Pass --allow-dirs=evals to skill-validator so the internal-tooling evals/
subdirectory under each skill no longer trips the spec's "unknown directory"
warning. The agentskills.io spec explicitly permits additional directories
at the skill root; the eval suite layout lives under evals/<suite>/ and is
read by this repo's eval runner only, not by agents at runtime.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Address two issues flagged in PR review:
1. Validate pluginRoot and source with isSafeRelativePath before using
them in path.resolve. Without this, absolute paths or .. traversals
in marketplace.json would pass validation silently.
2. Error when the per-plugin .cursor-plugin/plugin.json is missing
instead of silently skipping it. A missing manifest would prevent
the plugin from loading, so the validator should catch it.
Made-with: Cursor
The pre-commit validator previously required a root plugin.json and
would fail when only marketplace.json was present.
Refactor the validator to check for marketplace.json first, falling
back to root plugin.json for single-plugin repos. For marketplace
repos, validate the marketplace manifest (name, owner, plugins array),
resolve each plugin directory using pluginRoot + source, and validate
per-plugin manifests with paths relative to the plugin directory.
Made-with: Cursor
Valentin Kirilov