Remove the stale virus-scan surface and lock the pack back to 4 skills

The compatibility alias solved a temporary external mismatch, but the desired
steady state is a canonical 4-skill pack with no `virus-scan` surface at all.
This removes the alias from the repo, README, and manifest, and adds a README
check in CI so the public GitHub surface stays aligned with the canonical pack
inventory.

Constraint: Make the pack production-ready without reintroducing unnecessary alias or compatibility complexity
Rejected: Keep virus-scan as a permanent alias | adds long-term drift surface the user explicitly does not want
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Treat the 4 canonical skills as the pack API; if a compatibility alias is ever reintroduced, it should be explicitly time-bounded and removed once external drift is resolved
Tested: Local `npx skills add . --list --full-depth`; local isolated `--all` install from repo path; local README/manifest sync check
Not-tested: External skills.sh cache refresh timing after push; GitHub Actions execution after push

Author: jasperdevs

.github/workflows/verify-pack.yml

@@ -77,32 +77,8 @@ jobs:
               }
             }
 
-            for (const alias of manifest.aliases ?? []) {
-              if (!alias.name || !alias.path || !alias.replaced_by) {
-                fail(`Alias entry is missing required fields: ${JSON.stringify(alias)}`);
-              }
-              if (seenNames.has(alias.name)) {
-                fail(`Duplicate manifest entry for alias: ${alias.name}`);
-              }
-              if (!alias.deprecated) {
-                fail(`Alias ${alias.name} must be marked deprecated.`);
-              }
-              if (!canonicalNames.has(alias.replaced_by)) {
-                fail(`Alias ${alias.name} points to missing replacement target: ${alias.replaced_by}`);
-              }
-              seenNames.add(alias.name);
-              const aliasPath = path.resolve(alias.path);
-              const aliasFile = path.join(aliasPath, "SKILL.md");
-              if (!fs.existsSync(aliasPath) || !fs.statSync(aliasPath).isDirectory()) {
-                fail(`Alias path does not exist: ${alias.path}`);
-              }
-              if (!fs.existsSync(aliasFile)) {
-                fail(`Alias is missing SKILL.md: ${alias.path}`);
-              }
-              const frontmatterName = readFrontmatterName(aliasFile);
-              if (frontmatterName !== alias.name) {
-                fail(`Manifest alias/path mismatch for ${alias.name}; SKILL.md declares ${frontmatterName}`);
-              }
+            if (manifest.aliases && !Array.isArray(manifest.aliases)) {
+              fail("Manifest aliases must be an array when present.");
             }
           '
 
@@ -113,16 +89,21 @@ jobs:
           OUTPUT="$OUTPUT" node -e '
             const fs = require("fs");
             const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
-            const names = [
-              ...manifest.skills.map((skill) => skill.name),
-              ...(manifest.aliases ?? []).map((skill) => skill.name),
-            ];
+            const names = manifest.skills.map((skill) => skill.name);
             const output = process.env.OUTPUT ?? "";
             const missing = names.filter((name) => !output.includes(name));
             if (missing.length) {
               console.error("Missing skills in discovery output:", missing.join(", "));
               process.exit(1);
             }
+            const unexpected = (output.match(/^\s*[A-Za-z0-9-]+$/gm) ?? [])
+              .map((line) => line.trim())
+              .filter((line) => line && !["Available Skills", "Use --skill <name> to install specific skills"].includes(line))
+              .filter((line) => !names.includes(line));
+            if (unexpected.length) {
+              console.error("Unexpected skills in discovery output:", unexpected.join(", "));
+              process.exit(1);
+            }
           '
 
       - name: Verify isolated --all install
@@ -137,10 +118,7 @@ jobs:
             const fs = require("fs");
             const path = require("path");
             const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
-            const expected = [
-              ...manifest.skills.map((skill) => skill.name),
-              ...(manifest.aliases ?? []).map((skill) => skill.name),
-            ].sort();
+            const expected = manifest.skills.map((skill) => skill.name).sort();
             const installedDir = path.join(process.env.TMP_DIR, ".agents", "skills");
             const installed = fs.readdirSync(installedDir, { withFileTypes: true })
               .filter((entry) => entry.isDirectory())
@@ -154,12 +132,26 @@ jobs:
             }
           '
 
-      - name: Verify deprecated alias install path still works
-        env:
-          PACK_SOURCE: ${{ github.workspace }}
+      - name: Verify README stays aligned with canonical skills
         run: |
-          TMP_DIR="$(mktemp -d)"
-          pushd "$TMP_DIR" >/dev/null
-          npx skills add "$PACK_SOURCE" -y --agent codex --skill virus-scan --copy
-          popd >/dev/null
-          test -f "$TMP_DIR/.agents/skills/virus-scan/SKILL.md"
+          node -e '
+            const fs = require("fs");
+            const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
+            const readme = fs.readFileSync("README.md", "utf8");
+            for (const skill of manifest.skills) {
+              const installNeedle = `--skill ${skill.name}`;
+              const commandNeedle = `\`$${skill.name}\``;
+              if (!readme.includes(installNeedle)) {
+                console.error(`README is missing install command for ${skill.name}`);
+                process.exit(1);
+              }
+              if (!readme.includes(commandNeedle)) {
+                console.error(`README is missing command table entry for ${skill.name}`);
+                process.exit(1);
+              }
+            }
+            if (readme.includes("virus-scan")) {
+              console.error("README still contains removed skill name: virus-scan");
+              process.exit(1);
+            }
+          '

README.md

@@ -18,7 +18,6 @@ npx skills add https://github.com/jasperdevs/computer-doctor --skill computer-do
 npx skills add https://github.com/jasperdevs/computer-doctor --skill security-scan
 npx skills add https://github.com/jasperdevs/computer-doctor --skill devtools-audit
 npx skills add https://github.com/jasperdevs/computer-doctor --skill update-audit
-npx skills add https://github.com/jasperdevs/computer-doctor --skill virus-scan
 ```
 
 </details>
@@ -31,7 +30,6 @@ npx skills add https://github.com/jasperdevs/computer-doctor --skill virus-scan
 | `$security-scan` | Endpoint protection, firewall status, suspicious processes, persistence, autoruns, risky permissions, and obvious malware signals. | [open](https://skills.sh/jasperdevs/computer-doctor/security-scan) |
 | `$devtools-audit` | PATH problems, shell setup, runtimes, SDKs, package managers, Git tooling, and dead or conflicting installs. | [open](https://skills.sh/jasperdevs/computer-doctor/devtools-audit) |
 | `$update-audit` | OS updates, outdated apps, drivers where visible, runtimes, package managers, and better replacement choices. | [open](https://skills.sh/jasperdevs/computer-doctor/update-audit) |
-| `$virus-scan` | Deprecated compatibility alias for `$security-scan`. Keep using it only if you still rely on the old command name. | [open](https://skills.sh/jasperdevs/computer-doctor/virus-scan) |
 
 The canonical pack surface is tracked in [skills-pack.json](./skills-pack.json).
 

skills-pack.json

@@ -18,13 +18,5 @@
       "name": "update-audit",
       "path": "skills/update-audit"
     }
-  ],
-  "aliases": [
-    {
-      "name": "virus-scan",
-      "path": "skills/virus-scan",
-      "deprecated": true,
-      "replaced_by": "security-scan"
-    }
   ]
 }