feat(skills): GitHub-backed skill marketplace - #69

Merged

lefarcen merged 5 commits into

nexu-io:mainfrom

wuwangzhang1216:feat/skill-marketplace

May 22, 2026

Commits on May 20, 2026

feat(skills): GitHub-backed skill marketplace
wuwangzhang1216
committed
c40ef2d
feat(skills/marketplace): harden install pipeline against DNS rebinding, tarball traversal, and gzip bombs
wuwangzhang1216
committed
dbbd2a0
fix(skills/marketplace): stage on destination FS (EXDEV) + invalidate client template cache on install/uninstall
wuwangzhang1216
committed
9c3c7fe
fix(templates/refresh): generation token so a stale fetch can't clobber the post-refresh cache
wuwangzhang1216
committed
fe4fa94

Commits on May 21, 2026

fix(marketplace): apply Host guard to GET /api/marketplace too — DNS-rebinding privacy leak
wuwangzhang1216
committed
ce8c86e