SkillHub v0.2.23, Run Locally: A New Avatar, the Same Package Version

Description and use

В SkillHub v0.2.23 локально сохранили новый аватар без создания

Problem

Changing a skill's visual identity should not require uploading another package version. Access changes also need a clear boundary: making a skill public and making it private have different consequences.

Outcome

A recognizable new avatar was saved while the package version stayed at v1.0.0. Public expansion waited for review and then became public after approval; private restriction took effect immediately with no new review task or package version. A successful invitation left a readable join record showing 'Used', the joining identity, and the join timestamp.

Workflow

• In My Skills, choose an image, adjust the native crop, and save the avatar. Check that the result appears on the skill detail page while the package version stays at v1.0.0.
• Request a change from Private to Public. Observe that it remains private while waiting for review.
• After existing scan and administrator review completes, the same skill's page shows Public.
• Tighten the scope back to Private. Observe that the restriction takes effect immediately with no new review task and no new package version.
• A recipient confirms the join in the native invitation page. Open invitation history to see 'Used', the joining identity 'Local Developer', and the join timestamp.

Evidence

In My Skills, we chose an image, adjusted the native crop, and saved the avatar. The result appeared on the skill detail page. The demonstration skill remained @studio/brand-brief, with display name Release Intelligence and package version v1.0.0. No replacement skill package was uploaded for this change.

Source

The useful distinction is between presentation and installation identity. The avatar and display name help people recognize a skill; its installation coordinate identifies the package. In this run, the avatar update preserved that coordinate and version.

Source

We requested a change from Private to Public. It remained private while the request waited for review. After the existing scan and administrator review completed, the same skill's page showed Public.

Source

We then tightened the scope back to Private. This restriction took effect immediately, with no new review task and no new package version. The recorded result still showed v1.0.0.

Source

This is an asymmetric boundary: expanding access goes through review; restricting access can take effect immediately.

Source

A recipient confirmed the join in the native invitation page. The team gained one new member. Opening invitation history showed Used, the joining identity Local Developer, and the join timestamp. These are fictional local identities, not production users.

Source

Invitation history records the join; it does not represent current membership. Reopening the link as the same member was idempotent, so we do not present that as a test with a second new recipient.

Source