This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryAdds optional frontmatter # Tags: for categorizing skills without affecting execution.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Excludes `# Tags:` line from approval signing hash, preventing signature invalidation on tag edits Excludes `# Tags:` line from approval signing hash, preventing signature invalidation on tag edits Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Adds optional # Tags: frontmatter field for skill categorization Adds optional # Tags: frontmatter field for skill categorization Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
`SkillEntry.tags`, `SkillMeta.tags`, and `skill_preflight` always include tags (empty array when untagged) `SkillEntry.tags`, `SkillMeta.tags`, and `skill_preflight` always include tags (empty array when untagged) Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Feature | Low |
Tags are runtime-derived from frontmatter like description and vars Tags are runtime-derived from frontmatter like description and vars Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Upgrade impact: none (additive). New optional frontmatter field + one additive SkillMeta/skill_list field; no breaking change.
An optional # Tags: frontmatter field for categorizing skills — a second, author-defined axis alongside the audience grouping.
# Tags: morning-brief, amp, ops— optional, comma-separated, normalized to lowercase de-duped slugs. Pure classification: zero effect on execution, dispatch, approval, or runtime selection — a display + agent-comprehension axis, never an authz input.- Rides in the contract from day one.
SkillEntry.tags(onskill_list) is always present (empty array when untagged), andSkillMeta.tags/skill_preflightcarry it too — so the agent can chunk a large skill menu into families without reading each description (a mitigation for selection degradation on big flat lists), not just a viewer nicety. Server-side tag filtering (skill_list({ filter: { tags } })) is deferred; the field enables it later. - Runtime-derived. Like
description/vars, tags are a projection of the body, so the runtime derives them from the frontmatter — a custom SkillStore that doesn't track tags still gets them. - Approval-neutral. The
# Tags:line is excluded from the approval signing hash (the same carve-out the# Status:line already has), so editing a tag does not invalidate an operator's signature or drop the skill to Draft — safe by construction, since a tag can't change what a skill does. - Dashboard consumer (ships with the field). The skills list is faceted by tag — filter chips (All / each tag / untagged) plus per-row tag pills.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Skillscript
All releases →Related context
Related tools
Earlier breaking changes
- v0.35.0 Editing `# Deadline:` on an approved skill drops it to Draft (signature invalidates).
Beta — feedback welcome: [email protected]