skilldrop 0.16.40

Released 2026-10-20 · npx skilldrop-cli@0.16.40

Every release can be verified. Each GitHub Release now carries: - the exact tarball published to npm; - a Sigstore-signed build provenance for it (gh attestation verify skilldrop-cli-<version>.tgz --repo sananthanarayan/skilldrop); - a CycloneDX SBOM. Its notes are this changelog entry, and its title is the pull request's (RFC-0059).
The repo is scored by OpenSSF Scorecard every week and after every merge, with a badge on the README. - CI's own tools now install from hash-locked files. - Every workflow is read-only at the top level.
The README leads with the evidence: - one real request answered with and without a skill, and the blind judge's verdict; - the last run's numbers; - the skills that were retired for losing.
The CLI asks for a GitHub star once. The line prints after your first successful install, at an interactive terminal only, never in CI, a pipe or --json. Set SKILLDROP_NO_STAR=1 to turn it off. Nothing is sent anywhere.