approved=kwargs (e.g.$ data_write2861 … approved="…"3021). The highlight pass's single-capture-group patterns were treatingString.replace's third callback argument — the match offset, a number — as a capture group, and rendering it. Fixed (typeof p2 === "string"guard); added a regression test that fails on the leak. The stored skill source was never affected — this was render-only. - Adopter-facing docs audit (
adopter-agent-guide.md,adopter-playbook.md,connector-contract-reference.md). Pre-announcement pass for accuracy + no internal leakage:- Removed internal-process references (thread ids, internal-agent names, dev-cadence/roadmap phrasing, an internal substrate name used as an example) and stripped version-provenance citations, keeping only the genuine
v1.0contract-version mentions. - Accuracy: the
SkillStorecontract block + ship-status table were missingmanifest()(claimed 8 methods, listed 7) — corrected, andDataStoremade consistent; theAgentConnectorWakeReceiptinterface block was missingwarnings?: string[]— added; the agent-guide MCP tool reference completed from 13 to the full 17 tools.
- Removed internal-process references (thread ids, internal-agent names, dev-cadence/roadmap phrasing, an internal substrate name used as an example) and stripped version-provenance citations, keeping only the genuine
language-reference.mdre-rendered from atoms — the# OnError:deprecation section now states removal is planned for a post-launch release (after 0.30), replacing the earlier reference to a version that will be skipped.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]