skilldrop 0.16.45
Released 2026-10-21 · npx skilldrop-cli@0.16.45
- The scripts that read your files are fuzzed. 15 scripts are fuzzed: SQL, Lighthouse and Terraform JSON, brand files, cost and tracker exports, risk registers, event contracts, bundle stats, research matrices and Markdown. Coverage-guided fuzzing with Atheris runs in CI on every change to a script, and for longer every week. The same targets run briefly in the unit tests on every OS (RFC-0062).
- The first runs found 11 more crashes, now fixed. Five scripts crashed on a file that isn't UTF-8:
risk-register,event-contract-draft,bundle-size-review,feedback-synthesisandhypothesis-comparison.risk-registeralso crashed on a stray carriage return. On Python 3.9, five CSV readers crashed on a NUL byte:cloud-cost-review,backlog-triage,team-status-report,feedback-synthesisandhypothesis-comparison. Each now fails with a one-line message, and every target then ran 6,000 mutated inputs on Python 3.9 and 3.14 without a crash. - Atheris's first CI run found three more crashes, now fixed. -
md-to-htmlbroke on a NUL byte in Markdown, which collided with its own placeholders. It now drops those characters on input. -web-performance-reviewbroke on a number given as text, andbundle-size-reviewon a list where an id belongs. - JSON that parses but has the wrong shape is now one clear error, not a traceback, in the six scripts that read JSON:
web-performance-review,bundle-size-review,terraform-plan-review,event-contract-draft,brand-kitandbehaviour-equivalence. The message says to report it if the file is genuine.