skilldrop 0.16.27

Released 2026-10-19 · npx skilldrop-cli@0.16.27

An organisation can decide what its people install. Hand out a policy file (--policy, SKILLDROP_POLICY, or ~/.config/skilldrop/policy.json) and the installer enforces it: only the catalogues you allow, pinned to a commit if you say so, only the skills you allow, none you block, and nothing whose supply-chain scan finds worse than you accept. A refused install writes nothing and names the rule; update leaves refused skills as they are. A policy with a mistake stops the command rather than being half-applied (RFC-0050, how-to).
skilldrop inventory lists every install on a machine, across every tool and scope, with what the policy thinks of each; --merge combines reports from many machines into one view. Paths under your home directory are written as ~.
An audit log that shows if it was edited. With audit in the policy, every install, update and uninstall is recorded; each line carries the fingerprint of the one before, and skilldrop audit verify names the first line that doesn't follow. Entries name a pseudonym only your organisation can resolve, unless it chooses otherwise.
skilldrop verify-mirror checks an internal mirror against the fingerprints skilldrop package recorded, and names every file changed, missing or added since.