0.2.1 — the README names both ways to reach a skill

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "telegram-dev",
       "displayName": "Telegram Dev",
       "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-      "version": "0.2.0",
+      "version": "0.2.1",
       "author": {
         "name": "ssheleg",
         "url": "https://x.com/sshlg93"

CHANGELOG.md

@@ -1,3 +1,11 @@
+## v0.2.1 — the README names both ways to reach a skill
+
+Hygiene from the 2026-09-13 family audit (HK-11). The install section showed four
+channels and no invocation form, so a reader who installed the pack had nothing telling
+them what to type. Both forms are written — `/telegram-dev:<skill>` and `/<skill>` —
+because which one resolves depends on how the pack was installed, and promising one is
+how a reader concludes the skill is not there.
+
 ## v0.2.0 — the userbot reference stops hiding its second half
 
 Sherlock external-v3 (12 findings) plus the House audit gap that surfaced with them.

README.md

@@ -109,6 +109,11 @@ The whole family in one command:
 npx sshlg-skills install
 ```
 
+**Reaching a skill by name.** Claude Code routes on the description and both
+invocation forms work: `/telegram-dev:telegram-bots` names the plugin's copy
+explicitly, `/telegram-bots` the plain one. Which of the two resolves depends on how
+this pack was installed, so both are written here rather than one promised.
+
 ## Development
 
 <!-- commands-run-in: a clone -->

SKILL-CARD.md

@@ -5,7 +5,7 @@
 | Field | Value |
 |---|---|
 | Pack | `telegram-dev` |
-| Version | `0.2.0` |
+| Version | `0.2.1` |
 | Skills | `telegram-bots`, `telegram-userbots`, `telegram-miniapps` |
 | License | MIT |
 | Source | https://github.com/ssheleg/telegram-dev |

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/telegram-dev",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Three skills for building on Telegram, separated by which API each one speaks: the official HTTP Bot API for bots, MTProto (Telethon) for user accounts, and Mini Apps for the web layer whose whole security model is one signed blob.",
   "bin": {
     "telegram-dev": "bin/telegram-dev.js"

plugins/telegram-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "telegram-dev",
   "displayName": "Telegram Dev",
   "description": "Telegram development, split by the API each surface actually speaks. telegram-bots covers the official HTTP Bot API \u2014 update_id as the only idempotency key, the allowed_updates default that drops three types in silence, the webhook secret header, rate limits as a design constraint, and Telegram Stars with its ten-second pre-checkout window. telegram-userbots covers MTProto and Telethon \u2014 the session file as a credential equal to the password, FloodWaitError as the API working rather than failing, and the account-ban risk a bot token does not carry. telegram-miniapps covers initData verification, the algorithm shipped as a runnable fixture, and the SDK package whose name moved.",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"