chore(deps): Bump the skillsaw group with 2 updates

[dependabot]

Bumps the skillsaw group with 2 updates: stbenjam/skillsaw and stbenjam/skillsaw/review.

Updates stbenjam/skillsaw from 0.20.0 to 0.21.0

Release notes

Sourced from stbenjam/skillsaw's releases.

v0.21.0

What's New

• Cursor plugins and marketplaces: Native discovery and validation for Cursor plugin manifests, marketplaces, and their components, with source containment checks.
• Pi packages and projects: Discover Pi package resources, .pi/ project resources, flat Markdown skills, prompt templates, and local package references, and validate Pi skills against Pi's native metadata contract (pi-skill-valid).
• OpenClaw plugins: Native plugin discovery plus opt-in authoring rules for manifests, packages, and resources.
• Codex: Follow portable OpenAI overlay precedence, including portable installs and late exclusions.
• Muse Code: Recognize newly documented hook events.
• Claude marketplaces: Tell standalone marketplace catalogs apart from plugin declarations.

Fixes and improvements

• Restore skill coverage that native Pi and OpenClaw discovery had dropped.
• Fix release-audit findings across discovery, autofix, and the CLI, including in the Pi, Cursor, and OpenClaw paths.
• hooks-dangerous no longer flags local scripts run with Bun (e.g. bun run scripts/format.ts).
• Unknown or removed rule IDs in configuration now produce advisory unknown-rule warnings instead of failing CI.
• New site changelog and a simpler getting-started guide; onboarding now recommends the skills CLI.

Upgrading from 0.20.0

• Keep version: "0.20.0" in .skillsaw.yaml to defer new automatically enabled rules; set it to "0.21.0" when ready. openclaw-manifest-valid, openclaw-package-valid, openclaw-resources, and pi-resource-paths require explicit opt-in.
• Removed: the skillsaw docs command and the content-critical-position, content-actionability-score, and skill-frontmatter rules (use agentskill-valid). Remove them from your configuration.
• Pi-owned skills are now checked by pi-skill-valid (WARNING) instead of agentskill-valid (ERROR). Set severity: error to keep them blocking.
• The repo_type field in JSON and SARIF output may change: the new Cursor, Pi, and OpenClaw types rank above earlier ones. Match on the repo_types list instead.
• New dependencies: wcmatch, pathspec, and json5.

See the upgrade guide for details.

Full changelog: stbenjam/skillsaw@v0.20.0...v0.21.0

Commits

• f39a95b Fix 0.21.0 release audit findings (round 3) (#630)
• 63a46c0 Fix Claude action version for Opus 5.5 (#629)
• 420bd9d Bump Claude workflows to claude-opus-5-5 (#628)
• 43e8ea0 [Auto] Fix 0.21.0 release audit findings across discovery, autofix, and CLI (...
• 7c435cb [Auto] Restore skill coverage lost to native Pi and OpenClaw discovery (#626)
• 79533f7 Fix release audit findings in Pi, Cursor, OpenClaw, and CLI (#622)
• 92a4421 Run make self-lint in strict mode (#624)
• 88071c2 Prepare 0.21.0: remove retired rules and docs command (#615)
• 4b5ee0e [Auto] Add native OpenClaw plugin discovery and authoring rules (#619)
• c4441fb [Auto] Add native Pi package and project resource support (#620)
• Additional commits viewable in compare view

Updates stbenjam/skillsaw/review from 0.20.0 to 0.21.0

Release notes

Sourced from stbenjam/skillsaw/review's releases.

v0.21.0

What's New

• Cursor plugins and marketplaces: Native discovery and validation for Cursor plugin manifests, marketplaces, and their components, with source containment checks.
• Pi packages and projects: Discover Pi package resources, .pi/ project resources, flat Markdown skills, prompt templates, and local package references, and validate Pi skills against Pi's native metadata contract (pi-skill-valid).
• OpenClaw plugins: Native plugin discovery plus opt-in authoring rules for manifests, packages, and resources.
• Codex: Follow portable OpenAI overlay precedence, including portable installs and late exclusions.
• Muse Code: Recognize newly documented hook events.
• Claude marketplaces: Tell standalone marketplace catalogs apart from plugin declarations.

Fixes and improvements

• Restore skill coverage that native Pi and OpenClaw discovery had dropped.
• Fix release-audit findings across discovery, autofix, and the CLI, including in the Pi, Cursor, and OpenClaw paths.
• hooks-dangerous no longer flags local scripts run with Bun (e.g. bun run scripts/format.ts).
• Unknown or removed rule IDs in configuration now produce advisory unknown-rule warnings instead of failing CI.
• New site changelog and a simpler getting-started guide; onboarding now recommends the skills CLI.

Upgrading from 0.20.0

• Keep version: "0.20.0" in .skillsaw.yaml to defer new automatically enabled rules; set it to "0.21.0" when ready. openclaw-manifest-valid, openclaw-package-valid, openclaw-resources, and pi-resource-paths require explicit opt-in.
• Removed: the skillsaw docs command and the content-critical-position, content-actionability-score, and skill-frontmatter rules (use agentskill-valid). Remove them from your configuration.
• Pi-owned skills are now checked by pi-skill-valid (WARNING) instead of agentskill-valid (ERROR). Set severity: error to keep them blocking.
• The repo_type field in JSON and SARIF output may change: the new Cursor, Pi, and OpenClaw types rank above earlier ones. Match on the repo_types list instead.
• New dependencies: wcmatch, pathspec, and json5.

See the upgrade guide for details.

Full changelog: stbenjam/skillsaw@v0.20.0...v0.21.0

Commits

• f39a95b Fix 0.21.0 release audit findings (round 3) (#630)
• 63a46c0 Fix Claude action version for Opus 5.5 (#629)
• 420bd9d Bump Claude workflows to claude-opus-5-5 (#628)
• 43e8ea0 [Auto] Fix 0.21.0 release audit findings across discovery, autofix, and CLI (...
• 7c435cb [Auto] Restore skill coverage lost to native Pi and OpenClaw discovery (#626)
• 79533f7 Fix release audit findings in Pi, Cursor, OpenClaw, and CLI (#622)
• 92a4421 Run make self-lint in strict mode (#624)
• 88071c2 Prepare 0.21.0: remove retired rules and docs command (#615)
• 4b5ee0e [Auto] Add native OpenClaw plugin discovery and authoring rules (#619)
• c4441fb [Auto] Add native Pi package and project resource support (#620)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: cblecker/claude-plugins/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: f536b6bc-1e48-4bf4-90b5-49bcaec24392

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}