@hasnatools/skills 0.1.8 → 0.1.9

package/dist/index.js

@@ -20709,6 +20709,12 @@ async function getMarketplaceSkills(options) {
   const query = params.toString();
   return apiRequest(`/skills${query ? `?${query}` : ""}`);
 }
+async function getSkill(slug) {
+  return apiRequest(`/skills/${slug}`);
+}
+async function downloadSkill(slug) {
+  return apiRequest(`/skills/${slug}/download?format=json`);
+}
 async function installSkill(slug) {
   return apiRequest(`/skills/${slug}/install`);
 }
@@ -20916,6 +20922,7 @@ async function logoutCommand() {
   clearApiKey();
   console.log(source_default.green("✓") + " Logged out successfully");
 }
+var indigo = source_default.hex("#6366f1");
 async function whoamiCommand() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -20932,12 +20939,18 @@ async function whoamiCommand() {
   }
   spinner.stop();
   console.log();
-  console.log(source_default.bold("Account Information"));
+  console.log(indigo.bold("Account Information"));
   console.log();
-  console.log("  Email:   " + source_default.cyan(result.data.email));
-  console.log("  Name:    " + result.data.name);
+  console.log("  Email:   " + indigo(result.data.email));
+  console.log("  Name:    " + (result.data.name || source_default.dim("Not set")));
   console.log("  Plan:    " + source_default.bold(result.data.plan));
-  console.log("  Credits: " + source_default.bold(result.data.creditsBalance));
+  console.log();
+  console.log(indigo.bold("Organization"));
+  console.log();
+  console.log("  Name:    " + (result.data.tenantName || source_default.dim("Personal")));
+  console.log("  Slug:    " + indigo(result.data.tenantSlug || result.data.tenantId));
+  console.log();
+  console.log(source_default.dim("Run `skills credits` to check your balance"));
   console.log();
 }
 function sleep(ms) {
@@ -21080,9 +21093,179 @@ async function uninstallCommand(slug, options = {}) {
   }
 }
 
+// src/commands/download.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join4, normalize, basename, dirname, isAbsolute } from "path";
+var indigo2 = source_default.hex("#6366f1");
+function validateFilename(filename) {
+  if (!filename || filename.trim() === "") {
+    return null;
+  }
+  if (isAbsolute(filename)) {
+    return null;
+  }
+  const normalized = normalize(filename);
+  if (normalized.startsWith("..") || normalized.includes("/../") || normalized.includes("\\..\\")) {
+    return null;
+  }
+  if (normalized.startsWith("/") || normalized.startsWith("\\")) {
+    return null;
+  }
+  if (filename.includes("\x00")) {
+    return null;
+  }
+  const rootFile = normalized.split(/[/\\]/)[0];
+  if (rootFile.startsWith(".") && rootFile !== ".") {
+    return null;
+  }
+  const allowedExtensions = [
+    ".md",
+    ".ts",
+    ".js",
+    ".mjs",
+    ".cjs",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".txt",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".py",
+    ".rb",
+    ".go",
+    ".rs",
+    ".css",
+    ".html",
+    ".svg",
+    ".toml",
+    ".env.example"
+  ];
+  const ext = filename.substring(filename.lastIndexOf(".")).toLowerCase();
+  const hasValidExtension = allowedExtensions.some((allowed) => filename.toLowerCase().endsWith(allowed));
+  const isKnownFile = ["LICENSE", "README", "CHANGELOG", "AUTHORS", "CONTRIBUTORS"].some((known) => basename(filename).toUpperCase() === known);
+  if (!hasValidExtension && !isKnownFile && ext.length > 0) {
+    console.log(source_default.yellow(`  Skipping file with disallowed extension: ${filename}`));
+    return null;
+  }
+  return normalized;
+}
+function validateSlug(slug) {
+  const validSlugPattern = /^[a-z0-9][a-z0-9-_]*[a-z0-9]$|^[a-z0-9]$/i;
+  return validSlugPattern.test(slug) && slug.length <= 64;
+}
+function safeJoin(basePath, relativePath) {
+  const validated = validateFilename(relativePath);
+  if (!validated) {
+    return null;
+  }
+  const fullPath = join4(basePath, validated);
+  const normalizedBase = normalize(basePath);
+  const normalizedFull = normalize(fullPath);
+  if (!normalizedFull.startsWith(normalizedBase)) {
+    return null;
+  }
+  return fullPath;
+}
+async function downloadCommand(slug, options = {}) {
+  if (!slug || slug.trim() === "") {
+    console.log(source_default.yellow("Please provide a skill name"));
+    console.log(source_default.dim("Usage: skills download <name>"));
+    return;
+  }
+  if (!validateSlug(slug)) {
+    console.log(source_default.red("Invalid skill name format"));
+    console.log(source_default.dim("Skill names can only contain letters, numbers, hyphens, and underscores"));
+    return;
+  }
+  const isLocal = options.local ?? false;
+  const target = options.target ?? getDefaultTarget();
+  let installDir;
+  if (isLocal) {
+    if (!hasLocalConfig()) {
+      console.log(source_default.yellow("Not in a skills.md project"));
+      console.log(source_default.dim("Run `skills init` first or download globally (default)"));
+      return;
+    }
+    installDir = target === "claude" ? getProjectClaudeSkillsDir() : getProjectCodexSkillsDir();
+  } else {
+    installDir = target === "claude" ? getClaudeSkillsDir() : getCodexSkillsDir();
+  }
+  const spinner = ora(`Checking skill "${slug}"...`).start();
+  try {
+    const skillInfo = await getSkill(slug);
+    if (skillInfo.error || !skillInfo.data) {
+      spinner.fail("Skill not found");
+      console.error(source_default.red(skillInfo.error || `Could not find skill: ${slug}`));
+      return;
+    }
+    spinner.text = `Downloading ${skillInfo.data.name}...`;
+    const result = await downloadSkill(slug);
+    if (result.error || !result.data) {
+      if (result.status === 404) {
+        spinner.fail("Skill not available for download");
+        console.log();
+        console.log(source_default.yellow("This skill is not downloadable."));
+        console.log(source_default.dim("Some skills are remote-execution only to protect source code."));
+        console.log();
+        console.log(source_default.dim("You can still use this skill via:"));
+        console.log(`  skills install ${slug}`);
+        console.log(`  skills run ${slug} -- "your prompt"`);
+      } else {
+        spinner.fail("Download failed");
+        console.error(source_default.red(result.error || "Unknown error"));
+      }
+      return;
+    }
+    spinner.text = `Installing ${result.data.name}...`;
+    const { name, version, files } = result.data;
+    const skillDir = join4(installDir, `skill-${slug}`);
+    const exportsDir = join4(skillDir, "exports");
+    const logsDir = join4(skillDir, "logs");
+    mkdirSync3(skillDir, { recursive: true });
+    mkdirSync3(exportsDir, { recursive: true });
+    mkdirSync3(logsDir, { recursive: true });
+    let filesWritten = 0;
+    let filesSkipped = 0;
+    for (const [relativePath, content] of Object.entries(files)) {
+      const safePath = safeJoin(skillDir, relativePath);
+      if (!safePath) {
+        console.log(source_default.yellow(`  Skipping unsafe path: ${relativePath}`));
+        filesSkipped++;
+        continue;
+      }
+      const parentDir = dirname(safePath);
+      if (!existsSync4(parentDir)) {
+        mkdirSync3(parentDir, { recursive: true });
+      }
+      writeFileSync4(safePath, content, "utf-8");
+      filesWritten++;
+    }
+    spinner.succeed(`Downloaded ${source_default.bold(name)} v${version}`);
+    console.log();
+    console.log(indigo2.bold("Download Summary"));
+    console.log();
+    console.log(source_default.green("  ✓") + ` Location: ${source_default.dim(skillDir)}`);
+    console.log(source_default.green("  ✓") + ` Files written: ${source_default.bold(filesWritten)}`);
+    if (filesSkipped > 0) {
+      console.log(source_default.yellow("  ⚠") + ` Files skipped: ${source_default.bold(filesSkipped)}`);
+    }
+    console.log(source_default.green("  ✓") + ` Target: ${source_default.bold(target)}`);
+    console.log(source_default.green("  ✓") + ` Scope: ${isLocal ? "project" : "global"}`);
+    console.log();
+    console.log(source_default.dim("This skill includes source code. You can:"));
+    console.log(source_default.dim("  • Read and modify the code locally"));
+    console.log(source_default.dim("  • Run it via remote API:") + ` skills run ${slug}`);
+    console.log();
+  } catch (error) {
+    spinner.fail("Download failed");
+    console.error(source_default.red(error instanceof Error ? error.message : "Unknown error"));
+  }
+}
+
 // src/commands/list.ts
-import { existsSync as existsSync4, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync2 } from "fs";
+import { join as join5 } from "path";
 async function listCommand(options = {}) {
   const isGlobal = options.global ?? false;
   const target = options.target ?? getDefaultTarget();
@@ -21128,15 +21311,15 @@ async function listCommand(options = {}) {
   }
   const installedSkills = [];
   for (const dir of dirs) {
-    if (!existsSync4(dir))
+    if (!existsSync5(dir))
       continue;
     const entries = readdirSync(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory())
         continue;
-      const skillDir = join4(dir, entry.name);
-      const skillMdPath = join4(skillDir, "SKILL.md");
-      if (!existsSync4(skillMdPath))
+      const skillDir = join5(dir, entry.name);
+      const skillMdPath = join5(skillDir, "SKILL.md");
+      if (!existsSync5(skillMdPath))
         continue;
       const content = readFileSync2(skillMdPath, "utf-8");
       const frontmatter = parseFrontmatter(content);
@@ -21283,8 +21466,8 @@ function getNestedValue(obj, path6) {
 }
 
 // src/commands/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4, mkdirSync as mkdirSync3, appendFileSync } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync3, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4, appendFileSync } from "fs";
+import { join as join6 } from "path";
 async function runCommand(slug, options = {}) {
   if (!slug || slug.trim() === "") {
     console.log(source_default.yellow("Please provide a skill name"));
@@ -21298,8 +21481,8 @@ async function runCommand(slug, options = {}) {
     console.log(source_default.dim("Run `skills install " + slug + "` to install it"));
     return;
   }
-  const skillMdPath = join5(skillDir, "SKILL.md");
-  if (!existsSync5(skillMdPath)) {
+  const skillMdPath = join6(skillDir, "SKILL.md");
+  if (!existsSync6(skillMdPath)) {
     console.log(source_default.red(`Invalid skill: missing SKILL.md`));
     return;
   }
@@ -21334,16 +21517,16 @@ Stderr:`));
     }
     console.log();
     console.log(source_default.dim("─".repeat(60)));
-    const exportsDir = join5(skillDir, "exports");
-    const logsDir = join5(skillDir, "logs");
-    if (!existsSync5(exportsDir)) {
-      mkdirSync3(exportsDir, { recursive: true });
+    const exportsDir = join6(skillDir, "exports");
+    const logsDir = join6(skillDir, "logs");
+    if (!existsSync6(exportsDir)) {
+      mkdirSync4(exportsDir, { recursive: true });
     }
-    if (!existsSync5(logsDir)) {
-      mkdirSync3(logsDir, { recursive: true });
+    if (!existsSync6(logsDir)) {
+      mkdirSync4(logsDir, { recursive: true });
     }
     const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
-    const logFile = join5(logsDir, `log_${timestamp}.txt`);
+    const logFile = join6(logsDir, `log_${timestamp}.txt`);
     const logContent = [
       `Execution ID: ${executionId}`,
       `Skill: ${slug}`,
@@ -21359,21 +21542,21 @@ Stderr:`));
 ${stderr}` : ""
     ].join(`
 `);
-    writeFileSync4(logFile, logContent);
+    writeFileSync5(logFile, logContent);
     const savedExports = [];
     if (exportFiles && exportFiles.length > 0) {
       for (const file of exportFiles) {
-        const exportPath = join5(exportsDir, `export_${timestamp}_${file.filename}`);
+        const exportPath = join6(exportsDir, `export_${timestamp}_${file.filename}`);
         const fileContent = Buffer.from(file.content, "base64");
-        writeFileSync4(exportPath, fileContent);
+        writeFileSync5(exportPath, fileContent);
         savedExports.push(exportPath);
       }
     }
     if (logFiles && logFiles.length > 0) {
       for (const file of logFiles) {
-        const logPath = join5(logsDir, `server_${timestamp}_${file.filename}`);
+        const logPath = join6(logsDir, `server_${timestamp}_${file.filename}`);
         const fileContent = Buffer.from(file.content, "base64");
-        writeFileSync4(logPath, fileContent);
+        writeFileSync5(logPath, fileContent);
       }
     }
     saveExecutionHistory({
@@ -21406,7 +21589,7 @@ function saveExecutionHistory(entry) {
   if (!projectOutputDir) {
     return;
   }
-  const historyFile = join5(projectOutputDir, "execution-history.jsonl");
+  const historyFile = join6(projectOutputDir, "execution-history.jsonl");
   try {
     appendFileSync(historyFile, JSON.stringify(entry) + `
 `);
@@ -21430,12 +21613,12 @@ function findSkillDir(slug, target) {
   }
   searchDirs.push(target === "claude" ? getClaudeSkillsDir() : getCodexSkillsDir());
   for (const dir of searchDirs) {
-    const newSkillDir = join5(dir, `skill-${slug}`);
-    if (existsSync5(newSkillDir)) {
+    const newSkillDir = join6(dir, `skill-${slug}`);
+    if (existsSync6(newSkillDir)) {
       return newSkillDir;
     }
-    const oldSkillDir = join5(dir, slug);
-    if (existsSync5(oldSkillDir)) {
+    const oldSkillDir = join6(dir, slug);
+    if (existsSync6(oldSkillDir)) {
       return oldSkillDir;
     }
   }
@@ -21499,8 +21682,8 @@ function parseSkillMd(content) {
 
 // src/commands/generate.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync6 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync7 } from "fs";
+import { join as join7 } from "path";
 import { homedir as homedir3 } from "os";
 var MEDIA_TYPES = ["image", "video", "audio", "text"];
 var LOCAL_SKILLS = {
@@ -21509,14 +21692,14 @@ var LOCAL_SKILLS = {
   audio: "generate-audio"
 };
 function findLocalSkill(skillName) {
-  const globalDir = join6(homedir3(), ".claude", "skills", skillName);
-  if (existsSync6(globalDir)) {
+  const globalDir = join7(homedir3(), ".claude", "skills", skillName);
+  if (existsSync7(globalDir)) {
     return globalDir;
   }
   const projectRoot = findProjectRoot();
   if (projectRoot) {
-    const projectDir = join6(projectRoot, ".claude", "skills", skillName);
-    if (existsSync6(projectDir)) {
+    const projectDir = join7(projectRoot, ".claude", "skills", skillName);
+    if (existsSync7(projectDir)) {
       return projectDir;
     }
   }
@@ -21524,8 +21707,8 @@ function findLocalSkill(skillName) {
 }
 async function runLocalSkill(skillDir, args) {
   return new Promise((resolve) => {
-    const skillMdPath = join6(skillDir, "SKILL.md");
-    if (!existsSync6(skillMdPath)) {
+    const skillMdPath = join7(skillDir, "SKILL.md");
+    if (!existsSync7(skillMdPath)) {
       resolve(false);
       return;
     }
@@ -21538,7 +21721,7 @@ async function runLocalSkill(skillDir, args) {
     const runScript = match[1].trim();
     const fullCommand = args.length > 0 ? `${runScript} ${args.join(" ")}` : runScript;
     const projectRoot = findProjectRoot();
-    const skillsOutputDir = projectRoot ? join6(projectRoot, ".skills") : null;
+    const skillsOutputDir = projectRoot ? join7(projectRoot, ".skills") : null;
     const child = spawn(fullCommand, {
       cwd: skillDir,
       shell: true,
@@ -21730,8 +21913,8 @@ function formatStatus(status) {
 }
 
 // src/commands/history.ts
-import { existsSync as existsSync7, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync4, readdirSync as readdirSync2, statSync } from "fs";
+import { join as join8 } from "path";
 async function historyCommand(options = {}) {
   const projectOutputDir = getProjectSkillsOutputDir();
   if (!projectOutputDir) {
@@ -21739,8 +21922,8 @@ async function historyCommand(options = {}) {
     console.log(source_default.dim("Run `skills init` first"));
     return;
   }
-  const historyFile = join7(projectOutputDir, "execution-history.jsonl");
-  if (!existsSync7(historyFile)) {
+  const historyFile = join8(projectOutputDir, "execution-history.jsonl");
+  if (!existsSync8(historyFile)) {
     console.log(source_default.dim("No execution history found"));
     console.log(source_default.dim("Run a skill with `skills run <name>` to start tracking"));
     return;
@@ -21788,7 +21971,7 @@ async function historyCommand(options = {}) {
         }
       }
     }
-    if (options.verbose && existsSync7(entry.logFile)) {
+    if (options.verbose && existsSync8(entry.logFile)) {
       console.log(`  ${source_default.dim("Log:")} ${entry.logFile}`);
     }
     console.log();
@@ -21797,16 +21980,16 @@ async function historyCommand(options = {}) {
 async function exportsCommand(slug, options = {}) {
   const target = options.target || getDefaultTarget();
   const skillsDir = target === "claude" ? getProjectClaudeSkillsDir() : getProjectCodexSkillsDir();
-  let skillDir = join7(skillsDir, `skill-${slug}`);
-  if (!existsSync7(skillDir)) {
-    skillDir = join7(skillsDir, slug);
+  let skillDir = join8(skillsDir, `skill-${slug}`);
+  if (!existsSync8(skillDir)) {
+    skillDir = join8(skillsDir, slug);
   }
-  if (!existsSync7(skillDir)) {
+  if (!existsSync8(skillDir)) {
     console.log(source_default.red(`Skill "${slug}" not found`));
     return;
   }
-  const exportsDir = join7(skillDir, "exports");
-  if (!existsSync7(exportsDir)) {
+  const exportsDir = join8(skillDir, "exports");
+  if (!existsSync8(exportsDir)) {
     console.log(source_default.dim(`No exports found for "${slug}"`));
     return;
   }
@@ -21820,7 +22003,7 @@ async function exportsCommand(slug, options = {}) {
   console.log(source_default.dim(`Directory: ${exportsDir}`));
   console.log();
   const fileInfos = files.map((file) => {
-    const filePath = join7(exportsDir, file);
+    const filePath = join8(exportsDir, file);
     const stats = statSync(filePath);
     return { file, filePath, mtime: stats.mtime, size: stats.size };
   }).sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
@@ -21837,16 +22020,16 @@ async function exportsCommand(slug, options = {}) {
 async function logsCommand(slug, options = {}) {
   const target = options.target || getDefaultTarget();
   const skillsDir = target === "claude" ? getProjectClaudeSkillsDir() : getProjectCodexSkillsDir();
-  let skillDir = join7(skillsDir, `skill-${slug}`);
-  if (!existsSync7(skillDir)) {
-    skillDir = join7(skillsDir, slug);
+  let skillDir = join8(skillsDir, `skill-${slug}`);
+  if (!existsSync8(skillDir)) {
+    skillDir = join8(skillsDir, slug);
   }
-  if (!existsSync7(skillDir)) {
+  if (!existsSync8(skillDir)) {
     console.log(source_default.red(`Skill "${slug}" not found`));
     return;
   }
-  const logsDir = join7(skillDir, "logs");
-  if (!existsSync7(logsDir)) {
+  const logsDir = join8(skillDir, "logs");
+  if (!existsSync8(logsDir)) {
     console.log(source_default.dim(`No logs found for "${slug}"`));
     return;
   }
@@ -21857,7 +22040,7 @@ async function logsCommand(slug, options = {}) {
   }
   files.sort().reverse();
   const latestLog = files[0];
-  const logPath = join7(logsDir, latestLog);
+  const logPath = join8(logsDir, latestLog);
   console.log();
   console.log(source_default.bold(`Latest Log for ${slug}`));
   console.log(source_default.dim(`File: ${logPath}`));
@@ -21899,7 +22082,7 @@ function formatBytes(bytes) {
 }
 
 // src/commands/marketplace.ts
-var indigo = source_default.hex("#6366f1");
+var indigo3 = source_default.hex("#6366f1");
 async function marketplaceCommand(options = {}) {
   const spinner = ora("Fetching skills from marketplace...").start();
   const limit = options.limit || 20;
@@ -21922,36 +22105,36 @@ async function marketplaceCommand(options = {}) {
     return;
   }
   console.log();
-  console.log(indigo.bold(`Skills Marketplace`) + source_default.dim(` (page ${page}/${totalPages}, ${total} total skills)`));
+  console.log(indigo3.bold(`Skills Marketplace`) + source_default.dim(` (page ${page}/${totalPages}, ${total} total skills)`));
   console.log();
   for (const skill of skills) {
-    const verified = skill.isVerified ? indigo(" ✓") : "";
+    const verified = skill.isVerified ? indigo3(" ✓") : "";
     const downloads = skill.downloadCount > 0 ? source_default.dim(` (${skill.downloadCount} installs)`) : "";
     console.log("  " + source_default.bold(skill.name) + verified + source_default.dim(` v${skill.version}`) + downloads);
     console.log("    " + source_default.dim(skill.description || "No description"));
-    console.log("    " + indigo(`skills install ${skill.slug}`));
+    console.log("    " + indigo3(`skills install ${skill.slug}`));
     console.log();
   }
   console.log(source_default.dim("─".repeat(50)));
   if (totalPages > 1) {
     const navHints = [];
     if (page > 1) {
-      navHints.push(`${indigo(`skills marketplace -p ${page - 1}`)} for previous`);
+      navHints.push(`${indigo3(`skills marketplace -p ${page - 1}`)} for previous`);
     }
     if (page < totalPages) {
-      navHints.push(`${indigo(`skills marketplace -p ${page + 1}`)} for next`);
+      navHints.push(`${indigo3(`skills marketplace -p ${page + 1}`)} for next`);
     }
     if (navHints.length > 0) {
       console.log(source_default.dim(navHints.join(" | ")));
     }
   }
-  console.log(source_default.dim(`Run ${indigo("skills install <name>")} to install a skill`));
-  console.log(source_default.dim(`Run ${indigo("skills search <query>")} to search for specific skills`));
+  console.log(source_default.dim(`Run ${indigo3("skills install <name>")} to install a skill`));
+  console.log(source_default.dim(`Run ${indigo3("skills search <query>")} to search for specific skills`));
 }
 
 // src/commands/feedback.ts
 var import_prompts2 = __toESM(require_prompts3(), 1);
-var indigo2 = source_default.hex("#6366f1");
+var indigo4 = source_default.hex("#6366f1");
 var indigoBold = source_default.hex("#6366f1").bold;
 async function submitFeedback(type, title, description) {
   const spinner = ora("Submitting feedback...").start();
@@ -21973,7 +22156,7 @@ async function submitFeedback(type, title, description) {
     }
     spinner.succeed("Feedback submitted!");
     console.log();
-    console.log(indigo2("  Thank you for your feedback! \uD83D\uDE4F"));
+    console.log(indigo4("  Thank you for your feedback! \uD83D\uDE4F"));
     console.log(source_default.dim("  We'll review it and get back to you if needed."));
     return true;
   } catch (error) {
@@ -21989,7 +22172,7 @@ async function feedbackCommand(options = {}) {
   const apiKey = getApiKey();
   if (!apiKey) {
     console.log(source_default.yellow("⚠") + "  You need to be logged in to submit feedback.");
-    console.log(source_default.dim("   Run ") + indigo2("skills login") + source_default.dim(" first."));
+    console.log(source_default.dim("   Run ") + indigo4("skills login") + source_default.dim(" first."));
     console.log();
     return;
   }
@@ -22041,10 +22224,384 @@ Feedback cancelled.`));
   console.log();
 }
 
+// src/commands/info.ts
+var indigo5 = source_default.hex("#6366f1");
+async function infoCommand(name) {
+  const spinner = ora("Fetching skill info...").start();
+  const result = await getSkill(name);
+  if (result.error || !result.data) {
+    spinner.fail("Skill not found");
+    console.error(source_default.red(result.error || "Unknown error"));
+    return;
+  }
+  spinner.stop();
+  const skill = result.data;
+  console.log();
+  console.log(indigo5.bold(skill.name) + (skill.isVerified ? indigo5(" ✓") : ""));
+  console.log(source_default.dim(`v${skill.version}`));
+  console.log();
+  if (skill.description) {
+    console.log(skill.description);
+    console.log();
+  }
+  console.log(source_default.dim("─".repeat(50)));
+  console.log();
+  const details = [
+    ["Slug", skill.slug],
+    ["Version", skill.version],
+    ["Category", skill.category?.name || "Uncategorized"],
+    ["License", skill.license || "Not specified"],
+    ["Downloads", skill.downloadCount.toLocaleString()],
+    ["Verified", skill.isVerified ? source_default.green("Yes") : "No"],
+    ["Remote Execution", skill.isRemoteExecution ? source_default.green("Yes") : "No"],
+    ["Credits/Run", (skill.creditsPerExecution ?? 0) > 0 ? indigo5(String(skill.creditsPerExecution)) : source_default.green("Free")]
+  ];
+  for (const [label, value] of details) {
+    console.log(`  ${source_default.dim(label.padEnd(18))} ${value}`);
+  }
+  if (skill.tags && skill.tags.length > 0) {
+    console.log();
+    console.log(`  ${source_default.dim("Tags".padEnd(18))} ${skill.tags.map((t) => source_default.dim(`#${t.name}`)).join(" ")}`);
+  }
+  console.log();
+  console.log(source_default.dim("─".repeat(50)));
+  console.log();
+  console.log(`  ${source_default.dim("Install:")} ${indigo5(`skills install ${skill.slug}`)}`);
+  if (skill.isRemoteExecution) {
+    console.log(`  ${source_default.dim("Run:")}     ${indigo5(`skills run ${skill.slug}`)}`);
+  }
+  console.log();
+}
+
+// src/commands/credits.ts
+var indigo6 = source_default.hex("#6366f1");
+async function creditsCommand() {
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    console.log(source_default.yellow("Not logged in"));
+    console.log(source_default.dim("Run `skills login` to authenticate"));
+    return;
+  }
+  const spinner = ora("Fetching credits...").start();
+  const result = await getCurrentUser();
+  if (result.error || !result.data) {
+    spinner.fail("Failed to fetch credits");
+    console.error(source_default.red(result.error || "Unknown error"));
+    return;
+  }
+  spinner.stop();
+  const { creditsBalance, plan, tenantName } = result.data;
+  console.log();
+  console.log(indigo6.bold("Credits Balance"));
+  console.log();
+  console.log("  " + indigo6.bold(creditsBalance.toLocaleString()) + " credits");
+  console.log();
+  console.log(source_default.dim("─".repeat(30)));
+  console.log();
+  console.log("  Plan:  " + source_default.bold(plan));
+  console.log("  Org:   " + (tenantName || source_default.dim("Personal")));
+  console.log();
+  console.log(source_default.dim("Purchase more at https://skills.md/billing"));
+  console.log();
+}
+
+// src/commands/update.ts
+import { existsSync as existsSync9, readdirSync as readdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join9 } from "path";
+var indigo7 = source_default.hex("#6366f1");
+function parseFrontmatter2(content) {
+  const result = {};
+  const match = content.match(/^---\n([\s\S]*?)\n---/);
+  if (!match)
+    return result;
+  const frontmatter = match[1];
+  const lines = frontmatter.split(`
+`);
+  for (const line of lines) {
+    const colonIndex = line.indexOf(":");
+    if (colonIndex === -1)
+      continue;
+    const key = line.slice(0, colonIndex).trim();
+    let value = line.slice(colonIndex + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    result[key] = value;
+  }
+  return result;
+}
+async function updateCommand(skillName, options = {}) {
+  const target = options.target ?? getDefaultTarget();
+  const skillsDir = target === "claude" ? getClaudeSkillsDir() : getCodexSkillsDir();
+  if (!existsSync9(skillsDir)) {
+    console.log(source_default.dim("No skills installed"));
+    return;
+  }
+  const entries = readdirSync3(skillsDir, { withFileTypes: true });
+  const installedSkills = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith("skill-"))
+      continue;
+    const skillDir = join9(skillsDir, entry.name);
+    const skillMdPath = join9(skillDir, "SKILL.md");
+    if (!existsSync9(skillMdPath))
+      continue;
+    const content = readFileSync5(skillMdPath, "utf-8");
+    const frontmatter = parseFrontmatter2(content);
+    const slug = entry.name.replace("skill-", "");
+    if (skillName && slug !== skillName && frontmatter.name !== skillName) {
+      continue;
+    }
+    installedSkills.push({
+      slug,
+      name: frontmatter.name || slug,
+      version: frontmatter.version || "unknown",
+      dir: skillDir
+    });
+  }
+  if (installedSkills.length === 0) {
+    if (skillName) {
+      console.log(source_default.yellow(`Skill "${skillName}" not found`));
+    } else {
+      console.log(source_default.dim("No skills installed"));
+    }
+    return;
+  }
+  console.log();
+  console.log(indigo7.bold("Updating Skills"));
+  console.log();
+  let updated = 0;
+  let upToDate = 0;
+  let failed = 0;
+  for (const skill of installedSkills) {
+    const spinner = ora(`Checking ${skill.name}...`).start();
+    try {
+      const result = await installSkill(skill.slug);
+      if (result.error || !result.data) {
+        spinner.fail(`${skill.name}: Failed to fetch`);
+        failed++;
+        continue;
+      }
+      const newVersion = result.data.version;
+      const currentVersion = skill.version;
+      if (newVersion !== currentVersion) {
+        writeFileSync6(join9(skill.dir, "SKILL.md"), result.data.skillMdContent);
+        spinner.succeed(`${skill.name}: ${source_default.dim(currentVersion)} ${indigo7("→")} ${indigo7(newVersion)}`);
+        updated++;
+      } else {
+        spinner.succeed(`${skill.name}: ${source_default.dim(`v${currentVersion}`)} ${source_default.green("(up to date)")}`);
+        upToDate++;
+      }
+    } catch (error) {
+      spinner.fail(`${skill.name}: Error`);
+      failed++;
+    }
+  }
+  console.log();
+  console.log(source_default.dim("─".repeat(40)));
+  console.log();
+  const summary = [];
+  if (updated > 0)
+    summary.push(indigo7(`${updated} updated`));
+  if (upToDate > 0)
+    summary.push(source_default.green(`${upToDate} up to date`));
+  if (failed > 0)
+    summary.push(source_default.red(`${failed} failed`));
+  console.log("  " + summary.join(", "));
+  console.log();
+}
+
+// src/commands/upgrade.ts
+import { execSync } from "child_process";
+var indigo8 = source_default.hex("#6366f1");
+var PACKAGE_NAME = "@hasnatools/skills";
+async function upgradeCommand() {
+  console.log();
+  console.log(indigo8.bold("Upgrade Skills CLI"));
+  console.log();
+  const currentVersion = process.env.npm_package_version || getInstalledVersion();
+  console.log(`  Current: ${source_default.dim(`v${currentVersion}`)}`);
+  const spinner = ora("Checking for updates...").start();
+  try {
+    const latestVersion = execSync(`npm view ${PACKAGE_NAME} version`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    }).trim();
+    if (latestVersion === currentVersion) {
+      spinner.succeed("Already on latest version");
+      console.log();
+      return;
+    }
+    spinner.text = `Upgrading to v${latestVersion}...`;
+    const pm = detectPackageManager();
+    const upgradeCmd = pm === "bun" ? `bun install -g ${PACKAGE_NAME}@latest` : pm === "yarn" ? `yarn global add ${PACKAGE_NAME}@latest` : pm === "pnpm" ? `pnpm add -g ${PACKAGE_NAME}@latest` : `npm install -g ${PACKAGE_NAME}@latest`;
+    execSync(upgradeCmd, {
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    spinner.succeed(`Upgraded to ${indigo8(`v${latestVersion}`)}`);
+    console.log();
+    console.log(source_default.dim("  Restart your terminal to use the new version"));
+    console.log();
+  } catch (error) {
+    spinner.fail("Upgrade failed");
+    console.log();
+    console.log(source_default.red("  " + (error instanceof Error ? error.message : "Unknown error")));
+    console.log();
+    console.log(source_default.dim("  Try manually: npm install -g " + PACKAGE_NAME + "@latest"));
+    console.log();
+  }
+}
+function getInstalledVersion() {
+  try {
+    const output = execSync(`npm list -g ${PACKAGE_NAME} --depth=0 --json`, {
+      encoding: "utf-8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const data = JSON.parse(output);
+    return data.dependencies?.[PACKAGE_NAME]?.version || "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+function detectPackageManager() {
+  try {
+    execSync("bun --version", { stdio: ["pipe", "pipe", "pipe"] });
+    return "bun";
+  } catch {}
+  try {
+    execSync("pnpm --version", { stdio: ["pipe", "pipe", "pipe"] });
+    return "pnpm";
+  } catch {}
+  try {
+    execSync("yarn --version", { stdio: ["pipe", "pipe", "pipe"] });
+    return "yarn";
+  } catch {}
+  return "npm";
+}
+
+// src/commands/doctor.ts
+import { existsSync as existsSync10 } from "fs";
+import { execSync as execSync2 } from "child_process";
+var indigo9 = source_default.hex("#6366f1");
+async function doctorCommand() {
+  console.log();
+  console.log(indigo9.bold("Skills Doctor"));
+  console.log(source_default.dim("Checking your environment..."));
+  console.log();
+  const results = [];
+  const spinner1 = ora("Checking Node.js...").start();
+  try {
+    const nodeVersion = process.version;
+    const major = parseInt(nodeVersion.slice(1).split(".")[0], 10);
+    if (major >= 18) {
+      spinner1.succeed(`Node.js ${nodeVersion}`);
+      results.push({ name: "Node.js", status: "ok", message: nodeVersion });
+    } else {
+      spinner1.warn(`Node.js ${nodeVersion} (v18+ recommended)`);
+      results.push({ name: "Node.js", status: "warn", message: `${nodeVersion} (v18+ recommended)` });
+    }
+  } catch {
+    spinner1.fail("Node.js not found");
+    results.push({ name: "Node.js", status: "error", message: "Not found" });
+  }
+  const spinner2 = ora("Checking Bun...").start();
+  try {
+    const bunVersion = execSync2("bun --version", { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+    spinner2.succeed(`Bun v${bunVersion}`);
+    results.push({ name: "Bun", status: "ok", message: `v${bunVersion}` });
+  } catch {
+    spinner2.info("Bun not installed (optional)");
+    results.push({ name: "Bun", status: "warn", message: "Not installed (optional)" });
+  }
+  const spinner3 = ora("Checking API connectivity...").start();
+  const endpoint = getApiEndpoint();
+  try {
+    const response = await fetch(`${endpoint}/status`, {
+      method: "GET",
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (response.ok) {
+      spinner3.succeed(`API reachable (${endpoint})`);
+      results.push({ name: "API", status: "ok", message: endpoint });
+    } else {
+      spinner3.warn(`API returned ${response.status}`);
+      results.push({ name: "API", status: "warn", message: `Status ${response.status}` });
+    }
+  } catch (error) {
+    spinner3.fail("API unreachable");
+    results.push({ name: "API", status: "error", message: error instanceof Error ? error.message : "Connection failed" });
+  }
+  const spinner4 = ora("Checking authentication...").start();
+  const apiKey = getApiKey();
+  if (apiKey) {
+    try {
+      const response = await fetch(`${endpoint}/me`, {
+        headers: { Authorization: `Bearer ${apiKey}` },
+        signal: AbortSignal.timeout(1e4)
+      });
+      if (response.ok) {
+        const data = await response.json();
+        spinner4.succeed(`Authenticated as ${data.email}`);
+        results.push({ name: "Auth", status: "ok", message: data.email });
+      } else if (response.status === 401) {
+        spinner4.warn("API key invalid or expired");
+        results.push({ name: "Auth", status: "warn", message: "Invalid/expired key" });
+      } else {
+        spinner4.warn(`Auth check returned ${response.status}`);
+        results.push({ name: "Auth", status: "warn", message: `Status ${response.status}` });
+      }
+    } catch {
+      spinner4.warn("Could not verify authentication");
+      results.push({ name: "Auth", status: "warn", message: "Verification failed" });
+    }
+  } else {
+    spinner4.info("Not logged in");
+    results.push({ name: "Auth", status: "warn", message: "Not logged in" });
+  }
+  const spinner5 = ora("Checking Claude skills directory...").start();
+  const claudeDir = getClaudeSkillsDir();
+  if (existsSync10(claudeDir)) {
+    spinner5.succeed(`Claude skills: ${claudeDir}`);
+    results.push({ name: "Claude Dir", status: "ok", message: claudeDir });
+  } else {
+    spinner5.info("Claude skills directory not found");
+    results.push({ name: "Claude Dir", status: "warn", message: "Not found (will be created on install)" });
+  }
+  const spinner6 = ora("Checking Codex skills directory...").start();
+  const codexDir = getCodexSkillsDir();
+  if (existsSync10(codexDir)) {
+    spinner6.succeed(`Codex skills: ${codexDir}`);
+    results.push({ name: "Codex Dir", status: "ok", message: codexDir });
+  } else {
+    spinner6.info("Codex skills directory not found");
+    results.push({ name: "Codex Dir", status: "warn", message: "Not found (will be created on install)" });
+  }
+  console.log();
+  console.log(source_default.dim("─".repeat(50)));
+  console.log();
+  const okCount = results.filter((r) => r.status === "ok").length;
+  const warnCount = results.filter((r) => r.status === "warn").length;
+  const errorCount = results.filter((r) => r.status === "error").length;
+  if (errorCount > 0) {
+    console.log(source_default.red.bold(`  ${errorCount} error(s) found`));
+  }
+  if (warnCount > 0) {
+    console.log(source_default.yellow(`  ${warnCount} warning(s)`));
+  }
+  if (okCount === results.length) {
+    console.log(indigo9.bold("  All checks passed!"));
+  }
+  console.log();
+  if (!apiKey) {
+    console.log(source_default.dim("  Run `skills login` to authenticate"));
+  }
+  console.log();
+}
+
 // src/index.ts
-var indigo3 = source_default.hex("#6366f1");
+var indigo10 = source_default.hex("#6366f1");
 var program2 = new Command;
-program2.name("skills").description("CLI for skills.md - AI Agent Skills Marketplace").version("0.1.0");
+program2.name("skills").description("CLI for skills.md - AI Agent Skills Marketplace").version("0.1.9");
 program2.command("init").description("Initialize skills.md in current project").option("-f, --force", "Force re-initialization (removes existing .skills/)").action((options) => {
   initCommand({ force: options.force });
 });
@@ -22073,6 +22630,12 @@ program2.command("uninstall <name>").alias("remove").description("Uninstall a sk
     target: options.target
   });
 });
+program2.command("download <name>").alias("dl").description("Download a skill with full source code (if available)").option("-l, --local", "Download to current project instead of global").option("-t, --target <target>", "Target platform (claude, codex)").action((name, options) => {
+  downloadCommand(name, {
+    local: options.local,
+    target: options.target
+  });
+});
 program2.command("list").alias("ls").description("List installed skills").option("-g, --global", "List only global skills").option("-t, --target <target>", "Target platform (claude, codex)").option("-r, --remote", "List remote installations").action((options) => {
   listCommand({
     global: options.global,
@@ -22124,8 +22687,15 @@ program2.command("feedback").description("Submit feedback, bug reports, or featu
     message: options.message
   });
 });
+program2.command("info <name>").description("Show detailed information about a skill").action(infoCommand);
+program2.command("credits").description("Check your credits balance").action(creditsCommand);
+program2.command("update [skill]").description("Update installed skills to latest versions").option("-t, --target <target>", "Target platform (claude, codex)").action((skill, options) => {
+  updateCommand(skill, { target: options.target });
+});
+program2.command("upgrade").description("Upgrade the Skills CLI to the latest version").action(upgradeCommand);
+program2.command("doctor").description("Check your environment and diagnose issues").action(doctorCommand);
 program2.addHelpText("after", `
-${indigo3.bold("Examples:")}
+${indigo10.bold("Examples:")}
   ${source_default.dim("# Initialize in current project")}
   $ skills init
 
@@ -22163,7 +22733,22 @@ ${indigo3.bold("Examples:")}
   ${source_default.dim("# Submit feedback")}
   $ skills feedback
 
-${indigo3.bold("Documentation:")}
-  ${indigo3("https://skills.md/docs")}
+  ${source_default.dim("# Get skill info")}
+  $ skills info code-review
+
+  ${source_default.dim("# Check credits balance")}
+  $ skills credits
+
+  ${source_default.dim("# Update installed skills")}
+  $ skills update
+
+  ${source_default.dim("# Upgrade CLI")}
+  $ skills upgrade
+
+  ${source_default.dim("# Check environment")}
+  $ skills doctor
+
+${indigo10.bold("Documentation:")}
+  ${indigo10("https://skills.md/docs")}
 `);
 program2.parse();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasnatools/skills",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "CLI for skills.md - AI Agent Skills Marketplace",
   "type": "module",
   "bin": {