Fix review findings in @probo/skills package

Add ISC header to COMPATIBILITY.md, validate Claude marketplace
json, record access-review notes after API success, checksum npm
pack contents, trim dead package.json files entries, and mark
listUsers organization_id as required.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

.github/workflows/release-npm-skills.yaml

@@ -51,11 +51,15 @@ jobs:
       - name: "Generate checksums for published files"
         run: |
           cd packages/skills
-          find .claude-plugin skills commands agents hooks bin -type f 2>/dev/null \
+          PACKFILE=$(npm pack --silent)
+          tar -tzf "$PACKFILE" \
+            | grep -v '/$' \
             | sort \
             | while read -r file; do
-              echo "$(sha256sum "$file" | head -c 64)  $file"
-            done > checksums.txt
+                hash=$(tar -xOf "$PACKFILE" "$file" | sha256sum | head -c 64)
+                echo "$hash  $file"
+              done > checksums.txt
+          rm -f "$PACKFILE"
           test -s checksums.txt
       - run: "npm --workspace @probo/skills publish --access public --dry-run"
       - run: "npm --workspace @probo/skills publish --access public"

packages/skills/CHANGELOG.md

@@ -27,3 +27,7 @@ this file.
 
 - Package published as `@probo/skills` in `packages/skills/` (multi-agent
   scope, not Claude-specific)
+- Access-review skill records entry notes only after successful API writes
+- Release checksums derived from `npm pack` tarball contents
+- Validation enforces `.claude-plugin/marketplace.json`; `package.json` files
+  list trimmed to paths that exist

packages/skills/COMPATIBILITY.md

@@ -1,3 +1,19 @@
+<!--
+Copyright (c) 2026 Probo Inc <hello@probo.com>.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+-->
+
 # Multi-agent compatibility
 
 `@probo/skills` targets **Claude Code**, **Codex**, **OpenCode**, and

packages/skills/README.md

@@ -76,8 +76,6 @@ claude --plugin-dir ./packages/skills
 | MCP | `.mcp.json` | Probo API connection |
 | Skills | `skills/` | Compliance workflows |
 | Commands | `commands/` | `access-review`, `missing-signatures` — semi-auto workflows |
-| Agents | `agents/` | Reserved |
-| Hooks | `hooks/` | Reserved |
 
 Skills: `/probo:<skill-name>` (e.g. `/probo:open-source-compliance`, `/probo:missing-signatures`).
 

packages/skills/package.json

@@ -18,9 +18,6 @@
     ".agents",
     "skills",
     "commands",
-    "agents",
-    "hooks",
-    "bin",
     ".mcp.json",
     "README.md",
     "COMPATIBILITY.md"

packages/skills/scripts/validate.mjs

@@ -20,6 +20,7 @@ const root = join(dirname(fileURLToPath(import.meta.url)), "..");
 
 const requiredPaths = [
   ".claude-plugin/plugin.json",
+  ".claude-plugin/marketplace.json",
   ".codex-plugin/plugin.json",
   ".agents/plugins/marketplace.json",
   ".mcp.json",

packages/skills/skills/access-review/SKILL.md

@@ -54,15 +54,18 @@ Apply `references/decision-rubric.md`:
 | --- | --- |
 | **Auto** | Queue for `recordAccessReviewEntryDecisions` |
 | **Ambiguous** | Present to user; do not write yet |
-| **Skip** | Log in notes only |
+| **Skip** | Log in notes only (no API write) |
 
-Append each auto decision to the notes file before writing.
+Hold auto decisions in memory until step 4 succeeds — do not append them to the
+notes file yet.
 
 ### 4. Write auto decisions
 
 - Batch via `recordAccessReviewEntryDecisions` when possible.
 - Non-`APPROVED` decisions **must** include `decision_note`.
-- On MCP error, stop and do not advance `last_cursor`.
+- On MCP error, stop and do not advance `last_cursor` or update entry notes.
+- After a successful API response, append each recorded auto decision to the
+  notes file `## Entry notes` table.
 
 ### 5. Present ambiguous entries
 

packages/skills/skills/access-review/references/notes-format.md

@@ -40,7 +40,7 @@ updated_at: <ISO-8601 UTC>
 | --- | --- |
 | `last_cursor` | Empty on fresh run. Set to `listAccessEntries` `next_cursor` after each successful batch. Clear when null (pagination done). |
 | `updated_at` | Update on every file write |
-| `auto` column | `yes` if written via semi-auto rubric; `no` if user confirmed |
+| `auto` column | `yes` after a successful API write via semi-auto rubric; `no` if user confirmed |
 | Session log | Append-only; one line per batch or major event |
 | Ambiguous table | Remove rows after user confirms and decision is recorded |
 
@@ -51,7 +51,7 @@ updated_at: <ISO-8601 UTC>
 3. Continue `listAccessEntries` from `last_cursor` if set; otherwise start from
    the first pending page.
 4. Do not duplicate entry notes for IDs already in the table with a final
-   decision.
+   decision recorded after a successful API write.
 
 ## Git
 

packages/skills/skills/missing-signatures/references/mcp-tools.md

@@ -16,7 +16,7 @@ Resolve profile display fields. `users[]` entries are `Profile` objects.
 
 | Field | Usage |
 | --- | --- |
-| `organization_id` | Organization GID |
+| `organization_id` | Required — organization GID |
 | `size` | Page size; use `100` when prefetching is helpful |
 | `cursor` | Pagination |