Repository navigation
Review vendored packs: drop candidates, licences, and the C# conventions gap #107
Description
Activity
Factual correction, shared with #100
Both issues state that qedgen's
MISTRAL_API_KEYis missing from.env.example. It is present at.env.example:11. OnlyARISTOTLE_API_KEYis genuinely absent.Direct conflict with #98 on
solana-newThis issue wants
solana-newregistry-only (telemetry preambles); #98 wants it promoted to core, because the three shipped go-to-market skills link into it 36 times (idea-sprint23,pitch-deck8,hackathon5) plus 44 occurrences underplugin/, whereext/never exists."Core" means vendored into every install; "registry-only" means not a submodule at all. These cannot both happen. Registry-only would also permanently break the dead-link gate at
tests/test_skill_extensions.sh:126-152, which tolerates an unresolvedext/link only when the same line offersskills.sh add <pack>.Suggested ordering: settle this issue's licence clearance before #98 promotes anything, since #98's candidates include
trailofbits(CC-BY-SA-4.0 share-alike) and the core tier already containssafe-solana-builderwith no LICENSE file. Promoting into every install is the moment redistribution exposure becomes real.#100's registry-accuracy work feeds both and should land first. Its other claims verified:
meteora-sdk-skillsource 404s;get-shit-doneis ARCHIVED while the registry sayssafety: clean;emilkowalski/skillis nowemilkowalski/skills(MIT, ~42.6k stars, pushed 2026-09-23) against the registry'snone/unspecified, 2400 stars, "stale (~Mar 2026)"; exactly 7 entries share the placeholderlast_commit: 2026-06-15; 38 of 59 entries are untiered.
The kit vendors (redistributes) every
ext/pack as a submodule. Some are hard to justify or carry licence risk.Drop or move to registry-only
solana-gameqedgenMISTRAL_API_KEY(upstream also mentionsARISTOTLE_API_KEY), neither in.env.example. About 11 MB, the largest pack.eth-to-solsolana-devcovers EVM migration.solana-newsafetynotes telemetry preambles that POST usage events. Disclose this in the README, or move it to registry-only. Also see #98, since bundled skills depend on it.Licence
Of the packs we redistribute, these don't grant redistribution in a LICENSE file:
colosseumCOLOSSEUM_COPILOT_PATmetaplexvercelsafe-solana-buildertrailofbitsdefending-codeis fine: Apache-2.0 LICENSE file (GitHub shows NOASSERTION because of edits to the file).C# conventions
The old
rules/dotnet.mdwas deleted in the token cut.unity-engineernow links only toext/solana-game/skill/csharp-patterns.md(an extension). Theglobal.jsonSDK-pinning guidance survives nowhere. Ifsolana-gameis dropped or stays an extension, decide whether Unity work gets a small kit-owned conventions file.To do
metaplex,vercelandsafe-solana-builderto add LICENSE files. Get permission from Colosseum or stop vendoring it..gitmodules, registry, README, hub, tests).