@nano-step/skill-manager 5.2.2 → 5.4.0

package/README.md

@@ -26,13 +26,27 @@ npx @nano-step/skill-manager install --all
 | `update [name]` | Update one or all installed skills |
 | `installed` | Show currently installed skills |
 
-## Available Skills
+## Available Skills (17)
 
 | Skill | Description |
 |-------|-------------|
-| `skill-management` | AI skill routing — isolates tool definitions in subagent context to save 80-95% tokens |
+| `blog-workflow` | Generate SEO-optimized blog posts for dev.to, Medium, LinkedIn, Hashnode |
+| `comprehensive-feature-builder` | Systematic 5-phase workflow for researching, designing, implementing, and testing features |
+| `feature-analysis` | Deep code analysis with execution tracing, data transformation audits, and gap analysis |
 | `graphql-inspector` | GraphQL schema inspection with progressive discovery workflow |
-
+| `idea-workflow` | Analyze source code and produce monetization strategy with execution blueprint |
+| `mermaid-validator` | Validate Mermaid diagram syntax — enforces rules that prevent parse errors |
+| `nano-brain` | Persistent memory for AI agents — hybrid search across sessions, codebase, and notes |
+| `pdf` | PDF manipulation toolkit — extract, create, merge, split, OCR, fill forms, watermark |
+| `reddit-workflow` | Draft Reddit posts optimized for subreddit rules, tone, and spam filters |
+| `rri-t-testing` | RRI-T QA methodology — 5-phase testing with 7 dimensions, 5 personas, and release gates |
+| `rtk` | Token optimizer — wraps CLI commands with rtk to reduce token consumption by 60-90% |
+| `rtk-setup` | One-time RTK setup + ongoing enforcement across sessions and subagents |
+| `security-workflow` | OWASP Top 10 security audit with CVE scanning and prioritized hardening plan |
+| `skill-creator` | Create and validate AI agent skills with progressive disclosure and marketplace packaging |
+| `skill-management` | AI skill routing — isolates tool definitions in subagent context to save 80-95% tokens |
+| `team-workflow` | Simulate an autonomous software team — architecture, execution plan, QA strategy |
+| `ui-ux-pro-max` | UI/UX design intelligence with searchable database of styles, palettes, fonts, and guidelines |
 ## What Gets Installed
 
 When you install a skill, the manager:

package/dist/auth.d.ts

@@ -0,0 +1,8 @@
+export interface AuthConfig {
+    token?: string;
+}
+export declare function loadAuthConfig(): Promise<AuthConfig>;
+export declare function saveAuthConfig(config: AuthConfig): Promise<void>;
+export declare function removeAuthConfig(): Promise<void>;
+export declare function resolveToken(): Promise<string | null>;
+export declare function getPrivateRepo(): string;

package/dist/auth.js

@@ -0,0 +1,67 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadAuthConfig = loadAuthConfig;
+exports.saveAuthConfig = saveAuthConfig;
+exports.removeAuthConfig = removeAuthConfig;
+exports.resolveToken = resolveToken;
+exports.getPrivateRepo = getPrivateRepo;
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const child_process_1 = require("child_process");
+const CONFIG_DIR = path_1.default.join(os_1.default.homedir(), ".config", "skill-manager");
+const CONFIG_FILE = path_1.default.join(CONFIG_DIR, "config.json");
+const PRIVATE_REPO = "nano-step/private-skills";
+async function loadAuthConfig() {
+    const exists = await fs_extra_1.default.pathExists(CONFIG_FILE);
+    if (!exists) {
+        return {};
+    }
+    try {
+        const data = await fs_extra_1.default.readFile(CONFIG_FILE, "utf8");
+        return JSON.parse(data);
+    }
+    catch {
+        return {};
+    }
+}
+async function saveAuthConfig(config) {
+    await fs_extra_1.default.ensureDir(CONFIG_DIR);
+    await fs_extra_1.default.writeFile(CONFIG_FILE, JSON.stringify(config, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    await fs_extra_1.default.chmod(CONFIG_FILE, 0o600);
+}
+async function removeAuthConfig() {
+    const exists = await fs_extra_1.default.pathExists(CONFIG_FILE);
+    if (exists) {
+        await fs_extra_1.default.remove(CONFIG_FILE);
+    }
+}
+function getGhCliToken() {
+    try {
+        const token = (0, child_process_1.execSync)("gh auth token", { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        return token || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function resolveToken() {
+    const config = await loadAuthConfig();
+    if (config.token) {
+        return config.token;
+    }
+    const envToken = process.env.GITHUB_TOKEN;
+    if (envToken) {
+        return envToken;
+    }
+    return getGhCliToken();
+}
+function getPrivateRepo() {
+    return PRIVATE_REPO;
+}

package/dist/index.js

@@ -10,6 +10,8 @@ const utils_1 = require("./utils");
 const registry_1 = require("./registry");
 const state_1 = require("./state");
 const installer_1 = require("./installer");
+const remote_registry_1 = require("./remote-registry");
+const auth_1 = require("./auth");
 async function run() {
     const args = process.argv.slice(2);
     if (args.includes("--update") || args.includes("--remove")) {
@@ -27,38 +29,76 @@ async function run() {
         .name("skill-manager")
         .description("Install and manage AI agent skills for OpenCode")
         .version(utils_1.MANAGER_VERSION);
+    program
+        .command("login")
+        .description("Authenticate with GitHub to access private skills")
+        .option("--token <token>", "GitHub personal access token")
+        .action(async (options) => {
+        if (!options.token) {
+            console.error(chalk_1.default.red("Please provide a token with --token <token>"));
+            console.error(chalk_1.default.gray("Create a token at: https://github.com/settings/tokens"));
+            console.error(chalk_1.default.gray("Required scope: repo (for private repositories)"));
+            process.exit(1);
+        }
+        const config = await (0, auth_1.loadAuthConfig)();
+        config.token = options.token;
+        await (0, auth_1.saveAuthConfig)(config);
+        console.log(chalk_1.default.green("✓ Token saved successfully"));
+        console.log(chalk_1.default.gray("  Config: ~/.config/skill-manager/config.json"));
+    });
+    program
+        .command("logout")
+        .description("Remove stored GitHub token")
+        .action(async () => {
+        await (0, auth_1.removeAuthConfig)();
+        console.log(chalk_1.default.green("✓ Token removed"));
+    });
     program
         .command("list")
         .description("Show available skills from the catalog")
         .action(async () => {
         const paths = await (0, utils_1.detectOpenCodePaths)();
         await (0, state_1.migrateV4State)(paths.configDir, paths.stateFilePath, paths.skillsDir);
-        const catalog = await (0, registry_1.loadCatalog)(paths.packageSkillsDir);
+        const token = await (0, auth_1.resolveToken)();
+        const remoteSkills = token ? await (0, remote_registry_1.listRemoteSkills)() : [];
+        const catalog = await (0, registry_1.loadMergedCatalog)(paths.packageSkillsDir, remoteSkills);
         const state = await (0, state_1.loadState)(paths.stateFilePath);
         if (catalog.length === 0) {
             console.log(chalk_1.default.yellow("No skills found in catalog."));
+            if (!token) {
+                console.log(chalk_1.default.gray("Run 'skill-manager login' to access private skills."));
+            }
             return;
         }
         console.log(chalk_1.default.bold("\nAvailable Skills:\n"));
         const nameWidth = 22;
         const versionWidth = 10;
+        const sourceWidth = 10;
         const statusWidth = 14;
         console.log(chalk_1.default.gray("  " +
             "Name".padEnd(nameWidth) +
             "Version".padEnd(versionWidth) +
+            "Source".padEnd(sourceWidth) +
             "Status".padEnd(statusWidth) +
             "Description"));
-        console.log(chalk_1.default.gray("  " + "─".repeat(nameWidth + versionWidth + statusWidth + 30)));
-        for (const skill of catalog) {
+        console.log(chalk_1.default.gray("  " + "─".repeat(nameWidth + versionWidth + sourceWidth + statusWidth + 30)));
+        for (const entry of catalog) {
+            const skill = entry.manifest;
             const installed = state.skills[skill.name];
             const status = installed ? chalk_1.default.green("installed") : chalk_1.default.gray("not installed");
+            const sourceLabel = entry.source === "private" ? chalk_1.default.magenta("private") : chalk_1.default.blue("public");
             console.log("  " +
                 chalk_1.default.cyan(skill.name.padEnd(nameWidth)) +
                 skill.version.padEnd(versionWidth) +
+                sourceLabel.padEnd(sourceWidth + 10) +
                 status.padEnd(statusWidth + 10) +
                 skill.description);
         }
         console.log("");
+        if (!token) {
+            console.log(chalk_1.default.gray("Tip: Run 'skill-manager login' to access private skills."));
+            console.log("");
+        }
     });
     program
         .command("install [name]")
@@ -68,13 +108,15 @@ async function run() {
         const paths = await (0, utils_1.detectOpenCodePaths)();
         await (0, state_1.migrateV4State)(paths.configDir, paths.stateFilePath, paths.skillsDir);
         if (options.all) {
-            const catalog = await (0, registry_1.loadCatalog)(paths.packageSkillsDir);
+            const token = await (0, auth_1.resolveToken)();
+            const remoteSkills = token ? await (0, remote_registry_1.listRemoteSkills)() : [];
+            const catalog = await (0, registry_1.loadMergedCatalog)(paths.packageSkillsDir, remoteSkills);
             if (catalog.length === 0) {
                 console.log(chalk_1.default.yellow("No skills found in catalog."));
                 return;
             }
-            for (const skill of catalog) {
-                await (0, installer_1.installSkill)(skill.name, paths);
+            for (const entry of catalog) {
+                await (0, installer_1.installSkill)(entry.manifest.name, paths);
             }
         }
         else if (name) {

package/dist/installer.js

@@ -13,34 +13,54 @@ const utils_1 = require("./utils");
 const registry_1 = require("./registry");
 const state_1 = require("./state");
 const config_1 = require("./config");
-async function installSkill(name, paths) {
-    const manifest = await (0, registry_1.getSkillManifest)(paths.packageSkillsDir, name);
-    if (!manifest) {
-        const catalog = await (0, registry_1.loadCatalog)(paths.packageSkillsDir);
-        const available = catalog.map((s) => s.name).join(", ");
-        console.error(chalk_1.default.red(`Skill "${name}" not found in catalog.`));
-        console.error(chalk_1.default.yellow(`Available skills: ${available || "none"}`));
-        process.exit(1);
-    }
+const remote_registry_1 = require("./remote-registry");
+async function installFromDir(manifest, sourceDir, paths, source) {
     const state = await (0, state_1.loadState)(paths.stateFilePath);
-    const existing = state.skills[name];
+    const existing = state.skills[manifest.name];
     if (existing && existing.version === manifest.version) {
-        console.log(chalk_1.default.yellow(`Skill "${name}" is already installed at v${manifest.version}.`));
+        console.log(chalk_1.default.yellow(`Skill "${manifest.name}" is already installed at v${manifest.version}.`));
         return;
     }
     await (0, utils_1.ensureDirExists)(paths.skillsDir);
-    const packageSkillDir = path_1.default.join(paths.packageSkillsDir, name);
-    const targetSkillDir = path_1.default.join(paths.skillsDir, name);
-    await fs_extra_1.default.copy(packageSkillDir, targetSkillDir, { overwrite: true });
-    await (0, config_1.copyCommands)(manifest, packageSkillDir, paths.commandDir);
+    const targetSkillDir = path_1.default.join(paths.skillsDir, manifest.name);
+    await fs_extra_1.default.copy(sourceDir, targetSkillDir, { overwrite: true });
+    await (0, config_1.copyCommands)(manifest, sourceDir, paths.commandDir);
     await (0, config_1.mergeAgentConfig)(paths.agentConfigPath, manifest);
-    state.skills[name] = {
+    state.skills[manifest.name] = {
         version: manifest.version,
         installedAt: new Date().toISOString(),
         location: paths.configDir.includes(".config/opencode") ? "global" : "project",
     };
     await (0, state_1.saveState)(paths.stateFilePath, state);
-    console.log(chalk_1.default.green(`✓ Installed ${name} v${manifest.version}`));
+    const sourceLabel = source === "private" ? chalk_1.default.magenta(" (private)") : "";
+    console.log(chalk_1.default.green(`✓ Installed ${manifest.name} v${manifest.version}${sourceLabel}`));
+}
+async function installSkill(name, paths) {
+    const localManifest = await (0, registry_1.getSkillManifest)(paths.packageSkillsDir, name);
+    if (localManifest) {
+        const packageSkillDir = path_1.default.join(paths.packageSkillsDir, name);
+        await installFromDir(localManifest, packageSkillDir, paths, "public");
+        return;
+    }
+    const remoteManifest = await (0, remote_registry_1.getRemoteSkillManifest)(name);
+    if (remoteManifest) {
+        const tempDir = await (0, remote_registry_1.downloadSkillToTemp)(name);
+        if (tempDir) {
+            try {
+                await installFromDir(remoteManifest, tempDir, paths, "private");
+            }
+            finally {
+                await fs_extra_1.default.remove(tempDir);
+            }
+            return;
+        }
+    }
+    const catalog = await (0, registry_1.loadCatalog)(paths.packageSkillsDir);
+    const available = catalog.map((s) => s.name).join(", ");
+    console.error(chalk_1.default.red(`Skill "${name}" not found in catalog.`));
+    console.error(chalk_1.default.yellow(`Available public skills: ${available || "none"}`));
+    console.error(chalk_1.default.gray("Run 'skill-manager login' to access private skills."));
+    process.exit(1);
 }
 async function removeSkill(name, paths) {
     const state = await (0, state_1.loadState)(paths.stateFilePath);
@@ -49,13 +69,25 @@ async function removeSkill(name, paths) {
         return;
     }
     const manifest = await (0, registry_1.getSkillManifest)(paths.packageSkillsDir, name);
+    const installedManifestPath = path_1.default.join(paths.skillsDir, name, "skill.json");
+    let installedManifest = null;
+    if (await fs_extra_1.default.pathExists(installedManifestPath)) {
+        try {
+            const raw = await fs_extra_1.default.readFile(installedManifestPath, "utf8");
+            installedManifest = JSON.parse(raw);
+        }
+        catch {
+            installedManifest = null;
+        }
+    }
     const targetSkillDir = path_1.default.join(paths.skillsDir, name);
     if (await fs_extra_1.default.pathExists(targetSkillDir)) {
         await fs_extra_1.default.remove(targetSkillDir);
     }
-    if (manifest) {
-        await (0, config_1.removeCommands)(manifest, paths.commandDir);
-        await (0, config_1.removeAgentConfig)(paths.agentConfigPath, manifest);
+    const effectiveManifest = manifest || installedManifest;
+    if (effectiveManifest) {
+        await (0, config_1.removeCommands)(effectiveManifest, paths.commandDir);
+        await (0, config_1.removeAgentConfig)(paths.agentConfigPath, effectiveManifest);
     }
     delete state.skills[name];
     await (0, state_1.saveState)(paths.stateFilePath, state);
@@ -67,26 +99,54 @@ async function updateSkill(name, paths) {
         console.error(chalk_1.default.red(`Skill "${name}" is not installed. Use 'skill-manager install ${name}' first.`));
         process.exit(1);
     }
-    const manifest = await (0, registry_1.getSkillManifest)(paths.packageSkillsDir, name);
-    if (!manifest) {
-        console.error(chalk_1.default.red(`Skill "${name}" not found in catalog. It may have been removed.`));
-        process.exit(1);
-    }
     const installed = state.skills[name];
-    if (installed.version === manifest.version) {
-        console.log(chalk_1.default.yellow(`Skill "${name}" is already at v${manifest.version} (up to date).`));
+    const localManifest = await (0, registry_1.getSkillManifest)(paths.packageSkillsDir, name);
+    if (localManifest) {
+        if (installed.version === localManifest.version) {
+            console.log(chalk_1.default.yellow(`Skill "${name}" is already at v${localManifest.version} (up to date).`));
+            return;
+        }
+        const packageSkillDir = path_1.default.join(paths.packageSkillsDir, name);
+        const targetSkillDir = path_1.default.join(paths.skillsDir, name);
+        await fs_extra_1.default.copy(packageSkillDir, targetSkillDir, { overwrite: true });
+        await (0, config_1.copyCommands)(localManifest, packageSkillDir, paths.commandDir);
+        await (0, config_1.mergeAgentConfig)(paths.agentConfigPath, localManifest);
+        state.skills[name] = {
+            version: localManifest.version,
+            installedAt: new Date().toISOString(),
+            location: installed.location,
+        };
+        await (0, state_1.saveState)(paths.stateFilePath, state);
+        console.log(chalk_1.default.green(`✓ Updated ${name} from v${installed.version} to v${localManifest.version}`));
         return;
     }
-    const packageSkillDir = path_1.default.join(paths.packageSkillsDir, name);
-    const targetSkillDir = path_1.default.join(paths.skillsDir, name);
-    await fs_extra_1.default.copy(packageSkillDir, targetSkillDir, { overwrite: true });
-    await (0, config_1.copyCommands)(manifest, packageSkillDir, paths.commandDir);
-    await (0, config_1.mergeAgentConfig)(paths.agentConfigPath, manifest);
-    state.skills[name] = {
-        version: manifest.version,
-        installedAt: new Date().toISOString(),
-        location: installed.location,
-    };
-    await (0, state_1.saveState)(paths.stateFilePath, state);
-    console.log(chalk_1.default.green(`✓ Updated ${name} from v${installed.version} to v${manifest.version}`));
+    const remoteManifest = await (0, remote_registry_1.getRemoteSkillManifest)(name);
+    if (remoteManifest) {
+        if (installed.version === remoteManifest.version) {
+            console.log(chalk_1.default.yellow(`Skill "${name}" is already at v${remoteManifest.version} (up to date).`));
+            return;
+        }
+        const tempDir = await (0, remote_registry_1.downloadSkillToTemp)(name);
+        if (tempDir) {
+            try {
+                const targetSkillDir = path_1.default.join(paths.skillsDir, name);
+                await fs_extra_1.default.copy(tempDir, targetSkillDir, { overwrite: true });
+                await (0, config_1.copyCommands)(remoteManifest, tempDir, paths.commandDir);
+                await (0, config_1.mergeAgentConfig)(paths.agentConfigPath, remoteManifest);
+                state.skills[name] = {
+                    version: remoteManifest.version,
+                    installedAt: new Date().toISOString(),
+                    location: installed.location,
+                };
+                await (0, state_1.saveState)(paths.stateFilePath, state);
+                console.log(chalk_1.default.green(`✓ Updated ${name} from v${installed.version} to v${remoteManifest.version} (private)`));
+            }
+            finally {
+                await fs_extra_1.default.remove(tempDir);
+            }
+            return;
+        }
+    }
+    console.error(chalk_1.default.red(`Skill "${name}" not found in catalog. It may have been removed.`));
+    process.exit(1);
 }

package/dist/registry.d.ts

@@ -1,3 +1,4 @@
-import { SkillManifest } from "./utils";
+import { SkillManifest, CatalogEntry } from "./utils";
 export declare function loadCatalog(packageSkillsDir: string): Promise<SkillManifest[]>;
 export declare function getSkillManifest(packageSkillsDir: string, name: string): Promise<SkillManifest | null>;
+export declare function loadMergedCatalog(packageSkillsDir: string, remoteSkills: SkillManifest[]): Promise<CatalogEntry[]>;

package/dist/registry.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadCatalog = loadCatalog;
 exports.getSkillManifest = getSkillManifest;
+exports.loadMergedCatalog = loadMergedCatalog;
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const chalk_1 = __importDefault(require("chalk"));
@@ -61,3 +62,17 @@ async function getSkillManifest(packageSkillsDir, name) {
         return null;
     }
 }
+async function loadMergedCatalog(packageSkillsDir, remoteSkills) {
+    const localCatalog = await loadCatalog(packageSkillsDir);
+    const localNames = new Set(localCatalog.map((s) => s.name));
+    const entries = localCatalog.map((manifest) => ({
+        manifest,
+        source: "public",
+    }));
+    for (const manifest of remoteSkills) {
+        if (!localNames.has(manifest.name)) {
+            entries.push({ manifest, source: "private" });
+        }
+    }
+    return entries.sort((a, b) => a.manifest.name.localeCompare(b.manifest.name));
+}

package/dist/remote-registry.d.ts

@@ -0,0 +1,4 @@
+import { SkillManifest } from "./utils";
+export declare function listRemoteSkills(): Promise<SkillManifest[]>;
+export declare function downloadSkillToTemp(skillName: string): Promise<string | null>;
+export declare function getRemoteSkillManifest(skillName: string): Promise<SkillManifest | null>;

package/dist/remote-registry.js

@@ -0,0 +1,152 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listRemoteSkills = listRemoteSkills;
+exports.downloadSkillToTemp = downloadSkillToTemp;
+exports.getRemoteSkillManifest = getRemoteSkillManifest;
+const path_1 = __importDefault(require("path"));
+const os_1 = __importDefault(require("os"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const chalk_1 = __importDefault(require("chalk"));
+const auth_1 = require("./auth");
+async function githubFetch(url, token) {
+    const response = await fetch(url, {
+        headers: {
+            Authorization: `Bearer ${token}`,
+            Accept: "application/vnd.github.v3+json",
+            "User-Agent": "skill-manager",
+        },
+    });
+    if (response.status === 429) {
+        console.error(chalk_1.default.yellow("GitHub API rate limit exceeded. Please wait and try again later."));
+        return { data: null, status: 429 };
+    }
+    if (response.status === 403) {
+        console.error(chalk_1.default.yellow("Access denied to private repository. Check your token permissions."));
+        return { data: null, status: 403 };
+    }
+    if (response.status === 404) {
+        return { data: null, status: 404 };
+    }
+    if (!response.ok) {
+        return { data: null, status: response.status };
+    }
+    const data = (await response.json());
+    return { data, status: response.status };
+}
+function isValidManifest(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const obj = data;
+    return (typeof obj.name === "string" &&
+        typeof obj.version === "string" &&
+        typeof obj.description === "string");
+}
+async function listRemoteSkills() {
+    const token = await (0, auth_1.resolveToken)();
+    if (!token) {
+        return [];
+    }
+    const repo = (0, auth_1.getPrivateRepo)();
+    const [owner, repoName] = repo.split("/");
+    const url = `https://api.github.com/repos/${owner}/${repoName}/contents/skills`;
+    const { data: items, status } = await githubFetch(url, token);
+    if (!items || status !== 200) {
+        return [];
+    }
+    const skills = [];
+    for (const item of items) {
+        if (item.type !== "dir")
+            continue;
+        const manifestUrl = `https://api.github.com/repos/${owner}/${repoName}/contents/skills/${item.name}/skill.json`;
+        const { data: fileContent, status: fileStatus } = await githubFetch(manifestUrl, token);
+        if (!fileContent || fileStatus !== 200)
+            continue;
+        try {
+            const content = Buffer.from(fileContent.content, "base64").toString("utf8");
+            const manifest = JSON.parse(content);
+            if (isValidManifest(manifest)) {
+                skills.push(manifest);
+            }
+        }
+        catch {
+            console.error(chalk_1.default.yellow(`Warning: Failed to parse remote skill manifest for ${item.name}`));
+        }
+    }
+    return skills.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function downloadSkillToTemp(skillName) {
+    const token = await (0, auth_1.resolveToken)();
+    if (!token) {
+        console.error(chalk_1.default.red("No GitHub token available. Run 'skill-manager login' first."));
+        return null;
+    }
+    const repo = (0, auth_1.getPrivateRepo)();
+    const [owner, repoName] = repo.split("/");
+    const baseUrl = `https://api.github.com/repos/${owner}/${repoName}/contents/skills/${skillName}`;
+    const { data: items, status } = await githubFetch(baseUrl, token);
+    if (!items || status !== 200) {
+        if (status === 404) {
+            console.error(chalk_1.default.red(`Remote skill "${skillName}" not found.`));
+        }
+        return null;
+    }
+    const tempDir = path_1.default.join(os_1.default.tmpdir(), `skill-manager-${skillName}-${Date.now()}`);
+    await fs_extra_1.default.ensureDir(tempDir);
+    try {
+        await downloadDirectory(items, tempDir, owner, repoName, `skills/${skillName}`, token);
+        return tempDir;
+    }
+    catch (error) {
+        await fs_extra_1.default.remove(tempDir);
+        console.error(chalk_1.default.red(`Failed to download skill "${skillName}": ${error}`));
+        return null;
+    }
+}
+async function downloadDirectory(items, targetDir, owner, repoName, basePath, token) {
+    for (const item of items) {
+        const targetPath = path_1.default.join(targetDir, item.name);
+        if (item.type === "file") {
+            const fileUrl = `https://api.github.com/repos/${owner}/${repoName}/contents/${item.path}`;
+            const { data: fileContent, status } = await githubFetch(fileUrl, token);
+            if (fileContent && status === 200) {
+                const content = Buffer.from(fileContent.content, "base64");
+                await fs_extra_1.default.writeFile(targetPath, content);
+            }
+        }
+        else if (item.type === "dir") {
+            await fs_extra_1.default.ensureDir(targetPath);
+            const dirUrl = `https://api.github.com/repos/${owner}/${repoName}/contents/${item.path}`;
+            const { data: subItems, status } = await githubFetch(dirUrl, token);
+            if (subItems && status === 200) {
+                await downloadDirectory(subItems, targetPath, owner, repoName, item.path, token);
+            }
+        }
+    }
+}
+async function getRemoteSkillManifest(skillName) {
+    const token = await (0, auth_1.resolveToken)();
+    if (!token) {
+        return null;
+    }
+    const repo = (0, auth_1.getPrivateRepo)();
+    const [owner, repoName] = repo.split("/");
+    const manifestUrl = `https://api.github.com/repos/${owner}/${repoName}/contents/skills/${skillName}/skill.json`;
+    const { data: fileContent, status } = await githubFetch(manifestUrl, token);
+    if (!fileContent || status !== 200) {
+        return null;
+    }
+    try {
+        const content = Buffer.from(fileContent.content, "base64").toString("utf8");
+        const manifest = JSON.parse(content);
+        if (isValidManifest(manifest)) {
+            return manifest;
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}

package/dist/utils.d.ts

@@ -1,4 +1,4 @@
-export declare const MANAGER_VERSION = "5.2.2";
+export declare const MANAGER_VERSION = "5.4.0";
 export interface SkillManifest {
     name: string;
     version: string;
@@ -11,6 +11,10 @@ export interface SkillManifest {
     commands?: string[];
     tags?: string[];
 }
+export interface CatalogEntry {
+    manifest: SkillManifest;
+    source: "public" | "private";
+}
 export interface InstalledSkillInfo {
     version: string;
     installedAt: string;

package/dist/utils.js

@@ -13,7 +13,7 @@ exports.writeText = writeText;
 const path_1 = __importDefault(require("path"));
 const os_1 = __importDefault(require("os"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
-exports.MANAGER_VERSION = "5.2.2";
+exports.MANAGER_VERSION = "5.4.0";
 async function detectOpenCodePaths() {
     const homeConfig = path_1.default.join(os_1.default.homedir(), ".config", "opencode");
     const cwd = process.cwd();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nano-step/skill-manager",
-  "version": "5.2.2",
+  "version": "5.4.0",
   "description": "CLI tool that installs and manages AI agent skills, MCP tool routing, and workflow configurations.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",