v0.4.19
Jeffallan/claude-skillsv0.4.19Oct 15, 2026by github-actions[bot]
Upgrading?
AI Summary
This release focuses on CI/CD stability and security enhancements. It updates GitHub Actions workflows by pinning dependencies to full commit SHAs and merging Dependabot updates. Additionally, it replaces realistic secret literals with generic placeholders across documentation and skill references to prevent accidental exposure.
Key Highlights
- CI workflows now use full commit SHAs for GitHub Actions dependencies for greater stability.
- Merged Dependabot updates for `actions/checkout`, `actions/setup-node`, and other core actions.
- Replaced 149 realistic secret literals with generic placeholders in 63 files across 31 skills.
- Updated `kubernetes-specialist` configuration examples to use placeholders instead of realistic secrets.
New Features
- Security hardening: Replaced realistic secret examples with placeholders in 63 files across 31 skills.
- CI stability: Pinned third-party GitHub Actions to specific commit SHAs.
- Documentation security: Updated `references/configuration.md` to use generic placeholders.
Full Release Notes
### Added
- `.github/dependabot.yml`: weekly Dependabot updates for GitHub Actions, which keep the SHA pins and their version comments current
### Changed
- CI: third-party GitHub Actions in `validate.yml`, `release.yml`, and `publish-plugin.yml` are pinned to full commit SHAs, with the release tag in a trailing comment, instead of mutable tags like `actions/checkout@v6`. Each pin resolves to the commit its tag pointed to, so workflow behavior is unchanged
- CI: merged the first Dependabot updates for GitHub Actions: `actions/checkout` 6.1.0 → 7.0.1 (#255), `actions/setup-node` 6.5.0 → 7.1.0 (#258), `actions/upload-pages-artifact` 4.0.0 → 5.0.0 (#256), `actions/deploy-pages` 4.0.5 → 5.0.1 (#254), and `softprops/action-gh-release` 2.6.2 → 3.0.3 (#257). None of their breaking changes apply here: the workflows never check out fork PRs under `pull_request_target`, never publish to npm, and run on GitHub-hosted runners that support the Node 24 runtime
### Fixed
- `kubernetes-specialist`: `references/configuration.md` Secret examples used realistic-looking literals (`sk-1234567890abcdef`, PEM and OpenSSH private-key blocks, a registry `auth` string, sample passwords), which the Claude plugin directory blocked as "Secret in a shipped file". They are now obvious placeholders such as `<db-password>` and `<PEM-encoded private key>`
- Skill references: replaced 149 credential-like literals across 63 files in 31 skills with angle-bracket placeholders, so example code cannot be mistaken for real secrets. This covers connection strings with embedded passwords (`postgres://user:pass@`), sample secrets such as `YourStrong@Passw0rd`, AWS's documented example keys and `ghp_`/`xoxb-`/`sk_live_` samples in `security-reviewer`, CLI flags with literal credentials, test-fixture passwords (`'Test1234'`, `'SecurePass123!'`), and older placeholder styles (`"your-api-key"`, `YOUR_API_KEY`). Paired values, such as a fixture password and the login that uses it, share one placeholder. Spring `${VAR:default}` fallbacks for the database password and JWT secret now have no default
---
**Documentation:** https://jeffallan.github.io/claude-skills/
Related Repositories
public-apis/public-apis★ 491,196
A collective list of free APIs
NousResearch/hermes-agent★ 256,050
The agent that grows with you
yt-dlp/yt-dlp★ 200,229
A feature-rich command-line audio/video downloader
microsoft/markitdown★ 191,546
Python tool for converting files and office documents to Markdown.
Significant-Gravitas/AutoGPT★ 187,699
AutoGPT is the vision of accessible AI for everyone, to use and to build on. Our mission is to provide the tools, so that you can focus on what matters.