
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@meridiantoolkit/skills
Advanced tools
Agent skills for the Meridian business-services platform (workflow, service catalog, requests, payments, i18n). Works as a pi package or a Claude Code plugin.
Agent skills for the Meridian platform — user-facing skills for customers using Meridian through an API key (mrd_). Same SKILL.md files work as a pi Agent Skill package or a Claude Code plugin (.claude-plugin/plugin.json included) — no code, so nothing to port. Codex CLI has no skills concept; Codex users get the same coverage through the meridian MCP server's tool descriptions instead (see meridian-mcp).
| Skill | Trigger |
|---|---|
meridian-api | API key, connect, authenticate, Bearer token, rate limits |
meridian-services | browse services, categories, requirements, form fields |
meridian-requests | create request, track status, chat, upload documents |
meridian-payments | quote, pay — Flouci (Tunisia, local) or Stripe (international), verify |
meridian-meetings | list/create meetings, RSVP, Teams join link |
All skills assume Authorization: Bearer mrd_… and MERIDIAN_API_URL. See meridian-api first to connect.
pi:
pi install ./meridian-skills # project-local
pi install /absolute/path/to/meridian-skills # global
# or via npm after publish
pi install npm:@meridiantoolkit/skills
Or add to .pi/settings.json:
{ "skills": ["/absolute/path/to/meridian-skills/skills"] }
Claude Code:
/plugin marketplace add meridian-silkdev/meridian-plugin
/plugin install meridian-skills@meridian
Invocation syntax differs by host — the skill names themselves don't:
| Skill | pi | Claude Code |
|---|---|---|
meridian-api | /skill:meridian-api | /meridian-api |
meridian-services | /skill:meridian-services | /meridian-services |
meridian-requests | /skill:meridian-requests | /meridian-requests |
meridian-payments | /skill:meridian-payments | /meridian-payments |
meridian-meetings | /skill:meridian-meetings | /meridian-meetings |
Either host can also load a skill automatically when its description matches what you're asking for — you don't have to type the slash form.
.github/workflows/ci.yml — every push to main and every PR: installs the claude CLI and runs claude plugin validate ...github/workflows/publish.yml — fires on a published GitHub Release: validates, checks the release tag against both package.json and .claude-plugin/plugin.json versions, then npm publish --provenance via npm Trusted Publishing (OIDC) — no NPM_TOKEN secret needed. npm version <bump> keeps both version fields in sync automatically (see scripts/sync-plugin-version.mjs). Note this only covers the pi install npm:@meridiantoolkit/skills path — Claude Code installs straight from the git repo/tag and needs no publish step.One-time setup after the first manual publish: npmjs.com → package settings → Trusted Publisher → GitHub Actions → meridian-silkdev/meridian-skills, workflow publish.yml.
FAQs
Agent skills for the Meridian business-services platform (workflow, service catalog, requests, payments, i18n). Works as a pi package or a Claude Code plugin.
The npm package @meridiantoolkit/skills receives a total of 0 weekly downloads. As such, @meridiantoolkit/skills popularity was classified as not popular.
We found that @meridiantoolkit/skills demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.