Issues

• fix: test --all and doctor build paths from unvalidated lockfile slugs

  rolecraft-sh/rolecraft#375 · Filter by author Bdysj opened on Sep 30, 2026
  1

• fix: download-and-execute rule misses curl/wget flags, so curl -fsSL url | sh scores as safe

  bughelp wantedjavascriptpriority: highsecurity
  rolecraft-sh/rolecraft#370 · Filter by author sametcelikbicak opened on Sep 30, 2026
  2

  

• chore: .github/scripts/release-prep.sh has no test and no lint, and it runs after a tag is pushed

  enhancementgithub_actionshelp wantedpriority: medium
  rolecraft-sh/rolecraft#369 · Filter by author sametcelikbicak opened on Sep 30, 2026
  1

  

• fix: decide whether ci and mcp check degrade or fail on a corrupt MCP lock

  bughelp wantedjavascriptpriority: low
  rolecraft-sh/rolecraft#367 · Filter by author sametcelikbicak opened on Sep 30, 2026

• fix: name the lock file when the atomic write loses a race, instead of leaking a temp path

  buggood first issuehelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#366 · Filter by author sametcelikbicak opened on Sep 30, 2026
  2

• harden: profile import redirect follow-ups (real-server test, 304, port)

  enhancementjavascriptpriority: low
  rolecraft-sh/rolecraft#354 · Filter by author sametcelikbicak opened on Sep 29, 2026
  1

• chore: manifest test_count doesn't match actual npm test count

  enhancementjavascriptpriority: low
  rolecraft-sh/rolecraft#347 · Filter by author sametcelikbicak opened on Sep 29, 2026

• fix: update double-installs project skills and writes a global lock entry

  bughelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#346 · Filter by author sametcelikbicak opened on Sep 29, 2026

• fix: project-scoped agents (devin/eve/promptscript) write to the global lockfile

  bughelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#332 · Filter by author sametcelikbicak opened on Sep 28, 2026

• fix: ci installs non-local project-lock skills into the global agents dir

  bughelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#331 · Filter by author sametcelikbicak opened on Sep 28, 2026

• fix: doctor reports three false positives (orphan dirs, hashes, missing dirs)

  bughelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#330 · Filter by author sametcelikbicak opened on Sep 28, 2026

• fix: watch re-syncs its own output when target is inside the watched directory

  bughelp wantedjavascriptpriority: medium
  rolecraft-sh/rolecraft#329 · Filter by author sametcelikbicak opened on Sep 28, 2026

• fix: resolver skips files in skill subdirectories, corrupting contentSha

  bughelp wantedjavascriptpriority: high
  rolecraft-sh/rolecraft#325 · Filter by author sametcelikbicak opened on Sep 28, 2026

• fix: MCP npm: sources bypass content security scan

  bughelp wantedjavascriptpriority: highsecurity
  rolecraft-sh/rolecraft#322 · Filter by author sametcelikbicak opened on Sep 28, 2026

• refactor: make setup command reuse the setup API

  help wantedjavascript
  rolecraft-sh/rolecraft#306 · Filter by author sametcelikbicak opened on Sep 25, 2026

• refactor: move detectAgents out of src/commands/setup.js

  good first issuejavascript
  rolecraft-sh/rolecraft#305 · Filter by author sametcelikbicak opened on Sep 25, 2026

• refactor: finish UserError migration in resolver, profile, compose and convert

  help wantedjavascript
  rolecraft-sh/rolecraft#297 · Filter by author sametcelikbicak opened on Sep 25, 2026

• refactor: move shell completion generators from commands/ to api/

  help wantedjavascript
  rolecraft-sh/rolecraft#296 · Filter by author sametcelikbicak opened on Sep 25, 2026

• refactor: make convert command reuse the convert API

  good first issuejavascript
  rolecraft-sh/rolecraft#291 · Filter by author sametcelikbicak opened on Sep 25, 2026