[matanyall]

Polylane's public skills repository has client plugin manifests but no official MCP Registry metadata, Glama ownership metadata, or Gemini CLI extension. Add server.json, glama.json, gemini-extension.json, and a standalone root polylane-connect skill while preserving the existing plugin registrations and two detailed skills.

The registry manifest advertises only the authenticated product MCP endpoint. Gemini registers both product and documentation endpoints using Streamable HTTP. The README skills command now uses --full-depth --skill polylane polylane-cli because a root skill otherwise stops discovery in the pinned installer.

docs/registry-discovery.md cites authoritative formats and documents the separate MCP publishing, Glama claim, Gemini gallery topic, and skill-directory steps. It corrects the source article's automatic listing claim. No registry submissions, claims, account creation, topic changes, or publishing are performed. This repository contains client configuration, not the hosted server implementation, so the registry source-code repository field is omitted.

Validation at e43b96c:

• GitHub Actions manifest validation passed: official MCP/Glama schemas, endpoint consistency, Gemini configuration, all skill frontmatter, and Cursor schemas.
• Local scripts/validate.sh passed, including Claude's strict plugin checks and Cursor schemas.
• Root skill passed Codex's standalone skill validator. The bundled Codex plugin validator was unavailable and skipped.
• Pinned skills CLI discovery with --full-depth found all three skills, including both existing detailed skills; telemetry disabled, no installation performed.
• Polylane security and production-impact check runs completed successfully with no actionable findings. The impact report explicitly says production impact was not verified because it found no production consumer for this repository.
• No authenticated Gemini session was tested.

No Claude review workflow is configured in this repository. Human approval requested from boristane and still pending. Do not merge automatically.

[polylane]

Warning

Polylane could not verify the production impact of this pull request.

This change adds only client-side manifests, docs and CI to coreplanelabs/skills, which no production resource deploys or executes; an issue search scoped to this repository returned nothing and the workspace graph shows no production consumer. The new workflow runs PR-controlled code with a read-only token and no secrets, so it cannot reach production.

Check	Result
Impact assessment	Production impact not verified
Security review	Passed · 1 ruled out

View the full analysis →

Also considered · 3 refuted

• Refuted · Root SKILL.md stops pinned skills CLI from discovering the two existing skills · The path is a client-side installer on the user's machine, not a production resource: nothing in the attached Cloudflare, AWS, GCP, PlanetScale or Vercel accounts runs this repository's files.
• Refuted · server.json / gemini-extension.json repoint clients at a wrong production MCP endpoint · The new manifests advertise https://mcp.polylane.com/mcp, matching the existing mcp.json and .mcp.json in the tree, and the new CI check scripts/validate-discovery.py asserts server.remotes equals mcp.json's polylane url and that the Gemini httpUrls equal both registered urls.
• Refuted · New validate.yml workflow executes attacker-controlled PR script with write access or secrets · The workflow uses the pull_request trigger (not pull_request_target) with permissions: contents: read, so the job receives a read-only GITHUB_TOKEN and no repository secrets; both actions are pinned by full commit SHA and the run step has no ${{ }} interpolation.

Dependency changes

Package	Change	Jump	Release age
jsonschema	added 4.25.1	—	15 months
pyyaml	added 6.0.3	—	13 months

Analysed against 8 cloud accounts and 1 repository

• Cloud accounts: coreplane-prod, baseberry-uat, coreplane-infra, coreplane, coreplane-gtm, 251714435813, Polylane, nominal-493716
• Repository: coreplanelabs/skills

Polylane could not find the cloud resources this repository manages, so this review looked at the entire cloud account. Connect this repository to its resources and the next review will focus on exactly what this code deploys to.

_{Polylane analysed e43b96c for production impact and security. You can ask follow-ups by mentioning @polylane in a comment.}