Remove virus-scan from the repo and keep the pack on the canonical 4-skill surface

The desired production state is a 4-skill pack with no legacy alias in GitHub
or the source tree. This removes virus-scan from the manifest, README, and
skill directories, and keeps CI aligned with the canonical pack while still
explicitly failing if the removed name reappears in the README.

Constraint: Keep GitHub/source clean even if external skills.sh caching still lags behind
Rejected: Preserve virus-scan as a legacy alias | the user explicitly does not want it on GitHub or in the repo
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: Treat the 4 canonical skills as the only pack API; if a stale external page remains, fix it externally rather than carrying the alias in source
Tested: Local `npx skills add . --list --full-depth`; local isolated `--all` install from repo path; local search confirms only the workflow guard string mentions virus-scan
Not-tested: External skills.sh cache refresh timing after push; GitHub Actions execution after push

Author: jasperdevs

.github/workflows/verify-pack.yml

@@ -80,34 +80,6 @@ jobs:
             if (manifest.aliases && !Array.isArray(manifest.aliases)) {
               fail("Manifest aliases must be an array when present.");
             }
-
-            for (const alias of manifest.aliases ?? []) {
-              if (!alias.name || !alias.path || !alias.replaced_by) {
-                fail(`Alias entry is missing required fields: ${JSON.stringify(alias)}`);
-              }
-              if (seenNames.has(alias.name)) {
-                fail(`Duplicate manifest entry for alias: ${alias.name}`);
-              }
-              if (!alias.deprecated) {
-                fail(`Alias ${alias.name} must be marked deprecated.`);
-              }
-              if (!canonicalNames.has(alias.replaced_by)) {
-                fail(`Alias ${alias.name} points to missing replacement target: ${alias.replaced_by}`);
-              }
-              seenNames.add(alias.name);
-              const aliasPath = path.resolve(alias.path);
-              const aliasFile = path.join(aliasPath, "SKILL.md");
-              if (!fs.existsSync(aliasPath) || !fs.statSync(aliasPath).isDirectory()) {
-                fail(`Alias path does not exist: ${alias.path}`);
-              }
-              if (!fs.existsSync(aliasFile)) {
-                fail(`Alias is missing SKILL.md: ${alias.path}`);
-              }
-              const frontmatterName = readFrontmatterName(aliasFile);
-              if (frontmatterName !== alias.name) {
-                fail(`Manifest alias/path mismatch for ${alias.name}; SKILL.md declares ${frontmatterName}`);
-              }
-            }
           '
 
       - name: Verify discovery output matches manifest
@@ -117,10 +89,7 @@ jobs:
           OUTPUT="$OUTPUT" node -e '
             const fs = require("fs");
             const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
-            const names = [
-              ...manifest.skills.map((skill) => skill.name),
-              ...(manifest.aliases ?? []).map((skill) => skill.name),
-            ];
+            const names = manifest.skills.map((skill) => skill.name);
             const output = process.env.OUTPUT ?? "";
             const missing = names.filter((name) => !output.includes(name));
             if (missing.length) {
@@ -149,10 +118,7 @@ jobs:
             const fs = require("fs");
             const path = require("path");
             const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
-            const expected = [
-              ...manifest.skills.map((skill) => skill.name),
-              ...(manifest.aliases ?? []).map((skill) => skill.name),
-            ].sort();
+            const expected = manifest.skills.map((skill) => skill.name).sort();
             const installedDir = path.join(process.env.TMP_DIR, ".agents", "skills");
             const installed = fs.readdirSync(installedDir, { withFileTypes: true })
               .filter((entry) => entry.isDirectory())
@@ -166,26 +132,13 @@ jobs:
             }
           '
 
-      - name: Verify deprecated alias install path still works
-        env:
-          PACK_SOURCE: ${{ github.workspace }}
-        run: |
-          TMP_DIR="$(mktemp -d)"
-          pushd "$TMP_DIR" >/dev/null
-          npx skills add "$PACK_SOURCE" -y --agent codex --skill virus-scan --copy
-          popd >/dev/null
-          test -f "$TMP_DIR/.agents/skills/virus-scan/SKILL.md"
-
       - name: Verify README stays aligned with pack surface
         run: |
           node -e '
             const fs = require("fs");
             const manifest = JSON.parse(fs.readFileSync("skills-pack.json", "utf8"));
             const readme = fs.readFileSync("README.md", "utf8");
-            const names = [
-              ...manifest.skills.map((skill) => skill.name),
-              ...(manifest.aliases ?? []).map((skill) => skill.name),
-            ];
+            const names = manifest.skills.map((skill) => skill.name);
             for (const skillName of names) {
               const installNeedle = `--skill ${skillName}`;
               const commandNeedle = `\`$${skillName}\``;
@@ -198,4 +151,8 @@ jobs:
                 process.exit(1);
               }
             }
+            if (readme.includes("virus-scan")) {
+              console.error("README still contains removed skill name: virus-scan");
+              process.exit(1);
+            }
           '

README.md

@@ -18,7 +18,6 @@ npx skills add https://github.com/jasperdevs/computer-doctor --skill computer-do
 npx skills add https://github.com/jasperdevs/computer-doctor --skill security-scan
 npx skills add https://github.com/jasperdevs/computer-doctor --skill devtools-audit
 npx skills add https://github.com/jasperdevs/computer-doctor --skill update-audit
-npx skills add https://github.com/jasperdevs/computer-doctor --skill virus-scan
 ```
 
 </details>
@@ -31,7 +30,6 @@ npx skills add https://github.com/jasperdevs/computer-doctor --skill virus-scan
 | `$security-scan` | Endpoint protection, firewall status, suspicious processes, persistence, autoruns, risky permissions, and obvious malware signals. | [open](https://skills.sh/jasperdevs/computer-doctor/security-scan) |
 | `$devtools-audit` | PATH problems, shell setup, runtimes, SDKs, package managers, Git tooling, and dead or conflicting installs. | [open](https://skills.sh/jasperdevs/computer-doctor/devtools-audit) |
 | `$update-audit` | OS updates, outdated apps, drivers where visible, runtimes, package managers, and better replacement choices. | [open](https://skills.sh/jasperdevs/computer-doctor/update-audit) |
-| `$virus-scan` | Legacy alias for `$security-scan`. Prefer `$security-scan`, but this keeps older links and installs understandable. | [open](https://skills.sh/jasperdevs/computer-doctor/virus-scan) |
 
 The canonical pack surface is tracked in [skills-pack.json](./skills-pack.json).
 

skills-pack.json

@@ -18,13 +18,5 @@
       "name": "update-audit",
       "path": "skills/update-audit"
     }
-  ],
-  "aliases": [
-    {
-      "name": "virus-scan",
-      "path": "skills/virus-scan",
-      "deprecated": true,
-      "replaced_by": "security-scan"
-    }
   ]
 }