@safeskill/cli 0.2.3 → 0.3.1

package/dist/cli.mjs

@@ -1,16 +1,18 @@
 #!/usr/bin/env node
-import { r as __toESM } from "./_chunks/rolldown-runtime.mjs";
-import { a as Ie, c as Se, d as fe, f as ve, g as require_picocolors, h as pD, i as esm_default, l as Y, m as ye, n as require_gray_matter, o as M, p as xe, r as require_yauzl, s as Me, t as xdgConfig, u as be } from "./_chunks/libs/common.mjs";
-import { execSync, spawnSync } from "child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { i as __toESM, n as __exportAll } from "./_chunks/rolldown-runtime.mjs";
+import { _ as require_picocolors, a as esm_default, c as Me, d as be, f as fe, g as pD, h as ye, i as require_yauzl, l as Se, m as xe, n as xdgConfig, o as Ie, p as ve, r as require_gray_matter, s as M, t as require_dist, u as Y } from "./_chunks/libs/common.mjs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "fs";
 import { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
 import { homedir, platform, tmpdir } from "os";
-import { fileURLToPath } from "url";
 import * as readline from "readline";
 import { Writable } from "stream";
+import { promisify } from "util";
+import { execFile, execSync, spawn, spawnSync } from "child_process";
 import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
 import { gunzipSync } from "zlib";
 import { createHash } from "crypto";
+import { createHash as createHash$1 } from "node:crypto";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const packageJsonPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
 let version$2;
@@ -37,6 +39,14 @@ function getOwnerRepo(parsed) {
 		if (path.includes("/")) return path;
 		return null;
 	}
+	if (parsed.url.startsWith("ssh://")) try {
+		let path = new URL(parsed.url).pathname.slice(1);
+		path = path.replace(/\.git$/, "");
+		if (path.includes("/")) return path;
+		return null;
+	} catch {
+		return null;
+	}
 	if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
 	try {
 		let path = new URL(parsed.url).pathname.slice(1);
@@ -71,17 +81,57 @@ function isLocalPath(input) {
 	return isAbsolute(input) || input.startsWith("./") || input.startsWith("../") || input === "." || input === ".." || /^[a-zA-Z]:[/\\]/.test(input);
 }
 const SOURCE_ALIASES = { "coinbase/agentWallet": "coinbase/agentic-wallet-skills" };
+function decodeFragmentValue(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+function looksLikeGitSource(input) {
+	if (input.startsWith("github:") || input.startsWith("gitlab:") || input.startsWith("git@")) return true;
+	if (input.startsWith("ssh://")) return true;
+	if (input.startsWith("http://") || input.startsWith("https://")) try {
+		const parsed = new URL(input);
+		const pathname = parsed.pathname;
+		if (parsed.hostname === "github.com") return /^\/[^/]+\/[^/]+(?:\.git)?(?:\/tree\/[^/]+(?:\/.*)?)?\/?$/.test(pathname);
+		if (parsed.hostname === "gitlab.com") return /^\/.+?\/[^/]+(?:\.git)?(?:\/-\/tree\/[^/]+(?:\/.*)?)?\/?$/.test(pathname);
+	} catch {}
+	if (/^https?:\/\/.+\.git(?:$|[/?])/i.test(input)) return true;
+	return !input.includes(":") && !input.startsWith(".") && !input.startsWith("/") && /^([^/]+)\/([^/]+)(?:\/(.+)|@(.+))?$/.test(input);
+}
+function parseFragmentRef(input) {
+	const hashIndex = input.indexOf("#");
+	if (hashIndex < 0) return { inputWithoutFragment: input };
+	let inputWithoutFragment = input.slice(0, hashIndex);
+	const fragment = input.slice(hashIndex + 1);
+	if (!looksLikeGitSource(inputWithoutFragment) && inputWithoutFragment.endsWith("/")) {
+		const inputWithoutTrailingSlash = inputWithoutFragment.slice(0, -1);
+		if (looksLikeGitSource(inputWithoutTrailingSlash)) inputWithoutFragment = inputWithoutTrailingSlash;
+	}
+	if (!fragment || !looksLikeGitSource(inputWithoutFragment)) return { inputWithoutFragment: input };
+	const atIndex = fragment.indexOf("@");
+	if (atIndex === -1) return {
+		inputWithoutFragment,
+		ref: decodeFragmentValue(fragment)
+	};
+	const ref = fragment.slice(0, atIndex);
+	const skillFilter = fragment.slice(atIndex + 1);
+	return {
+		inputWithoutFragment,
+		ref: ref ? decodeFragmentValue(ref) : void 0,
+		skillFilter: skillFilter ? decodeFragmentValue(skillFilter) : void 0
+	};
+}
+function appendFragmentRef(input, ref, skillFilter) {
+	if (!ref) return input;
+	return `${input}#${ref}${skillFilter ? `@${skillFilter}` : ""}`;
+}
 function parseSource(input) {
-	const alias = SOURCE_ALIASES[input];
-	if (alias) input = alias;
 	if (input.startsWith("safeskill://")) return {
 		type: "hub",
 		url: input
 	};
-	const githubPrefixMatch = input.match(/^github:(.+)$/);
-	if (githubPrefixMatch) return parseSource(githubPrefixMatch[1]);
-	const gitlabPrefixMatch = input.match(/^gitlab:(.+)$/);
-	if (gitlabPrefixMatch) return parseSource(`https://gitlab.com/${gitlabPrefixMatch[1]}`);
 	if (isLocalPath(input)) {
 		const resolvedPath = resolve(input);
 		return {
@@ -90,14 +140,29 @@ function parseSource(input) {
 			localPath: resolvedPath
 		};
 	}
+	const { inputWithoutFragment, ref: fragmentRef, skillFilter: fragmentSkillFilter } = parseFragmentRef(input);
+	input = inputWithoutFragment;
+	const alias = SOURCE_ALIASES[input];
+	if (alias) input = alias;
+	const githubPrefixMatch = input.match(/^github:(.+)$/);
+	if (githubPrefixMatch) return parseSource(appendFragmentRef(githubPrefixMatch[1], fragmentRef, fragmentSkillFilter));
+	const gitlabPrefixMatch = input.match(/^gitlab:(.+)$/);
+	if (gitlabPrefixMatch) return parseSource(appendFragmentRef(`https://gitlab.com/${gitlabPrefixMatch[1]}`, fragmentRef, fragmentSkillFilter));
+	if (input.startsWith("ssh://")) return {
+		type: "git",
+		url: input,
+		...fragmentRef ? { ref: fragmentRef } : {},
+		...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
+	};
 	const githubTreeWithPathMatch = input.match(/github\.com\/([^/]+)\/([^/]+)\/tree\/([^/]+)\/(.+)/);
 	if (githubTreeWithPathMatch) {
 		const [, owner, repo, ref, subpath] = githubTreeWithPathMatch;
 		return {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
-			ref,
-			subpath: subpath ? sanitizeSubpath(subpath) : subpath
+			ref: ref || fragmentRef,
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath,
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const githubTreeMatch = input.match(/github\.com\/([^/]+)\/([^/]+)\/tree\/([^/]+)$/);
@@ -106,7 +171,8 @@ function parseSource(input) {
 		return {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
-			ref
+			ref: ref || fragmentRef,
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const githubRepoMatch = input.match(/github\.com\/([^/]+)\/([^/]+)/);
@@ -114,7 +180,9 @@ function parseSource(input) {
 		const [, owner, repo] = githubRepoMatch;
 		return {
 			type: "github",
-			url: `https://github.com/${owner}/${repo.replace(/\.git$/, "")}.git`
+			url: `https://github.com/${owner}/${repo.replace(/\.git$/, "")}.git`,
+			...fragmentRef ? { ref: fragmentRef } : {},
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const gitlabTreeWithPathMatch = input.match(/^(https?):\/\/([^/]+)\/(.+?)\/-\/tree\/([^/]+)\/(.+)/);
@@ -123,8 +191,9 @@ function parseSource(input) {
 		if (hostname !== "github.com" && repoPath) return {
 			type: "gitlab",
 			url: `${protocol}://${hostname}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref,
-			subpath: subpath ? sanitizeSubpath(subpath) : subpath
+			ref: ref || fragmentRef,
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath,
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const gitlabTreeMatch = input.match(/^(https?):\/\/([^/]+)\/(.+?)\/-\/tree\/([^/]+)$/);
@@ -133,7 +202,8 @@ function parseSource(input) {
 		if (hostname !== "github.com" && repoPath) return {
 			type: "gitlab",
 			url: `${protocol}://${hostname}/${repoPath.replace(/\.git$/, "")}.git`,
-			ref
+			ref: ref || fragmentRef,
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const gitlabRepoMatch = input.match(/gitlab\.com\/(.+?)(?:\.git)?\/?$/);
@@ -141,7 +211,9 @@ function parseSource(input) {
 		const repoPath = gitlabRepoMatch[1];
 		if (repoPath.includes("/")) return {
 			type: "gitlab",
-			url: `https://gitlab.com/${repoPath}.git`
+			url: `https://gitlab.com/${repoPath}.git`,
+			...fragmentRef ? { ref: fragmentRef } : {},
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	const atSkillMatch = input.match(/^([^/]+)\/([^/@]+)@(.+)$/);
@@ -150,16 +222,19 @@ function parseSource(input) {
 		return {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
-			skillFilter
+			...fragmentRef ? { ref: fragmentRef } : {},
+			skillFilter: fragmentSkillFilter || skillFilter
 		};
 	}
-	const shorthandMatch = input.match(/^([^/]+)\/([^/]+)(?:\/(.+))?$/);
+	const shorthandMatch = input.match(/^([^/]+)\/([^/]+)(?:\/(.+?))?\/?$/);
 	if (shorthandMatch && !input.includes(":") && !input.startsWith(".") && !input.startsWith("/")) {
 		const [, owner, repo, subpath] = shorthandMatch;
 		return {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
-			subpath: subpath ? sanitizeSubpath(subpath) : subpath
+			...fragmentRef ? { ref: fragmentRef } : {},
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath,
+			...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 		};
 	}
 	if (isWellKnownUrl(input)) return {
@@ -168,7 +243,9 @@ function parseSource(input) {
 	};
 	return {
 		type: "git",
-		url: input
+		url: input,
+		...fragmentRef ? { ref: fragmentRef } : {},
+		...fragmentSkillFilter ? { skillFilter: fragmentSkillFilter } : {}
 	};
 }
 function isWellKnownUrl(input) {
@@ -349,45 +426,187 @@ async function searchMultiselect(options) {
 		render();
 	});
 }
-const CLONE_TIMEOUT_MS = 6e4;
+const DEFAULT_CLONE_TIMEOUT_MS = 3e5;
+const CLONE_TIMEOUT_MS = (() => {
+	const raw = process.env.SKILLS_CLONE_TIMEOUT_MS;
+	if (!raw) return DEFAULT_CLONE_TIMEOUT_MS;
+	const parsed = Number.parseInt(raw, 10);
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_CLONE_TIMEOUT_MS;
+})();
+const execFileAsync = promisify(execFile);
+const LFS_DISABLED_GIT_CONFIG = [
+	"filter.lfs.required=false",
+	"filter.lfs.smudge=",
+	"filter.lfs.clean=",
+	"filter.lfs.process="
+];
 var GitCloneError = class extends Error {
 	url;
 	isTimeout;
+	isAuth;
 	isAuthError;
 	constructor(message, url, isTimeout = false, isAuthError = false) {
 		super(message);
 		this.name = "GitCloneError";
 		this.url = url;
 		this.isTimeout = isTimeout;
+		this.isAuth = isAuthError;
 		this.isAuthError = isAuthError;
 	}
 };
-async function cloneRepo(url, ref) {
-	const tempDir = await mkdtemp(join(tmpdir(), "skills-"));
-	const git = esm_default({ timeout: { block: CLONE_TIMEOUT_MS } }).env({
+function parseGitHubRepoUrl(url) {
+	const sshMatch = url.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/i);
+	if (sshMatch) {
+		const owner = sshMatch[1];
+		const repo = sshMatch[2];
+		return {
+			owner,
+			repo,
+			slug: `${owner}/${repo}`,
+			sshUrl: `git@github.com:${owner}/${repo}.git`
+		};
+	}
+	try {
+		const parsed = new URL(url);
+		if (parsed.hostname !== "github.com") return null;
+		const match = parsed.pathname.match(/^\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+		if (!match) return null;
+		const owner = match[1];
+		const repo = match[2];
+		return {
+			owner,
+			repo,
+			slug: `${owner}/${repo}`,
+			sshUrl: `git@github.com:${owner}/${repo}.git`
+		};
+	} catch {
+		return null;
+	}
+}
+function isGitHubHttpsCloneUrl(url) {
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" && parsed.hostname === "github.com";
+	} catch {
+		return false;
+	}
+}
+function isGitHubSsoAuthError(message) {
+	const lower = message.toLowerCase();
+	return lower.includes("saml sso") || lower.includes("enforced sso") || lower.includes("enabled or enforced saml") || lower.includes("re-authorize the oauth application");
+}
+function isAuthFailure(message) {
+	return message.includes("Authentication failed") || message.includes("could not read Username") || message.includes("Permission denied") || message.includes("Repository not found") || message.includes("requested URL returned error: 403") || isGitHubSsoAuthError(message);
+}
+function redactCloneUrl(url) {
+	return url.replace(/(https?:\/\/)[^/\s?#'")<>]+@/gi, "$1[redacted]@").replace(/([a-z][a-z0-9+.-]*:\/\/)[^/\s?#'")<>@:]+:[^/\s?#'")<>@]*@/gi, "$1[redacted]@");
+}
+function buildGitCloneEnv(extraEnv) {
+	return {
 		...process.env,
-		GIT_TERMINAL_PROMPT: "0"
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_LFS_SKIP_SMUDGE: "1",
+		...extraEnv
+	};
+}
+function gitLfsDisabledCloneArgs() {
+	return LFS_DISABLED_GIT_CONFIG.flatMap((config) => ["--config", config]);
+}
+function createGitClient(extraEnv) {
+	return esm_default({
+		timeout: { block: CLONE_TIMEOUT_MS },
+		config: LFS_DISABLED_GIT_CONFIG
+	}).env(buildGitCloneEnv(extraEnv));
+}
+async function resetTempDir(dir) {
+	await rm(dir, {
+		recursive: true,
+		force: true
+	}).catch(() => {});
+	await mkdir(dir, { recursive: true });
+}
+async function tryGhClone(repo, tempDir, ref) {
+	let cloneTarget = repo.slug;
+	try {
+		const { stdout, stderr } = await execFileAsync("gh", [
+			"auth",
+			"status",
+			"-h",
+			"github.com"
+		], {
+			timeout: 5e3,
+			env: buildGitCloneEnv()
+		});
+		const statusOutput = `${stdout}${stderr}`;
+		if (/Git operations protocol:\s+ssh/i.test(statusOutput)) cloneTarget = repo.sshUrl;
+	} catch {
+		return false;
+	}
+	const gitFlags = ref ? [
+		...gitLfsDisabledCloneArgs(),
+		"--depth=1",
+		"--branch",
+		ref
+	] : [...gitLfsDisabledCloneArgs(), "--depth=1"];
+	await execFileAsync("gh", [
+		"repo",
+		"clone",
+		cloneTarget,
+		tempDir,
+		"--",
+		...gitFlags
+	], {
+		timeout: CLONE_TIMEOUT_MS,
+		env: buildGitCloneEnv()
 	});
+	return true;
+}
+function buildGitHubAuthError(url, repo, message) {
+	const displayUrl = redactCloneUrl(url);
+	if (repo && isGitHubSsoAuthError(message)) return `GitHub blocked HTTPS access to ${displayUrl} because the organization enforces SAML SSO.\n  skills tried your existing git credentials and available fallbacks, but none succeeded.\n  - Re-authorize your GitHub credentials/app for that org's SSO policy\n  - Or rerun with SSH: npx skills add ${repo.sshUrl}\n  - Verify access with: gh auth status -h github.com or ssh -T git@github.com`;
+	if (repo) return `Authentication failed for ${displayUrl}.\n  - For private repos, ensure you have access\n  - Retry with SSH: npx skills add ${repo.sshUrl}\n  - Check access with: gh auth status -h github.com or ssh -T git@github.com`;
+	return `Authentication failed for ${displayUrl}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`;
+}
+async function cloneRepo(url, ref) {
+	const tempDir = await mkdtemp(join(tmpdir(), "skills-"));
 	const cloneOptions = ref ? [
 		"--depth",
 		"1",
 		"--branch",
 		ref
 	] : ["--depth", "1"];
+	const repo = parseGitHubRepoUrl(url);
 	try {
-		await git.clone(url, tempDir, cloneOptions);
+		await createGitClient().clone(url, tempDir, cloneOptions);
 		return tempDir;
 	} catch (error) {
+		const errorMessage = error instanceof Error ? error.message : String(error);
+		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
+		const isAuthError = isAuthFailure(errorMessage);
+		if (isTimeout) {
+			await rm(tempDir, {
+				recursive: true,
+				force: true
+			}).catch(() => {});
+			throw new GitCloneError(`Clone timed out after ${Math.round(CLONE_TIMEOUT_MS / 1e3)}s. Common causes:\n  - Large repository: raise the timeout with SKILLS_CLONE_TIMEOUT_MS=600000 (10m)\n  - Slow network: retry, or clone manually and pass the local path to 'skills add'\n  - Private repo without credentials: ensure auth is configured\n      - For SSH: ssh-add -l (to check loaded keys)\n      - For HTTPS: gh auth status (if using GitHub CLI)`, url, true, false);
+		}
+		if (isAuthError && repo && isGitHubHttpsCloneUrl(url)) {
+			try {
+				await resetTempDir(tempDir);
+				if (await tryGhClone(repo, tempDir, ref)) return tempDir;
+			} catch {}
+			try {
+				await resetTempDir(tempDir);
+				await createGitClient({ GIT_SSH_COMMAND: process.env.GIT_SSH_COMMAND ?? "ssh -o BatchMode=yes" }).clone(repo.sshUrl, tempDir, cloneOptions);
+				return tempDir;
+			} catch {}
+		}
 		await rm(tempDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
-		const errorMessage = error instanceof Error ? error.message : String(error);
-		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
-		const isAuthError = errorMessage.includes("Authentication failed") || errorMessage.includes("could not read Username") || errorMessage.includes("Permission denied") || errorMessage.includes("Repository not found");
-		if (isTimeout) throw new GitCloneError("Clone timed out after 60s. This often happens with private repos that require authentication.\n  Ensure you have access and your SSH keys or credentials are configured:\n  - For SSH: ssh-add -l (to check loaded keys)\n  - For HTTPS: gh auth status (if using GitHub CLI)", url, true, false);
-		if (isAuthError) throw new GitCloneError(`Authentication failed for ${url}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`, url, false, true);
-		throw new GitCloneError(`Failed to clone ${url}: ${errorMessage}`, url, false, false);
+		if (isAuthError) throw new GitCloneError(buildGitHubAuthError(url, repo, errorMessage), url, false, true);
+		throw new GitCloneError(`Failed to clone ${redactCloneUrl(url)}: ${redactCloneUrl(errorMessage)}`, url, false, false);
 	}
 }
 async function cleanupTempDir(dir) {
@@ -404,10 +623,8 @@ const REGION_DOMAINS = {
 	global: "safeskill.io"
 };
 const REGION_DETECT_URLS = ["https://ifconfig.co/country-iso", "https://ipapi.co/country/"];
-const STATUS_TIMEOUT_MS = 2500;
 const DETECT_TIMEOUT_MS = 1500;
 let resolvedRegionPromise = null;
-let regionAvailabilityCache = /* @__PURE__ */ new Map();
 let safeSkillRegionOverride = null;
 function normalizeSafeSkillRegion(region) {
 	const value = region?.trim().toLowerCase();
@@ -443,61 +660,11 @@ async function detectRegionByPublicIP() {
 	}
 	return "global";
 }
-function hasCustomEndpoints() {
-	return !!(process.env.SAFESKILL_HUB_URL || process.env.SAFESKILL_SEARCH_URL || process.env.SAFESKILL_TELEMETRY_URL || process.env.SKILLS_API_URL);
-}
 function ensureAbsoluteUrl(url, fallbackPath) {
 	const parsed = new URL(url);
 	if (!parsed.pathname || parsed.pathname === "/") parsed.pathname = fallbackPath;
 	return parsed.toString().replace(/\/$/, "");
 }
-function getShellSpecificCommands(variable, value) {
-	const shell = process.env.SHELL;
-	const platform = process.platform;
-	const parentProcess = process.env.PROMPT || process.env.COMSPEC;
-	const commands = [];
-	if (platform === "win32") {
-		process.env.WT_SESSION || process.env.TERM_PROGRAM;
-		const isPowerShell = process.env.PSModulePath || parentProcess?.includes("powershell.exe") || parentProcess?.includes("pwsh.exe");
-		const isCMD = parentProcess?.includes("cmd.exe");
-		if (isCMD && !isPowerShell) commands.push(`CMD: set ${variable}=${value}`);
-		else if (isPowerShell && !isCMD) commands.push(`PowerShell: $env:${variable}="${value}"`);
-		else if (isCMD && isPowerShell) {
-			commands.push(`CMD: set ${variable}=${value}`);
-			commands.push(`PowerShell: $env:${variable}="${value}"`);
-		} else {
-			commands.push(`CMD: set ${variable}=${value}`);
-			commands.push(`PowerShell: $env:${variable}="${value}"`);
-		}
-	} else if (shell?.includes("bash") || shell?.includes("zsh")) commands.push(`bash/zsh: export ${variable}="${value}"`);
-	else if (shell?.includes("fish")) commands.push(`fish: set -gx ${variable} "${value}"`);
-	else commands.push(`export ${variable}="${value}"`);
-	return commands;
-}
-async function ensureRegionAvailable(region, hubBaseUrl) {
-	if (hasCustomEndpoints()) return;
-	const cacheKey = `${region}`;
-	if (regionAvailabilityCache.has(cacheKey)) {
-		await regionAvailabilityCache.get(cacheKey);
-		return;
-	}
-	const availabilityPromise = (async () => {
-		const statusUrl = new URL("/api/v1/status", hubBaseUrl).toString();
-		try {
-			if ((await fetch(statusUrl, {
-				signal: withTimeout(STATUS_TIMEOUT_MS),
-				headers: getHeaders()
-			})).ok) return;
-		} catch {}
-		const alternateRegion = region === "cn" ? "global" : "cn";
-		REGION_DOMAINS[alternateRegion];
-		const currentDomain = REGION_DOMAINS[region];
-		const commandList = getShellSpecificCommands("SAFESKILL_REGION", alternateRegion).map((cmd) => `  ${cmd}`).join("\n");
-		throw new Error(`SafeSkill ${region} region (${currentDomain}) is currently unavailable.\nTry these solutions:\n  1. Set environment variable:\n${commandList}\n  2. Or disable telemetry: DISABLE_TELEMETRY=1\n\nFor assistance, contact: dev@safeskill.io`);
-	})();
-	regionAvailabilityCache.set(cacheKey, availabilityPromise);
-	await availabilityPromise;
-}
 async function resolveSafeSkillRegion() {
 	if (resolvedRegionPromise) return resolvedRegionPromise;
 	resolvedRegionPromise = (async () => {
@@ -510,10 +677,7 @@ async function resolveSafeSkillRegion() {
 }
 async function getSafeSkillHubBaseUrl() {
 	if (process.env.SAFESKILL_HUB_URL) return process.env.SAFESKILL_HUB_URL;
-	const region = await resolveSafeSkillRegion();
-	const baseUrl = `https://hubapi.${REGION_DOMAINS[region]}`;
-	await ensureRegionAvailable(region, baseUrl);
-	return baseUrl;
+	return `https://hubapi.${REGION_DOMAINS[await resolveSafeSkillRegion()]}`;
 }
 async function getSafeSkillSearchUrlWithHub(hubBaseUrl) {
 	const configured = process.env.SAFESKILL_SEARCH_URL || process.env.SKILLS_API_URL;
@@ -753,7 +917,7 @@ async function resolveHubSkill(source, agent) {
 				source,
 				agent
 			})
-		}) : null;
+		}).catch(() => null) : null;
 		return resolveWithAgent && resolveWithAgent.ok ? resolveWithAgent : fetch(resolveUrl, {
 			method: "POST",
 			headers: getHeaders({ "content-type": "application/json" }),
@@ -761,15 +925,25 @@ async function resolveHubSkill(source, agent) {
 		});
 	};
 	let resolvedBaseUrl = baseUrl;
-	let response = await resolveFromBaseUrl(baseUrl);
-	const alternateBaseUrl = response.status >= 500 ? getAlternateHubBaseUrl(baseUrl) : null;
+	let response = null;
+	let lastError;
+	try {
+		response = await resolveFromBaseUrl(baseUrl);
+	} catch (error) {
+		lastError = error;
+	}
+	const alternateBaseUrl = !response || response.status >= 500 ? getAlternateHubBaseUrl(baseUrl) : null;
 	if (alternateBaseUrl) {
-		const alternateResponse = await resolveFromBaseUrl(alternateBaseUrl);
-		if (alternateResponse.ok || !response.ok) {
+		const alternateResponse = await resolveFromBaseUrl(alternateBaseUrl).catch((error) => {
+			lastError = error;
+			return null;
+		});
+		if (alternateResponse && (alternateResponse.ok || !response || !response.ok)) {
 			response = alternateResponse;
 			resolvedBaseUrl = alternateBaseUrl;
 		}
 	}
+	if (!response) throw lastError instanceof Error ? lastError : /* @__PURE__ */ new Error("hub resolve failed");
 	if (!response.ok) throw new Error(`hub resolve failed: ${response.status}`);
 	const resolved = await readEnvelope(response);
 	resolved.hubBaseUrl = resolvedBaseUrl;
@@ -831,6 +1005,18 @@ async function checkHubUpdates(items) {
 	return readEnvelope(response);
 }
 var import_gray_matter = /* @__PURE__ */ __toESM(require_gray_matter(), 1);
+function parseFrontmatter(content) {
+	const match = content.match(/^\uFEFF?---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*\r?\n?([\s\S]*)$/);
+	if (!match) return {
+		data: {},
+		content
+	};
+	const parsed = (0, import_gray_matter.default)(`---\n${match[1] ?? ""}\n---\n`);
+	return {
+		data: parsed.data && typeof parsed.data === "object" && !Array.isArray(parsed.data) ? parsed.data : {},
+		content: match[2] ?? ""
+	};
+}
 function isContainedIn(targetPath, basePath) {
 	const normalizedBase = normalize(resolve(basePath));
 	const normalizedTarget = normalize(resolve(targetPath));
@@ -896,6 +1082,85 @@ async function getPluginGroupings(basePath) {
 	} catch {}
 	return groupings;
 }
+const CSI_RE = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]/g;
+const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
+const DCS_PM_APC_RE = /\x1b[P^_][\s\S]*?(?:\x1b\\)/g;
+const SIMPLE_ESC_RE = /\x1b[\x20-\x2f]*[\x30-\x7e]/g;
+const C1_RE = /[\x80-\x9f]/g;
+const CONTROL_RE = /[\x00-\x08\x0b\x0c\x0d-\x1f\x7f]/g;
+function stripTerminalEscapes(input) {
+	return input.replace(OSC_RE, "").replace(DCS_PM_APC_RE, "").replace(CSI_RE, "").replace(SIMPLE_ESC_RE, "").replace(C1_RE, "").replace(CONTROL_RE, "");
+}
+function sanitizeMetadata(input) {
+	if (typeof input !== "string") return "";
+	return stripTerminalEscapes(input).replace(/[\r\n]+/g, " ").trim();
+}
+const LOCAL_LOCK_FILE = "skills-lock.json";
+const CURRENT_VERSION$1 = 1;
+function getLocalLockPath(cwd) {
+	return join(cwd || process.cwd(), LOCAL_LOCK_FILE);
+}
+async function readLocalLock(cwd) {
+	const lockPath = getLocalLockPath(cwd);
+	try {
+		const content = await readFile(lockPath, "utf-8");
+		const parsed = JSON.parse(content);
+		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
+		if (parsed.version < CURRENT_VERSION$1) return createEmptyLocalLock();
+		return parsed;
+	} catch {
+		return createEmptyLocalLock();
+	}
+}
+async function writeLocalLock(lock, cwd) {
+	const lockPath = getLocalLockPath(cwd);
+	const sortedSkills = {};
+	for (const key of Object.keys(lock.skills).sort()) sortedSkills[key] = lock.skills[key];
+	const sorted = {
+		version: lock.version,
+		skills: sortedSkills
+	};
+	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
+}
+async function computeSkillFolderHash(skillDir) {
+	const files = [];
+	await collectFiles(skillDir, skillDir, files);
+	files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+	const hash = createHash("sha256");
+	for (const file of files) {
+		hash.update(file.relativePath);
+		hash.update(file.content);
+	}
+	return hash.digest("hex");
+}
+async function collectFiles(baseDir, currentDir, results) {
+	const entries = await readdir(currentDir, { withFileTypes: true });
+	await Promise.all(entries.map(async (entry) => {
+		const fullPath = join(currentDir, entry.name);
+		if (entry.isDirectory()) {
+			if (entry.name === ".git" || entry.name === "node_modules") return;
+			await collectFiles(baseDir, fullPath, results);
+		} else if (entry.isFile()) {
+			const content = await readFile(fullPath);
+			const relativePath = relative(baseDir, fullPath).split("\\").join("/");
+			results.push({
+				relativePath,
+				content
+			});
+		}
+	}));
+}
+async function addSkillToLocalLock(skillName, entry, cwd) {
+	const lock = await readLocalLock(cwd);
+	lock.skills[skillName] = entry;
+	await writeLocalLock(lock, cwd);
+}
+function createEmptyLocalLock() {
+	return {
+		version: CURRENT_VERSION$1,
+		skills: {}
+	};
+}
 const SKIP_DIRS = [
 	"node_modules",
 	".git",
@@ -903,6 +1168,61 @@ const SKIP_DIRS = [
 	"build",
 	"__pycache__"
 ];
+const AGENT_PROJECT_SKILL_DIRS = [
+	".aider-desk/skills",
+	".agents/skills",
+	"agent/skills",
+	"data/skills",
+	".autohand/skills",
+	".adal/skills",
+	".bob/skills",
+	".claude/skills",
+	".cline/skills",
+	".codeartsdoer/skills",
+	".codebuddy/skills",
+	".codemaker/skills",
+	".codestudio/skills",
+	".codex/skills",
+	".commandcode/skills",
+	".continue/skills",
+	".github/skills",
+	".goose/skills",
+	".devin/skills",
+	".flocks/plugins/skills",
+	".forge/skills",
+	".hermes/skills",
+	".iflow/skills",
+	".inferencesh/skills",
+	".jazz/skills",
+	".junie/skills",
+	".kilocode/skills",
+	".kiro/skills",
+	".mux/skills",
+	".lingma/skills",
+	".moxby/skills",
+	".neovate/skills",
+	".ona/skills",
+	".opencode/skills",
+	".openhands/skills",
+	".pi/skills",
+	".pochi/skills",
+	".qoder/skills",
+	".reasonix/skills",
+	".rovodev/skills",
+	".roo/skills",
+	".tabnine/agent/skills",
+	".terramind/skills",
+	".tinycloud/skills",
+	".trae/skills",
+	".windsurf/skills",
+	".zencoder/skills"
+];
+function normalizeSkillName(name) {
+	return name.toLowerCase().replace(/[\s_]+/g, "-");
+}
+function normalizeRelativePath(path) {
+	return path.split(sep).join("/").replace(/\/+/g, "/");
+}
 function shouldInstallInternalSkills() {
 	const envValue = process.env.INSTALL_INTERNAL_SKILLS;
 	return envValue === "1" || envValue === "true";
@@ -917,7 +1237,7 @@ async function hasSkillMd(dir) {
 async function parseSkillMd(skillMdPath, options) {
 	try {
 		const content = await readFile(skillMdPath, "utf-8");
-		const { data } = (0, import_gray_matter.default)(content);
+		const { data } = parseFrontmatter(content);
 		let skillData = data;
 		if (!skillData.name || !skillData.description) try {
 			const metaContent = await readFile(join(dirname(skillMdPath), "_meta.json"), "utf-8");
@@ -940,9 +1260,14 @@ async function parseSkillMd(skillMdPath, options) {
 		if (!skillData.name || !skillData.description) return null;
 		if (typeof skillData.name !== "string" || typeof skillData.description !== "string") return null;
 		if (skillData.metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) return null;
+		let name = sanitizeMetadata(skillData.name);
+		let description = sanitizeMetadata(skillData.description);
+		if (!name && options?.fallbackName) name = sanitizeMetadata(options.fallbackName);
+		if (!description && options?.fallbackDescription) description = sanitizeMetadata(options.fallbackDescription);
+		if (!name || !description) return null;
 		return {
-			name: skillData.name,
-			description: skillData.description,
+			name,
+			description,
 			path: dirname(skillMdPath),
 			rawContent: content,
 			metadata: skillData.metadata,
@@ -972,6 +1297,8 @@ function isSubpathSafe(basePath, subpath) {
 async function discoverSkills(basePath, subpath, options) {
 	const skills = [];
 	const seenNames = /* @__PURE__ */ new Set();
+	const localLock = await readLocalLock(basePath);
+	const lockedSkillNames = new Set(Object.keys(localLock.skills).map(normalizeSkillName));
 	if (subpath && !isSubpathSafe(basePath, subpath)) throw new Error(`Invalid subpath: "${subpath}" resolves outside the repository directory. Subpath must not contain ".." segments that escape the base path.`);
 	const searchPath = subpath ? join(basePath, subpath) : basePath;
 	const pluginGroupings = await getPluginGroupings(searchPath);
@@ -980,13 +1307,23 @@ async function discoverSkills(basePath, subpath, options) {
 		if (pluginGroupings.has(resolvedPath)) skill.pluginName = pluginGroupings.get(resolvedPath);
 		return skill;
 	};
+	const isInstalledProjectSkill = (skill) => {
+		if (lockedSkillNames.size === 0) return false;
+		const relativeDir = normalizeRelativePath(relative(basePath, skill.path));
+		if (!AGENT_PROJECT_SKILL_DIRS.some((dir) => relativeDir === dir || relativeDir.startsWith(`${dir}/`))) return false;
+		const skillName = normalizeSkillName(skill.name);
+		const directoryName = normalizeSkillName(basename(skill.path));
+		return lockedSkillNames.has(skillName) || lockedSkillNames.has(directoryName);
+	};
 	if (await hasSkillMd(searchPath)) {
 		let skill = await parseSkillMd(join(searchPath, "SKILL.md"), options);
 		if (skill) {
-			skill = enhanceSkill(skill);
-			skills.push(skill);
-			seenNames.add(skill.name);
-			if (!options?.fullDepth) return skills;
+			if (!isInstalledProjectSkill(skill)) {
+				skill = enhanceSkill(skill);
+				skills.push(skill);
+				seenNames.add(skill.name);
+				if (!options?.fullDepth) return skills;
+			}
 		}
 	}
 	const prioritySearchDirs = [
@@ -995,50 +1332,44 @@ async function discoverSkills(basePath, subpath, options) {
 		join(searchPath, "skills/.curated"),
 		join(searchPath, "skills/.experimental"),
 		join(searchPath, "skills/.system"),
-		join(searchPath, ".agents/skills"),
-		join(searchPath, ".claude/skills"),
-		join(searchPath, ".cline/skills"),
-		join(searchPath, ".codebuddy/skills"),
-		join(searchPath, ".codex/skills"),
-		join(searchPath, ".commandcode/skills"),
-		join(searchPath, ".continue/skills"),
-		join(searchPath, ".github/skills"),
-		join(searchPath, ".goose/skills"),
-		join(searchPath, ".iflow/skills"),
-		join(searchPath, ".junie/skills"),
-		join(searchPath, ".kilocode/skills"),
-		join(searchPath, ".kiro/skills"),
-		join(searchPath, ".mux/skills"),
-		join(searchPath, ".neovate/skills"),
-		join(searchPath, ".opencode/skills"),
-		join(searchPath, ".openhands/skills"),
-		join(searchPath, ".pi/skills"),
-		join(searchPath, ".qoder/skills"),
-		join(searchPath, ".roo/skills"),
-		join(searchPath, ".trae/skills"),
-		join(searchPath, ".windsurf/skills"),
-		join(searchPath, ".zencoder/skills")
+		...AGENT_PROJECT_SKILL_DIRS.map((dir) => join(searchPath, dir))
 	];
+	const deepContainerDirs = new Set(prioritySearchDirs.slice(1));
 	prioritySearchDirs.push(...await getPluginSkillPaths(searchPath));
-	for (const dir of prioritySearchDirs) try {
-		const entries = await readdir(dir, { withFileTypes: true });
-		for (const entry of entries) if (entry.isDirectory()) {
-			const skillDir = join(dir, entry.name);
-			if (await hasSkillMd(skillDir)) {
-				let skill = await parseSkillMd(join(skillDir, "SKILL.md"), options);
-				if (skill && !seenNames.has(skill.name)) {
-					skill = enhanceSkill(skill);
-					skills.push(skill);
-					seenNames.add(skill.name);
-				}
+	const tryAddSkillAt = async (skillDir) => {
+		if (!await hasSkillMd(skillDir)) return false;
+		let skill = await parseSkillMd(join(skillDir, "SKILL.md"), options);
+		if (!skill || seenNames.has(skill.name)) return true;
+		if (isInstalledProjectSkill(skill)) return true;
+		skill = enhanceSkill(skill);
+		skills.push(skill);
+		seenNames.add(skill.name);
+		return true;
+	};
+	for (const dir of prioritySearchDirs) {
+		const walkDeep = deepContainerDirs.has(dir);
+		try {
+			const entries = await readdir(dir, { withFileTypes: true });
+			for (const entry of entries) {
+				if (!entry.isDirectory()) continue;
+				const childDir = join(dir, entry.name);
+				if (await tryAddSkillAt(childDir) || !walkDeep) continue;
+				if (SKIP_DIRS.includes(entry.name)) continue;
+				try {
+					const grandEntries = await readdir(childDir, { withFileTypes: true });
+					for (const grand of grandEntries) {
+						if (!grand.isDirectory() || SKIP_DIRS.includes(grand.name)) continue;
+						await tryAddSkillAt(join(childDir, grand.name));
+					}
+				} catch {}
 			}
-		}
-	} catch {}
+		} catch {}
+	}
 	if (skills.length === 0 || options?.fullDepth) {
 		const allSkillDirs = await findSkillDirs(searchPath);
 		for (const skillDir of allSkillDirs) {
 			let skill = await parseSkillMd(join(skillDir, "SKILL.md"), options);
-			if (skill && !seenNames.has(skill.name)) {
+			if (skill && !seenNames.has(skill.name) && !isInstalledProjectSkill(skill)) {
 				skill = enhanceSkill(skill);
 				skills.push(skill);
 				seenNames.add(skill.name);
@@ -1062,6 +1393,19 @@ const home = homedir();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
 const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
+const vibeHome = process.env.VIBE_HOME?.trim() || join(home, ".vibe");
+const hermesHome = process.env.HERMES_HOME?.trim() || join(home, ".hermes");
+const autohandHome = process.env.AUTOHAND_HOME?.trim() || join(home, ".autohand");
+const zedAppDataHome = process.env.APPDATA?.trim();
+const zedFlatpakConfigHome = process.env.FLATPAK_XDG_CONFIG_HOME?.trim();
+function packageJsonHasDependency(packageJsonPath, dependencyName) {
+	try {
+		const packageJson = JSON.parse(readFileSync(packageJsonPath, "utf-8"));
+		return !!(packageJson.dependencies?.[dependencyName] || packageJson.devDependencies?.[dependencyName]);
+	} catch {
+		return false;
+	}
+}
 function getOpenClawGlobalSkillsDir(homeDir = home, pathExists = existsSync) {
 	if (pathExists(join(homeDir, ".openclaw"))) return join(homeDir, ".openclaw/skills");
 	if (pathExists(join(homeDir, ".clawdbot"))) return join(homeDir, ".clawdbot/skills");
@@ -1069,6 +1413,13 @@ function getOpenClawGlobalSkillsDir(homeDir = home, pathExists = existsSync) {
 	return join(homeDir, ".openclaw/skills");
 }
 const agents = {
+	"aider-desk": {
+		name: "aider-desk",
+		displayName: "AiderDesk",
+		skillsDir: ".aider-desk/skills",
+		globalSkillsDir: join(home, ".aider-desk/skills"),
+		detectInstalled: async () => existsSync(join(home, ".aider-desk"))
+	},
 	amp: {
 		name: "amp",
 		displayName: "Amp",
@@ -1087,6 +1438,27 @@ const agents = {
 			return existsSync(join(home, ".gemini/antigravity"));
 		}
 	},
+	"antigravity-cli": {
+		name: "antigravity-cli",
+		displayName: "Antigravity CLI",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: join(home, ".gemini/antigravity-cli/skills"),
+		detectInstalled: async () => existsSync(join(home, ".gemini/antigravity-cli"))
+	},
+	astrbot: {
+		name: "astrbot",
+		displayName: "AstrBot",
+		skillsDir: "data/skills",
+		globalSkillsDir: join(home, ".astrbot/data/skills"),
+		detectInstalled: async () => existsSync(join(process.cwd(), "data/skills")) || existsSync(join(home, ".astrbot"))
+	},
+	"autohand-code": {
+		name: "autohand-code",
+		displayName: "Autohand Code CLI",
+		skillsDir: ".autohand/skills",
+		globalSkillsDir: join(autohandHome, "skills"),
+		detectInstalled: async () => existsSync(autohandHome)
+	},
 	augment: {
 		name: "augment",
 		displayName: "Augment",
@@ -1096,6 +1468,13 @@ const agents = {
 			return existsSync(join(home, ".augment"));
 		}
 	},
+	bob: {
+		name: "bob",
+		displayName: "IBM Bob",
+		skillsDir: ".bob/skills",
+		globalSkillsDir: join(home, ".bob/skills"),
+		detectInstalled: async () => existsSync(join(home, ".bob"))
+	},
 	"claude-code": {
 		name: "claude-code",
 		displayName: "Claude Code",
@@ -1123,6 +1502,13 @@ const agents = {
 			return existsSync(join(home, ".cline"));
 		}
 	},
+	"codearts-agent": {
+		name: "codearts-agent",
+		displayName: "CodeArts Agent",
+		skillsDir: ".codeartsdoer/skills",
+		globalSkillsDir: join(home, ".codeartsdoer/skills"),
+		detectInstalled: async () => existsSync(join(home, ".codeartsdoer"))
+	},
 	codebuddy: {
 		name: "codebuddy",
 		displayName: "CodeBuddy",
@@ -1132,6 +1518,20 @@ const agents = {
 			return existsSync(join(process.cwd(), ".codebuddy")) || existsSync(join(home, ".codebuddy"));
 		}
 	},
+	codemaker: {
+		name: "codemaker",
+		displayName: "Codemaker",
+		skillsDir: ".codemaker/skills",
+		globalSkillsDir: join(home, ".codemaker/skills"),
+		detectInstalled: async () => existsSync(join(home, ".codemaker"))
+	},
+	codestudio: {
+		name: "codestudio",
+		displayName: "Code Studio",
+		skillsDir: ".codestudio/skills",
+		globalSkillsDir: join(home, ".codestudio/skills"),
+		detectInstalled: async () => existsSync(join(home, ".codestudio"))
+	},
 	codex: {
 		name: "codex",
 		displayName: "Codex",
@@ -1195,6 +1595,21 @@ const agents = {
 			return existsSync(join(home, ".deepagents"));
 		}
 	},
+	devin: {
+		name: "devin",
+		displayName: "Devin for Terminal",
+		skillsDir: ".devin/skills",
+		globalSkillsDir: join(configHome, "devin/skills"),
+		detectInstalled: async () => existsSync(join(configHome, "devin"))
+	},
+	dexto: {
+		name: "dexto",
+		displayName: "Dexto",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: join(home, ".agents/skills"),
+		showInUniversalPrompt: false,
+		detectInstalled: async () => existsSync(join(home, ".dexto"))
+	},
 	droid: {
 		name: "droid",
 		displayName: "Droid",
@@ -1204,15 +1619,33 @@ const agents = {
 			return existsSync(join(home, ".factory"));
 		}
 	},
+	eve: {
+		name: "eve",
+		displayName: "Eve",
+		skillsDir: "agent/skills",
+		globalSkillsDir: void 0,
+		detectInstalled: async () => {
+			const cwd = process.cwd();
+			return existsSync(join(cwd, "agent")) && packageJsonHasDependency(join(cwd, "package.json"), "eve");
+		}
+	},
 	firebender: {
 		name: "firebender",
 		displayName: "Firebender",
 		skillsDir: ".agents/skills",
 		globalSkillsDir: join(home, ".firebender/skills"),
+		showInUniversalPrompt: false,
 		detectInstalled: async () => {
 			return existsSync(join(home, ".firebender"));
 		}
 	},
+	forgecode: {
+		name: "forgecode",
+		displayName: "ForgeCode",
+		skillsDir: ".forge/skills",
+		globalSkillsDir: join(home, ".forge/skills"),
+		detectInstalled: async () => existsSync(join(home, ".forge"))
+	},
 	flocks: {
 		name: "flocks",
 		displayName: "Flocks",
@@ -1249,6 +1682,27 @@ const agents = {
 			return existsSync(join(configHome, "goose"));
 		}
 	},
+	"hermes-agent": {
+		name: "hermes-agent",
+		displayName: "Hermes Agent",
+		skillsDir: ".hermes/skills",
+		globalSkillsDir: join(hermesHome, "skills"),
+		detectInstalled: async () => existsSync(hermesHome)
+	},
+	"inference-sh": {
+		name: "inference-sh",
+		displayName: "inference.sh",
+		skillsDir: ".inferencesh/skills",
+		globalSkillsDir: join(home, ".inferencesh/skills"),
+		detectInstalled: async () => existsSync(join(home, ".inferencesh"))
+	},
+	jazz: {
+		name: "jazz",
+		displayName: "Jazz",
+		skillsDir: ".jazz/skills",
+		globalSkillsDir: join(home, ".jazz/skills"),
+		detectInstalled: async () => existsSync(join(home, ".jazz")) || existsSync(join(process.cwd(), ".jazz"))
+	},
 	junie: {
 		name: "junie",
 		displayName: "Junie",
@@ -1278,13 +1732,22 @@ const agents = {
 	},
 	"kimi-cli": {
 		name: "kimi-cli",
-		displayName: "Kimi Code CLI",
+		displayName: "Kimi CLI",
 		skillsDir: ".agents/skills",
 		globalSkillsDir: join(home, ".config/agents/skills"),
 		detectInstalled: async () => {
 			return existsSync(join(home, ".kimi"));
 		}
 	},
+	"kimi-code-cli": {
+		name: "kimi-code-cli",
+		displayName: "Kimi Code CLI",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: join(home, ".agents/skills"),
+		detectInstalled: async () => {
+			return existsSync(join(home, ".kimi-code")) || existsSync(join(home, ".kimi"));
+		}
+	},
 	"kiro-cli": {
 		name: "kiro-cli",
 		displayName: "Kiro CLI",
@@ -1303,6 +1766,21 @@ const agents = {
 			return existsSync(join(home, ".kode"));
 		}
 	},
+	lingma: {
+		name: "lingma",
+		displayName: "Lingma",
+		skillsDir: ".lingma/skills",
+		globalSkillsDir: join(home, ".lingma/skills"),
+		detectInstalled: async () => existsSync(join(home, ".lingma"))
+	},
+	loaf: {
+		name: "loaf",
+		displayName: "Loaf",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: join(home, ".agents/skills"),
+		showInUniversalPrompt: false,
+		detectInstalled: async () => existsSync(join(home, ".loaf"))
+	},
 	mcpjam: {
 		name: "mcpjam",
 		displayName: "MCPJam",
@@ -1316,11 +1794,18 @@ const agents = {
 		name: "mistral-vibe",
 		displayName: "Mistral Vibe",
 		skillsDir: ".vibe/skills",
-		globalSkillsDir: join(home, ".vibe/skills"),
+		globalSkillsDir: join(vibeHome, "skills"),
 		detectInstalled: async () => {
-			return existsSync(join(home, ".vibe"));
+			return existsSync(vibeHome);
 		}
 	},
+	moxby: {
+		name: "moxby",
+		displayName: "Moxby",
+		skillsDir: ".moxby/skills",
+		globalSkillsDir: join(home, ".moxby/skills"),
+		detectInstalled: async () => existsSync(join(home, ".moxby"))
+	},
 	mux: {
 		name: "mux",
 		displayName: "Mux",
@@ -1348,6 +1833,13 @@ const agents = {
 			return existsSync(join(home, ".openhands"));
 		}
 	},
+	ona: {
+		name: "ona",
+		displayName: "Ona",
+		skillsDir: ".ona/skills",
+		globalSkillsDir: join(home, ".ona/skills"),
+		detectInstalled: async () => existsSync(join(home, ".ona"))
+	},
 	pi: {
 		name: "pi",
 		displayName: "Pi",
@@ -1366,6 +1858,13 @@ const agents = {
 			return existsSync(join(home, ".qoder"));
 		}
 	},
+	"qoder-cn": {
+		name: "qoder-cn",
+		displayName: "Qoder CN",
+		skillsDir: ".qoder/skills",
+		globalSkillsDir: join(home, ".qoder-cn/skills"),
+		detectInstalled: async () => existsSync(join(home, ".qoder-cn"))
+	},
 	"qwen-code": {
 		name: "qwen-code",
 		displayName: "Qwen Code",
@@ -1385,6 +1884,20 @@ const agents = {
 			return existsSync(join(process.cwd(), ".replit"));
 		}
 	},
+	reasonix: {
+		name: "reasonix",
+		displayName: "Reasonix",
+		skillsDir: ".reasonix/skills",
+		globalSkillsDir: join(home, ".reasonix/skills"),
+		detectInstalled: async () => existsSync(join(home, ".reasonix"))
+	},
+	rovodev: {
+		name: "rovodev",
+		displayName: "Rovo Dev",
+		skillsDir: ".rovodev/skills",
+		globalSkillsDir: join(home, ".rovodev/skills"),
+		detectInstalled: async () => existsSync(join(home, ".rovodev"))
+	},
 	roo: {
 		name: "roo",
 		displayName: "Roo Code",
@@ -1394,6 +1907,27 @@ const agents = {
 			return existsSync(join(home, ".roo"));
 		}
 	},
+	"tabnine-cli": {
+		name: "tabnine-cli",
+		displayName: "Tabnine CLI",
+		skillsDir: ".tabnine/agent/skills",
+		globalSkillsDir: join(home, ".tabnine/agent/skills"),
+		detectInstalled: async () => existsSync(join(home, ".tabnine"))
+	},
+	terramind: {
+		name: "terramind",
+		displayName: "Terramind",
+		skillsDir: ".terramind/skills",
+		globalSkillsDir: join(home, ".terramind/skills"),
+		detectInstalled: async () => existsSync(join(home, ".terramind"))
+	},
+	tinycloud: {
+		name: "tinycloud",
+		displayName: "Tinycloud",
+		skillsDir: ".tinycloud/skills",
+		globalSkillsDir: join(home, ".tinycloud/skills"),
+		detectInstalled: async () => existsSync(join(home, ".tinycloud"))
+	},
 	trae: {
 		name: "trae",
 		displayName: "Trae",
@@ -1430,6 +1964,15 @@ const agents = {
 			return existsSync(join(home, ".codeium/windsurf"));
 		}
 	},
+	zed: {
+		name: "zed",
+		displayName: "Zed",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: join(home, ".agents/skills"),
+		detectInstalled: async () => {
+			return existsSync(join(configHome, "zed")) || !!zedAppDataHome && existsSync(join(zedAppDataHome, "Zed")) || !!zedFlatpakConfigHome && existsSync(join(zedFlatpakConfigHome, "zed"));
+		}
+	},
 	zencoder: {
 		name: "zencoder",
 		displayName: "Zencoder",
@@ -1439,6 +1982,13 @@ const agents = {
 			return existsSync(join(home, ".zencoder"));
 		}
 	},
+	zenflow: {
+		name: "zenflow",
+		displayName: "Zenflow",
+		skillsDir: ".zencoder/skills",
+		globalSkillsDir: join(home, ".zencoder/skills"),
+		detectInstalled: async () => existsSync(join(home, ".zencoder"))
+	},
 	neovate: {
 		name: "neovate",
 		displayName: "Neovate",
@@ -1457,6 +2007,16 @@ const agents = {
 			return existsSync(join(home, ".pochi"));
 		}
 	},
+	promptscript: {
+		name: "promptscript",
+		displayName: "PromptScript",
+		skillsDir: ".agents/skills",
+		globalSkillsDir: void 0,
+		showInUniversalPrompt: false,
+		detectInstalled: async () => {
+			return existsSync(join(process.cwd(), ".promptscript")) || existsSync(join(process.cwd(), "promptscript.yaml"));
+		}
+	},
 	adal: {
 		name: "adal",
 		displayName: "AdaL",
@@ -1475,12 +2035,37 @@ const agents = {
 		detectInstalled: async () => false
 	}
 };
+const agentAliases = { hermes: "hermes-agent" };
+function normalizeAgentType(input) {
+	if (input in agents) return input;
+	return agentAliases[input] ?? null;
+}
+function normalizeAgentTypes(inputs) {
+	const normalized = inputs.map((agent) => ({
+		input: agent,
+		normalized: normalizeAgentType(agent)
+	}));
+	return {
+		normalizedAgents: normalized.filter((agent) => Boolean(agent.normalized)).map((agent) => agent.normalized),
+		invalidAgents: normalized.filter((agent) => !agent.normalized).map((agent) => agent.input)
+	};
+}
 async function detectInstalledAgents() {
 	return (await Promise.all(Object.entries(agents).map(async ([type, config]) => ({
 		type,
 		installed: await config.detectInstalled()
 	})))).filter((r) => r.installed).map((r) => r.type);
 }
+const EVE_SUBAGENTS_DIR = join("agent", "subagents");
+function getEveSubagents(cwd = process.cwd()) {
+	const dir = join(cwd, EVE_SUBAGENTS_DIR);
+	if (!existsSync(dir)) return [];
+	try {
+		return readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name).sort();
+	} catch {
+		return [];
+	}
+}
 function getUniversalAgents() {
 	return Object.entries(agents).filter(([_, config]) => config.skillsDir === ".agents/skills" && config.showInUniversalList !== false).map(([type]) => type);
 }
@@ -1490,7 +2075,7 @@ function getNonUniversalAgents() {
 function isUniversalAgent(type) {
 	return agents[type].skillsDir === ".agents/skills";
 }
-const AGENTS_DIR$2 = ".agents";
+const AGENTS_DIR$1 = ".agents";
 const SKILLS_SUBDIR = "skills";
 function sanitizeName(name) {
 	const asciiName = name.toLowerCase().replace(/[^a-z0-9._]+/g, "-").replace(/^[.\-]+|[.\-]+$/g, "");
@@ -1509,15 +2094,19 @@ function sanitizeName(name) {
 function sanitizeSkillName(skill) {
 	return sanitizeName(skill.installName || skill.slug || skill.name);
 }
-function isPathSafe(basePath, targetPath) {
+function isPathSafe$1(basePath, targetPath) {
 	const normalizedBase = normalize(resolve(basePath));
 	const normalizedTarget = normalize(resolve(targetPath));
 	return normalizedTarget.startsWith(normalizedBase + sep) || normalizedTarget === normalizedBase;
 }
 function getCanonicalSkillsDir(global, cwd) {
-	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$2, SKILLS_SUBDIR);
+	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
 }
-function getAgentBaseDir(agentType, global, cwd) {
+function getEveSubagentSkillsDir(subagent, cwd) {
+	return join(cwd || process.cwd(), EVE_SUBAGENTS_DIR, sanitizeName(subagent), "skills");
+}
+function getAgentBaseDir(agentType, global, cwd, eveSubagent) {
+	if (agentType === "eve" && eveSubagent) return getEveSubagentSkillsDir(eveSubagent, cwd);
 	if (isUniversalAgent(agentType)) return getCanonicalSkillsDir(global, cwd);
 	const agent = agents[agentType];
 	const baseDir = global ? homedir() : cwd || process.cwd();
@@ -1585,18 +2174,18 @@ async function installSkillForAgent(skill, agentType, options = {}) {
 		error: `${agent.displayName} does not support global skill installation`
 	};
 	const skillName = sanitizeSkillName(skill);
-	const canonicalBase = getCanonicalSkillsDir(isGlobal, cwd);
+	const canonicalBase = agentType === "eve" ? getAgentBaseDir(agentType, isGlobal, cwd, options.eveSubagent) : getCanonicalSkillsDir(isGlobal, cwd);
 	const canonicalDir = join(canonicalBase, skillName);
-	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd);
+	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd, options.eveSubagent);
 	const agentDir = join(agentBase, skillName);
 	const installMode = options.mode ?? "symlink";
-	if (!isPathSafe(canonicalBase, canonicalDir)) return {
+	if (!isPathSafe$1(canonicalBase, canonicalDir)) return {
 		success: false,
 		path: agentDir,
 		mode: installMode,
 		error: "Invalid skill name: potential path traversal detected"
 	};
-	if (!isPathSafe(agentBase, agentDir)) return {
+	if (!isPathSafe$1(agentBase, agentDir)) return {
 		success: false,
 		path: agentDir,
 		mode: installMode,
@@ -1605,7 +2194,7 @@ async function installSkillForAgent(skill, agentType, options = {}) {
 	try {
 		if (installMode === "copy") {
 			await cleanAndCreateDirectory(agentDir);
-			await copyDirectory(skill.path, agentDir);
+			await copyDirectory(skill.path, agentDir, agentType);
 			return {
 				success: true,
 				path: agentDir,
@@ -1613,7 +2202,7 @@ async function installSkillForAgent(skill, agentType, options = {}) {
 			};
 		}
 		await cleanAndCreateDirectory(canonicalDir);
-		await copyDirectory(skill.path, canonicalDir);
+		await copyDirectory(skill.path, canonicalDir, agentType);
 		if (isGlobal && isUniversalAgent(agentType)) return {
 			success: true,
 			path: canonicalDir,
@@ -1646,26 +2235,44 @@ async function installSkillForAgent(skill, agentType, options = {}) {
 		};
 	}
 }
-const EXCLUDE_FILES = new Set(["metadata.json"]);
-const EXCLUDE_DIRS = new Set([
+const EXCLUDE_FILES$1 = new Set(["metadata.json"]);
+const EXCLUDE_DIRS$1 = new Set([
 	".git",
 	"__pycache__",
 	"__pypackages__"
 ]);
-const isExcluded = (name, isDirectory = false) => {
-	if (EXCLUDE_FILES.has(name)) return true;
+const isExcluded$1 = (name, isDirectory = false) => {
+	if (EXCLUDE_FILES$1.has(name)) return true;
 	if (name.startsWith(".")) return true;
-	if (isDirectory && EXCLUDE_DIRS.has(name)) return true;
+	if (isDirectory && EXCLUDE_DIRS$1.has(name)) return true;
 	return false;
 };
-async function copyDirectory(src, dest) {
+function stripIgnoredEveFrontmatter(raw) {
+	const { data, content } = parseFrontmatter(raw);
+	const eveData = {};
+	if (typeof data.description === "string") eveData.description = data.description;
+	if (typeof data.license === "string") eveData.license = data.license;
+	if (data.metadata && typeof data.metadata === "object") {
+		const metadata = { ...data.metadata };
+		delete metadata.internal;
+		if (Object.keys(metadata).length > 0) eveData.metadata = metadata;
+	}
+	const keys = Object.keys(eveData);
+	if (keys.length === 0) return content.trimStart();
+	return `---\n${keys.map((key) => `${key}: ${JSON.stringify(eveData[key])}`).join("\n")}\n---\n${content}`;
+}
+async function copyDirectory(src, dest, agentType) {
 	await mkdir(dest, { recursive: true });
 	const entries = await readdir(src, { withFileTypes: true });
-	await Promise.all(entries.filter((entry) => !isExcluded(entry.name, entry.isDirectory())).map(async (entry) => {
+	await Promise.all(entries.filter((entry) => !isExcluded$1(entry.name, entry.isDirectory())).map(async (entry) => {
 		const srcPath = join(src, entry.name);
 		const destPath = join(dest, entry.name);
-		if (entry.isDirectory()) await copyDirectory(srcPath, destPath);
+		if (entry.isDirectory()) await copyDirectory(srcPath, destPath, agentType);
 		else try {
+			if (agentType === "eve" && entry.name.toLowerCase() === "skill.md") {
+				await writeFile(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
+				return;
+			}
 			await cp(srcPath, destPath, {
 				dereference: true,
 				recursive: true
@@ -1680,9 +2287,9 @@ async function isSkillInstalled(skillName, agentType, options = {}) {
 	const agent = agents[agentType];
 	const sanitized = sanitizeName(skillName);
 	if (options.global && agent.globalSkillsDir === void 0) return false;
-	const targetBase = options.global ? agent.globalSkillsDir : join(options.cwd || process.cwd(), agent.skillsDir);
+	const targetBase = getAgentBaseDir(agentType, options.global ?? false, options.cwd, options.eveSubagent);
 	const skillDir = join(targetBase, sanitized);
-	if (!isPathSafe(targetBase, skillDir)) return false;
+	if (!isPathSafe$1(targetBase, skillDir)) return false;
 	try {
 		await access(skillDir);
 		return true;
@@ -1694,16 +2301,16 @@ function getInstallPath(skillName, agentType, options = {}) {
 	agents[agentType];
 	options.cwd || process.cwd();
 	const sanitized = sanitizeName(skillName);
-	const targetBase = getAgentBaseDir(agentType, options.global ?? false, options.cwd);
+	const targetBase = getAgentBaseDir(agentType, options.global ?? false, options.cwd, options.eveSubagent);
 	const installPath = join(targetBase, sanitized);
-	if (!isPathSafe(targetBase, installPath)) throw new Error("Invalid skill name: potential path traversal detected");
+	if (!isPathSafe$1(targetBase, installPath)) throw new Error("Invalid skill name: potential path traversal detected");
 	return installPath;
 }
 function getCanonicalPath(skillName, options = {}) {
 	const sanitized = sanitizeName(skillName);
 	const canonicalBase = getCanonicalSkillsDir(options.global ?? false, options.cwd);
 	const canonicalPath = join(canonicalBase, sanitized);
-	if (!isPathSafe(canonicalBase, canonicalPath)) throw new Error("Invalid skill name: potential path traversal detected");
+	if (!isPathSafe$1(canonicalBase, canonicalPath)) throw new Error("Invalid skill name: potential path traversal detected");
 	return canonicalPath;
 }
 async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
@@ -1718,17 +2325,17 @@ async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
 		error: `${agent.displayName} does not support global skill installation`
 	};
 	const skillName = sanitizeSkillName(skill);
-	const canonicalBase = getCanonicalSkillsDir(isGlobal, cwd);
+	const canonicalBase = agentType === "eve" ? getAgentBaseDir(agentType, isGlobal, cwd, options.eveSubagent) : getCanonicalSkillsDir(isGlobal, cwd);
 	const canonicalDir = join(canonicalBase, skillName);
-	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd);
+	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd, options.eveSubagent);
 	const agentDir = join(agentBase, skillName);
-	if (!isPathSafe(canonicalBase, canonicalDir)) return {
+	if (!isPathSafe$1(canonicalBase, canonicalDir)) return {
 		success: false,
 		path: agentDir,
 		mode: installMode,
 		error: "Invalid skill name: potential path traversal detected"
 	};
-	if (!isPathSafe(agentBase, agentDir)) return {
+	if (!isPathSafe$1(agentBase, agentDir)) return {
 		success: false,
 		path: agentDir,
 		mode: installMode,
@@ -1737,10 +2344,10 @@ async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
 	async function writeSkillFiles(targetDir) {
 		for (const [filePath, content] of skill.files) {
 			const fullPath = join(targetDir, filePath);
-			if (!isPathSafe(targetDir, fullPath)) continue;
+			if (!isPathSafe$1(targetDir, fullPath)) continue;
 			const parentDir = dirname(fullPath);
 			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, content, "utf-8");
+			await writeFile(fullPath, agentType === "eve" && basename(filePath).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(content) : content, "utf-8");
 		}
 	}
 	try {
@@ -1811,6 +2418,14 @@ async function listInstalledSkills(options = {}) {
 				path: agentDir,
 				agentType
 			});
+			if (agentType === "eve" && !isGlobal) for (const subagent of getEveSubagents(cwd)) {
+				const subagentDir = getEveSubagentSkillsDir(subagent, cwd);
+				if (!scopes.some((s) => s.path === subagentDir && s.global === isGlobal)) scopes.push({
+					global: isGlobal,
+					path: subagentDir,
+					agentType
+				});
+			}
 		}
 		const allAgentTypes = Object.keys(agents);
 		for (const agentType of allAgentTypes) {
@@ -1824,6 +2439,14 @@ async function listInstalledSkills(options = {}) {
 				path: agentDir,
 				agentType
 			});
+			if (agentType === "eve" && !isGlobal) for (const subagent of getEveSubagents(cwd)) {
+				const subagentDir = getEveSubagentSkillsDir(subagent, cwd);
+				if (!scopes.some((s) => s.path === subagentDir && s.global === isGlobal)) scopes.push({
+					global: isGlobal,
+					path: subagentDir,
+					agentType
+				});
+			}
 		}
 	}
 	for (const scope of scopes) try {
@@ -1869,7 +2492,7 @@ async function listInstalledSkills(options = {}) {
 				]));
 				for (const possibleName of possibleNames) {
 					const agentSkillDir = join(agentBase, possibleName);
-					if (!isPathSafe(agentBase, agentSkillDir)) continue;
+					if (!isPathSafe$1(agentBase, agentSkillDir)) continue;
 					try {
 						await access(agentSkillDir);
 						found = true;
@@ -1881,7 +2504,7 @@ async function listInstalledSkills(options = {}) {
 					for (const agentEntry of agentEntries) {
 						if (!agentEntry.isDirectory()) continue;
 						const candidateDir = join(agentBase, agentEntry.name);
-						if (!isPathSafe(agentBase, candidateDir)) continue;
+						if (!isPathSafe$1(agentBase, candidateDir)) continue;
 						try {
 							const candidateSkillMd = join(candidateDir, "SKILL.md");
 							await stat(candidateSkillMd);
@@ -1912,6 +2535,7 @@ async function listInstalledSkills(options = {}) {
 }
 const AUDIT_URL = "https://add-skill.vercel.sh/audit";
 let cliVersion = null;
+let detectedAgentName = null;
 function isCI() {
 	return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI || process.env.TRAVIS || process.env.BUILDKITE || process.env.JENKINS_URL || process.env.TEAMCITY_VERSION);
 }
@@ -1921,6 +2545,9 @@ function isEnabled() {
 function setVersion(version) {
 	cliVersion = version;
 }
+function setDetectedAgent(agentName) {
+	detectedAgentName = agentName;
+}
 async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
 	if (skillSlugs.length === 0) return null;
 	try {
@@ -1945,6 +2572,7 @@ function track(data) {
 			const params = new URLSearchParams();
 			if (cliVersion) params.set("v", cliVersion);
 			if (isCI()) params.set("ci", "1");
+			if (detectedAgentName) params.set("agent", detectedAgentName);
 			for (const [key, value] of Object.entries(data)) if (value !== void 0 && value !== null) params.set(key, String(value));
 			const telemetryUrl = await getSafeSkillTelemetryUrl();
 			fetch(`${telemetryUrl}?${params.toString()}`).catch(() => {});
@@ -1989,6 +2617,15 @@ var WellKnownProvider = class {
 		}
 	}
 	async fetchIndex(baseUrl) {
+		const result = await this.fetchIndexForUse(baseUrl);
+		if (!result) return null;
+		return {
+			index: result.index,
+			resolvedBaseUrl: result.resolvedBaseUrl,
+			resolvedWellKnownPath: result.resolvedWellKnownPath
+		};
+	}
+	async fetchIndexForUse(baseUrl) {
 		try {
 			const parsed = new URL(baseUrl);
 			const basePath = parsed.pathname.replace(/\/$/, "");
@@ -2011,12 +2648,21 @@ var WellKnownProvider = class {
 				const index = await response.json();
 				if (!index.skills || !Array.isArray(index.skills)) continue;
 				let allValid = true;
-				for (const entry of index.skills) if (!this.isValidSkillEntry(entry)) {
-					allValid = false;
-					break;
+				const originalEntries = [];
+				const sanitizedEntries = [];
+				for (const entry of index.skills) {
+					if (!this.isValidSkillEntry(entry)) {
+						allValid = false;
+						break;
+					}
+					const sanitizedEntry = this.sanitizeSkillEntry(entry);
+					if (!sanitizedEntry) continue;
+					originalEntries.push(entry);
+					sanitizedEntries.push(sanitizedEntry);
 				}
-				if (allValid) return {
-					index,
+				if (allValid && sanitizedEntries.length > 0) return {
+					index: { skills: sanitizedEntries },
+					originalEntries,
 					resolvedBaseUrl: resolvedBase,
 					resolvedWellKnownPath: wellKnownPath
 				};
@@ -2034,28 +2680,41 @@ var WellKnownProvider = class {
 		if (typeof e.name !== "string" || !e.name) return false;
 		if (typeof e.description !== "string" || !e.description) return false;
 		if (!Array.isArray(e.files) || e.files.length === 0) return false;
-		if (!/^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/.test(e.name) && e.name.length > 1) {
-			if (e.name.length === 1 && !/^[a-z0-9]$/.test(e.name)) return false;
-		}
+		if (!/^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/.test(e.name)) return false;
 		for (const file of e.files) {
 			if (typeof file !== "string") return false;
 			if (file.startsWith("/") || file.startsWith("\\") || file.includes("..")) return false;
+			if (!this.isSafeWellKnownFilePath(file)) return false;
 		}
 		if (!e.files.some((f) => typeof f === "string" && f.toLowerCase() === "skill.md")) return false;
 		return true;
 	}
+	isSafeWellKnownFilePath(file) {
+		if (/[\x00-\x1f\x7f-\x9f]/.test(file)) return false;
+		return stripTerminalEscapes(file) === file;
+	}
+	sanitizeSkillEntry(entry) {
+		const name = sanitizeMetadata(entry.name);
+		const description = sanitizeMetadata(entry.description);
+		if (!name || !description) return null;
+		return {
+			...entry,
+			name,
+			description
+		};
+	}
 	async fetchSkill(url) {
 		try {
 			const parsed = new URL(url);
-			const result = await this.fetchIndex(url);
+			const result = await this.fetchIndexForUse(url);
 			if (!result) return null;
-			const { index, resolvedBaseUrl, resolvedWellKnownPath } = result;
+			const { index, originalEntries, resolvedBaseUrl, resolvedWellKnownPath } = result;
 			let skillName = null;
 			const pathMatch = parsed.pathname.match(/\/.well-known\/(?:agent-skills|skills)\/([^/]+)\/?$/);
 			if (pathMatch && pathMatch[1] && pathMatch[1] !== "index.json") skillName = pathMatch[1];
-			else if (index.skills.length === 1) skillName = index.skills[0].name;
+			else if (index.skills.length === 1) skillName = originalEntries[0].name;
 			if (!skillName) return null;
-			const skillEntry = index.skills.find((s) => s.name === skillName);
+			const skillEntry = originalEntries.find((s) => s.name === skillName);
 			if (!skillEntry) return null;
 			return this.fetchSkillByEntry(resolvedBaseUrl, skillEntry, resolvedWellKnownPath);
 		} catch {
@@ -2065,13 +2724,16 @@ var WellKnownProvider = class {
 	async fetchSkillByEntry(baseUrl, entry, wellKnownPath) {
 		try {
 			const resolvedPath = wellKnownPath ?? this.WELL_KNOWN_PATHS[0];
+			if (!this.isValidSkillEntry(entry)) return null;
+			const sanitizedEntry = this.sanitizeSkillEntry(entry);
+			if (!sanitizedEntry) return null;
 			const skillBaseUrl = `${baseUrl.replace(/\/$/, "")}/${resolvedPath}/${entry.name}`;
 			const skillMdUrl = `${skillBaseUrl}/SKILL.md`;
 			const response = await fetch(skillMdUrl, { headers: getHeaders() });
 			if (!response.ok) return null;
 			const content = await response.text();
-			const { data } = (0, import_gray_matter.default)(content);
-			if (!data.name || !data.description) return null;
+			const { data } = parseFrontmatter(content);
+			if (typeof data.name !== "string" || typeof data.description !== "string" || !data.name || !data.description) return null;
 			const files = /* @__PURE__ */ new Map();
 			files.set("SKILL.md", content);
 			const filePromises = entry.files.filter((f) => f.toLowerCase() !== "skill.md").map(async (filePath) => {
@@ -2087,15 +2749,18 @@ var WellKnownProvider = class {
 			});
 			const fileResults = await Promise.all(filePromises);
 			for (const result of fileResults) if (result) files.set(result.path, result.content);
+			const name = sanitizeMetadata(data.name);
+			const description = sanitizeMetadata(data.description);
+			if (!name || !description) return null;
 			return {
-				name: data.name,
-				description: data.description,
+				name,
+				description,
 				content,
 				installName: entry.name,
 				sourceUrl: skillMdUrl,
 				metadata: data.metadata,
 				files,
-				indexEntry: entry
+				indexEntry: sanitizedEntry
 			};
 		} catch {
 			return null;
@@ -2103,10 +2768,10 @@ var WellKnownProvider = class {
 	}
 	async fetchAllSkills(url) {
 		try {
-			const result = await this.fetchIndex(url);
+			const result = await this.fetchIndexForUse(url);
 			if (!result) return [];
-			const { index, resolvedBaseUrl, resolvedWellKnownPath } = result;
-			const skillPromises = index.skills.map((entry) => this.fetchSkillByEntry(resolvedBaseUrl, entry, resolvedWellKnownPath));
+			const { originalEntries, resolvedBaseUrl, resolvedWellKnownPath } = result;
+			const skillPromises = originalEntries.map((entry) => this.fetchSkillByEntry(resolvedBaseUrl, entry, resolvedWellKnownPath));
 			return (await Promise.all(skillPromises)).filter((s) => s !== null);
 		} catch {
 			return [];
@@ -2140,28 +2805,28 @@ var WellKnownProvider = class {
 	}
 };
 const wellKnownProvider = new WellKnownProvider();
-const AGENTS_DIR$1 = ".agents";
-const LOCK_FILE$1 = ".skill-lock.json";
-const CURRENT_VERSION$1 = 4;
-function getSkillLockPath$1() {
+const AGENTS_DIR = ".agents";
+const LOCK_FILE = ".skill-lock.json";
+const CURRENT_VERSION = 4;
+function getSkillLockPath() {
 	const xdgStateHome = process.env.XDG_STATE_HOME;
-	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE$1);
-	return join(homedir(), AGENTS_DIR$1, LOCK_FILE$1);
+	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
+	return join(homedir(), AGENTS_DIR, LOCK_FILE);
 }
-async function readSkillLock$1() {
-	const lockPath = getSkillLockPath$1();
+async function readSkillLock() {
+	const lockPath = getSkillLockPath();
 	try {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
 		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLockFile();
-		if (parsed.version < CURRENT_VERSION$1) return createEmptyLockFile();
+		if (parsed.version < CURRENT_VERSION) return createEmptyLockFile();
 		return parsed;
 	} catch (error) {
 		return createEmptyLockFile();
 	}
 }
 async function writeSkillLock(lock) {
-	const lockPath = getSkillLockPath$1();
+	const lockPath = getSkillLockPath();
 	await mkdir(dirname(lockPath), { recursive: true });
 	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
@@ -2181,28 +2846,14 @@ function getGitHubToken() {
 	} catch {}
 	return null;
 }
-async function fetchSkillFolderHash(ownerRepo, skillPath, token) {
-	let folderPath = skillPath.replace(/\\/g, "/");
-	if (folderPath.endsWith("/SKILL.md")) folderPath = folderPath.slice(0, -9);
-	else if (folderPath.endsWith("SKILL.md")) folderPath = folderPath.slice(0, -8);
-	if (folderPath.endsWith("/")) folderPath = folderPath.slice(0, -1);
-	for (const branch of ["main", "master"]) try {
-		const url = `https://api.github.com/repos/${ownerRepo}/git/trees/${branch}?recursive=1`;
-		const headers = getHeaders({ Accept: "application/vnd.github.v3+json" });
-		if (token) headers["Authorization"] = `Bearer ${token}`;
-		const response = await fetch(url, { headers });
-		if (!response.ok) continue;
-		const data = await response.json();
-		if (!folderPath) return data.sha;
-		const folderEntry = data.tree.find((entry) => entry.type === "tree" && entry.path === folderPath);
-		if (folderEntry) return folderEntry.sha;
-	} catch {
-		continue;
-	}
-	return null;
+async function fetchSkillFolderHash(ownerRepo, skillPath, getToken, ref) {
+	const { fetchRepoTree, getSkillFolderHashFromTree } = await Promise.resolve().then(() => blob_exports);
+	const tree = await fetchRepoTree(ownerRepo, ref, getToken ?? void 0);
+	if (!tree) return null;
+	return getSkillFolderHashFromTree(tree, skillPath);
 }
 async function addSkillToLock(skillName, entry) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	const now = (/* @__PURE__ */ new Date()).toISOString();
 	const existingEntry = lock.skills[skillName];
 	lock.skills[skillName] = {
@@ -2213,109 +2864,43 @@ async function addSkillToLock(skillName, entry) {
 	await writeSkillLock(lock);
 }
 async function removeSkillFromLock(skillName) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!(skillName in lock.skills)) return false;
 	delete lock.skills[skillName];
 	await writeSkillLock(lock);
 	return true;
 }
 async function getSkillFromLock(skillName) {
-	return (await readSkillLock$1()).skills[skillName] ?? null;
+	return (await readSkillLock()).skills[skillName] ?? null;
 }
 async function getAllLockedSkills() {
-	return (await readSkillLock$1()).skills;
+	return (await readSkillLock()).skills;
 }
 function createEmptyLockFile() {
 	return {
-		version: CURRENT_VERSION$1,
+		version: CURRENT_VERSION,
 		skills: {},
 		dismissed: {}
 	};
 }
 async function isPromptDismissed(promptKey) {
-	return (await readSkillLock$1()).dismissed?.[promptKey] === true;
+	return (await readSkillLock()).dismissed?.[promptKey] === true;
 }
 async function dismissPrompt(promptKey) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	if (!lock.dismissed) lock.dismissed = {};
 	lock.dismissed[promptKey] = true;
 	await writeSkillLock(lock);
 }
 async function getLastSelectedAgents() {
-	return (await readSkillLock$1()).lastSelectedAgents;
+	return (await readSkillLock()).lastSelectedAgents;
 }
 async function saveSelectedAgents(agents) {
-	const lock = await readSkillLock$1();
+	const lock = await readSkillLock();
 	lock.lastSelectedAgents = agents;
 	await writeSkillLock(lock);
 }
-const LOCAL_LOCK_FILE = "skills-lock.json";
-const CURRENT_VERSION = 1;
-function getLocalLockPath(cwd) {
-	return join(cwd || process.cwd(), LOCAL_LOCK_FILE);
-}
-async function readLocalLock(cwd) {
-	const lockPath = getLocalLockPath(cwd);
-	try {
-		const content = await readFile(lockPath, "utf-8");
-		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
-		if (parsed.version < CURRENT_VERSION) return createEmptyLocalLock();
-		return parsed;
-	} catch {
-		return createEmptyLocalLock();
-	}
-}
-async function writeLocalLock(lock, cwd) {
-	const lockPath = getLocalLockPath(cwd);
-	const sortedSkills = {};
-	for (const key of Object.keys(lock.skills).sort()) sortedSkills[key] = lock.skills[key];
-	const sorted = {
-		version: lock.version,
-		skills: sortedSkills
-	};
-	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
-}
-async function computeSkillFolderHash(skillDir) {
-	const files = [];
-	await collectFiles(skillDir, skillDir, files);
-	files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-	const hash = createHash("sha256");
-	for (const file of files) {
-		hash.update(file.relativePath);
-		hash.update(file.content);
-	}
-	return hash.digest("hex");
-}
-async function collectFiles(baseDir, currentDir, results) {
-	const entries = await readdir(currentDir, { withFileTypes: true });
-	await Promise.all(entries.map(async (entry) => {
-		const fullPath = join(currentDir, entry.name);
-		if (entry.isDirectory()) {
-			if (entry.name === ".git" || entry.name === "node_modules") return;
-			await collectFiles(baseDir, fullPath, results);
-		} else if (entry.isFile()) {
-			const content = await readFile(fullPath);
-			const relativePath = relative(baseDir, fullPath).split("\\").join("/");
-			results.push({
-				relativePath,
-				content
-			});
-		}
-	}));
-}
-async function addSkillToLocalLock(skillName, entry, cwd) {
-	const lock = await readLocalLock(cwd);
-	lock.skills[skillName] = entry;
-	await writeLocalLock(lock, cwd);
-}
-function createEmptyLocalLock() {
-	return {
-		version: CURRENT_VERSION,
-		skills: {}
-	};
-}
-var version$1 = "0.2.3";
+var version$1 = "0.3.1";
 const isCancelled$1 = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -2325,6 +2910,12 @@ async function isSourcePrivate(source) {
 function initTelemetry(version) {
 	setVersion(version);
 }
+function getLockSourceForParsedSource(parsed) {
+	const normalizedSource = getOwnerRepo(parsed);
+	if (parsed.type === "github") return normalizedSource;
+	if (parsed.type === "gitlab" || parsed.type === "git") return parsed.url;
+	return normalizedSource;
+}
 function riskLabel(risk) {
 	switch (risk) {
 		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical Risk"));
@@ -2548,13 +3139,13 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		targetAgents = validAgents;
 		M.info(`Installing to all ${targetAgents.length} agents`);
 	} else if (options.agent && options.agent.length > 0) {
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
+		const { normalizedAgents, invalidAgents } = normalizeAgentTypes(options.agent);
 		if (invalidAgents.length > 0) {
 			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
 			M.info(`Valid agents: ${validAgents.join(", ")}`);
 			process.exit(1);
 		}
-		targetAgents = options.agent;
+		targetAgents = normalizedAgents;
 	} else {
 		spinner.start("Loading agents...");
 		const installedAgents = await detectInstalledAgents();
@@ -2960,14 +3551,14 @@ async function runAdd(args, options = {}) {
 			targetAgents = validAgents;
 			M.info(`Installing to all ${targetAgents.length} agents`);
 		} else if (options.agent && options.agent.length > 0) {
-			const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
+			const { normalizedAgents, invalidAgents } = normalizeAgentTypes(options.agent);
 			if (invalidAgents.length > 0) {
 				M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
 				M.info(`Valid agents: ${validAgents.join(", ")}`);
 				await cleanup(tempDir);
 				process.exit(1);
 			}
-			targetAgents = options.agent;
+			targetAgents = normalizedAgents;
 		} else {
 			spinner.start("Loading agents...");
 			const installedAgents = await detectInstalledAgents();
@@ -3141,7 +3732,7 @@ async function runAdd(args, options = {}) {
 			skillFiles[skill.name] = relativePath;
 		}
 		const normalizedSource = getOwnerRepo(parsed);
-		const lockSource = parsed.url.startsWith("git@") ? parsed.url : normalizedSource;
+		const lockSource = getLockSourceForParsedSource(parsed);
 		if (normalizedSource) {
 			const ownerRepo = parseOwnerRepo(normalizedSource);
 			if (ownerRepo) {
@@ -3170,13 +3761,14 @@ async function runAdd(args, options = {}) {
 					let skillFolderHash = "";
 					const skillPathValue = skillFiles[skill.name];
 					if (parsed.type === "github" && normalizedSource && skillPathValue) {
-						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken());
+						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken, parsed.ref);
 						if (hash) skillFolderHash = hash;
 					}
 					await addSkillToLock(skill.name, {
 						source: lockSource || normalizedSource || parsed.url,
 						sourceType: parsed.type,
 						sourceUrl: parsed.url,
+						ref: parsed.ref,
 						skillPath: skillPathValue,
 						skillFolderHash,
 						pluginName: skill.pluginName,
@@ -3192,10 +3784,15 @@ async function runAdd(args, options = {}) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
 					const computedHash = await computeSkillFolderHash(skill.path);
+					const skillPathValue = skillFiles[skill.name];
 					await addSkillToLocalLock(skill.name, {
 						source: lockSource || parsed.url,
+						ref: parsed.ref,
 						sourceType: parsed.type,
-						computedHash
+						skillPath: skillPathValue,
+						computedHash,
+						resolvedVersion: parsed.type === "hub" ? hubResolved?.version : void 0,
+						artifactDigest: parsed.type === "hub" ? hubResolved?.artifact_digest : void 0
 					}, cwd);
 				} catch {}
 			}
@@ -3361,10 +3958,21 @@ function parseAddOptions(args) {
 		options
 	};
 }
-const RESET$2 = "\x1B[0m";
-const BOLD$2 = "\x1B[1m";
-const DIM$2 = "\x1B[38;5;102m";
-const TEXT$1 = "\x1B[38;5;145m";
+var import_dist = require_dist();
+let cachedResult = null;
+async function detectAgent() {
+	if (cachedResult) return cachedResult;
+	cachedResult = await (0, import_dist.determineAgent)();
+	if (cachedResult.isAgent) setDetectedAgent(cachedResult.agent.name);
+	return cachedResult;
+}
+async function isRunningInAgent() {
+	return (await detectAgent()).isAgent;
+}
+const RESET$3 = "\x1B[0m";
+const BOLD$3 = "\x1B[1m";
+const DIM$3 = "\x1B[38;5;102m";
+const TEXT$2 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
 const GREEN = "\x1B[32m";
 const YELLOW$1 = "\x1B[33m";
@@ -3376,7 +3984,7 @@ function formatCount(count) {
 }
 function formatTrustScore(score) {
 	if (score === void 0 || score === null) return "";
-	return `${score >= 80 ? GREEN : score >= 60 ? YELLOW$1 : RED}TrustScore:${score}${RESET$2}`;
+	return `${score >= 80 ? GREEN : score >= 60 ? YELLOW$1 : RED}TrustScore:${score}${RESET$3}`;
 }
 function formatRelativeDate(ts) {
 	if (!ts) return "";
@@ -3391,8 +3999,8 @@ function formatRelativeDate(ts) {
 }
 function formatStatsBadges(installs, stars) {
 	const parts = [];
-	if (installs > 0) parts.push(`${CYAN$1}↓ ${formatCount(installs)}${RESET$2}`);
-	if (stars > 0) parts.push(`${YELLOW$1}★ ${formatCount(stars)}${RESET$2}`);
+	if (installs > 0) parts.push(`${CYAN$1}↓ ${formatCount(installs)}${RESET$3}`);
+	if (stars > 0) parts.push(`${YELLOW$1}★ ${formatCount(stars)}${RESET$3}`);
 	return parts.join("  ");
 }
 async function searchSkillsAPI(query) {
@@ -3418,29 +4026,29 @@ async function runSearchPrompt(initialQuery = "") {
 		if (lastRenderedLines > 0) process.stdout.write(MOVE_UP(lastRenderedLines) + MOVE_TO_COL(1));
 		process.stdout.write(CLEAR_DOWN);
 		const lines = [];
-		const cursor = `${BOLD$2}_${RESET$2}`;
-		lines.push(`${TEXT$1}Search skills:${RESET$2} ${query}${cursor}`);
+		const cursor = `${BOLD$3}_${RESET$3}`;
+		lines.push(`${TEXT$2}Search skills:${RESET$3} ${query}${cursor}`);
 		lines.push("");
-		if (!query || query.length < 2) lines.push(`${DIM$2}Start typing to search (min 2 chars)${RESET$2}`);
-		else if (results.length === 0 && loading) lines.push(`${DIM$2}Searching...${RESET$2}`);
-		else if (results.length === 0) lines.push(`${DIM$2}No SafeSkill found${RESET$2}`);
+		if (!query || query.length < 2) lines.push(`${DIM$3}Start typing to search (min 2 chars)${RESET$3}`);
+		else if (results.length === 0 && loading) lines.push(`${DIM$3}Searching...${RESET$3}`);
+		else if (results.length === 0) lines.push(`${DIM$3}No SafeSkill found${RESET$3}`);
 		else {
 			const visible = results.slice(0, 8);
 			for (let i = 0; i < visible.length; i++) {
 				const skill = visible[i];
 				const isSelected = i === selectedIndex;
-				const arrow = isSelected ? `${BOLD$2}>${RESET$2}` : " ";
+				const arrow = isSelected ? `${BOLD$3}>${RESET$3}` : " ";
 				const displayName = skill.label || skill.name;
-				const name = isSelected ? `${BOLD$2}${displayName}${RESET$2}` : `${TEXT$1}${displayName}${RESET$2}`;
-				const source = skill.source ? ` ${DIM$2}${skill.source}${RESET$2}` : "";
+				const name = isSelected ? `${BOLD$3}${displayName}${RESET$3}` : `${TEXT$2}${displayName}${RESET$3}`;
+				const source = skill.source ? ` ${DIM$3}${skill.source}${RESET$3}` : "";
 				const statsBadge = formatStatsBadges(skill.installs, skill.totalStars);
-				const trustBadge = skill.trustScore !== void 0 ? ` ${skill.trustScore >= 80 ? GREEN : skill.trustScore >= 60 ? YELLOW$1 : RED}TrustScore:${skill.trustScore}${RESET$2}` : "";
-				const loadingIndicator = loading && i === 0 ? ` ${DIM$2}...${RESET$2}` : "";
+				const trustBadge = skill.trustScore !== void 0 ? ` ${skill.trustScore >= 80 ? GREEN : skill.trustScore >= 60 ? YELLOW$1 : RED}TrustScore:${skill.trustScore}${RESET$3}` : "";
+				const loadingIndicator = loading && i === 0 ? ` ${DIM$3}...${RESET$3}` : "";
 				lines.push(`  ${arrow}${trustBadge}  ${name}${source}${statsBadge ? `  ${statsBadge}` : ""}${loadingIndicator}`);
 			}
 		}
 		lines.push("");
-		lines.push(`${DIM$2}up/down navigate | enter select | esc cancel${RESET$2}`);
+		lines.push(`${DIM$3}up/down navigate | enter select | esc cancel${RESET$3}`);
 		for (const line of lines) process.stdout.write(line + "\n");
 		lastRenderedLines = lines.length;
 	}
@@ -3535,10 +4143,10 @@ async function isRepoPublic(owner, repo) {
 }
 async function runFind(args) {
 	const query = args.join(" ");
-	const isNonInteractive = !process.stdin.isTTY;
-	const agentTip = `${DIM$2}Tip: if running in a coding agent, follow these steps:${RESET$2}
-${DIM$2}  1) npx safeskill find [query]${RESET$2}
-${DIM$2}  2) npx safeskill add <owner/repo@skill>${RESET$2}`;
+	const isNonInteractive = !process.stdin.isTTY || await isRunningInAgent();
+	const agentTip = `${DIM$3}Tip: if running in a coding agent, follow these steps:${RESET$3}
+${DIM$3}  1) npx safeskill find [query]${RESET$3}
+${DIM$3}  2) npx safeskill add <source>${RESET$3}`;
 	if (query) {
 		const results = await searchSkillsAPI(query);
 		track({
@@ -3547,26 +4155,26 @@ ${DIM$2}  2) npx safeskill add <owner/repo@skill>${RESET$2}`;
 			resultCount: String(results.length)
 		});
 		if (results.length === 0) {
-			console.log(`${DIM$2}No skills found for "${query}"${RESET$2}`);
+			console.log(`${DIM$3}No skills found for "${query}"${RESET$3}`);
 			return;
 		}
-		console.log(`${DIM$2}Install with${RESET$2} npx safeskill add <owner/repo@skill>`);
+		console.log(`${DIM$3}Install with${RESET$3} npx safeskill add <owner/repo@skill>`);
 		console.log();
 		for (const skill of results.slice(0, 6)) {
 			const pkg = skill.source || skill.slug;
 			const installRef = pkg.startsWith("safeskill://") ? pkg : `${pkg}@${skill.name}`;
-			console.log(`${TEXT$1}${installRef}${RESET$2}`);
+			console.log(`${TEXT$2}${installRef}${RESET$3}`);
 			const statsBadge = formatStatsBadges(skill.installs, skill.totalStars);
 			const badges = [
 				formatTrustScore(skill.trustScore),
 				statsBadge,
-				skill.updatedAt ? `${DIM$2}${formatRelativeDate(skill.updatedAt)}${RESET$2}` : ""
+				skill.updatedAt ? `${DIM$3}${formatRelativeDate(skill.updatedAt)}${RESET$3}` : ""
 			].filter(Boolean).join(`  `);
 			if (badges) console.log(`  ${badges}`);
 			const displayName = skill.label || skill.name;
 			const desc = skill.description || (displayName !== skill.name ? displayName : "");
-			if (desc) console.log(`${DIM$2}  ${desc}${RESET$2}`);
-			if (skill.detailUrl) console.log(`${DIM$2}└ ${skill.detailUrl}${RESET$2}`);
+			if (desc) console.log(`${DIM$3}  ${desc}${RESET$3}`);
+			if (skill.detailUrl) console.log(`${DIM$3}└ ${skill.detailUrl}${RESET$3}`);
 			console.log();
 		}
 		return;
@@ -3574,6 +4182,7 @@ ${DIM$2}  2) npx safeskill add <owner/repo@skill>${RESET$2}`;
 	if (isNonInteractive) {
 		console.log(agentTip);
 		console.log();
+		return;
 	}
 	const selected = await runSearchPrompt();
 	track({
@@ -3583,14 +4192,14 @@ ${DIM$2}  2) npx safeskill add <owner/repo@skill>${RESET$2}`;
 		interactive: "1"
 	});
 	if (!selected) {
-		console.log(`${DIM$2}Search cancelled${RESET$2}`);
+		console.log(`${DIM$3}Search cancelled${RESET$3}`);
 		console.log();
 		return;
 	}
 	const pkg = selected.source || selected.slug;
 	const skillName = selected.name;
 	console.log();
-	console.log(`${TEXT$1}Installing ${BOLD$2}${skillName}${RESET$2} from ${DIM$2}${pkg}${RESET$2}...`);
+	console.log(`${TEXT$2}Installing ${BOLD$3}${skillName}${RESET$3} from ${DIM$3}${pkg}${RESET$3}...`);
 	console.log();
 	const { source, options } = parseAddOptions([
 		pkg,
@@ -3600,9 +4209,9 @@ ${DIM$2}  2) npx safeskill add <owner/repo@skill>${RESET$2}`;
 	await runAdd(source, options);
 	console.log();
 	const info = getOwnerRepoFromString(pkg);
-	if (pkg.startsWith("safeskill://")) console.log(`${DIM$2}Installed from safeskill source${RESET$2} ${TEXT$1}${pkg}${RESET$2}`);
-	else if (info && await isRepoPublic(info.owner, info.repo)) console.log(`${DIM$2}View the skill at${RESET$2} ${TEXT$1}https://skills.sh/${selected.slug}${RESET$2}`);
-	else console.log(`${DIM$2}Discover more skills at${RESET$2} ${TEXT$1}https://skills.sh${RESET$2}`);
+	if (pkg.startsWith("safeskill://")) console.log(`${DIM$3}Installed from safeskill source${RESET$3} ${TEXT$2}${pkg}${RESET$3}`);
+	else if (info && await isRepoPublic(info.owner, info.repo)) console.log(`${DIM$3}View the skill at${RESET$3} ${TEXT$2}https://skills.sh/${selected.slug}${RESET$3}`);
+	else console.log(`${DIM$3}Discover more skills at${RESET$3} ${TEXT$2}https://skills.sh${RESET$3}`);
 	console.log();
 }
 const isCancelled = (value) => typeof value === "symbol";
@@ -3725,13 +4334,13 @@ async function runSync(args, options = {}) {
 		targetAgents = validAgents;
 		M.info(`Installing to all ${targetAgents.length} agents`);
 	} else if (options.agent && options.agent.length > 0) {
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
+		const { normalizedAgents, invalidAgents } = normalizeAgentTypes(options.agent);
 		if (invalidAgents.length > 0) {
 			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
 			M.info(`Valid agents: ${validAgents.join(", ")}`);
 			process.exit(1);
 		}
-		targetAgents = options.agent;
+		targetAgents = normalizedAgents;
 	} else {
 		spinner.start("Loading agents...");
 		const installedAgents = await detectInstalledAgents();
@@ -3939,9 +4548,9 @@ async function runInstallFromLock(args) {
 		}
 	}
 }
-const RESET$1 = "\x1B[0m";
-const BOLD$1 = "\x1B[1m";
-const DIM$1 = "\x1B[38;5;102m";
+const RESET$2 = "\x1B[0m";
+const BOLD$2 = "\x1B[1m";
+const DIM$2 = "\x1B[38;5;102m";
 const CYAN = "\x1B[36m";
 const YELLOW = "\x1B[33m";
 function shortenPath(fullPath, cwd) {
@@ -3975,13 +4584,13 @@ async function runList(args) {
 	let agentFilter;
 	if (options.agent && options.agent.length > 0) {
 		const validAgents = Object.keys(agents);
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
+		const { normalizedAgents, invalidAgents } = normalizeAgentTypes(options.agent);
 		if (invalidAgents.length > 0) {
-			console.log(`${YELLOW}Invalid agents: ${invalidAgents.join(", ")}${RESET$1}`);
-			console.log(`${DIM$1}Valid agents: ${validAgents.join(", ")}${RESET$1}`);
+			console.log(`${YELLOW}Invalid agents: ${invalidAgents.join(", ")}${RESET$2}`);
+			console.log(`${DIM$2}Valid agents: ${validAgents.join(", ")}${RESET$2}`);
 			process.exit(1);
 		}
-		agentFilter = options.agent;
+		agentFilter = normalizedAgents;
 	}
 	const installedSkills = await listInstalledSkills({
 		global: scope,
@@ -4005,20 +4614,20 @@ async function runList(args) {
 			console.log("[]");
 			return;
 		}
-		console.log(`${DIM$1}No ${scopeLabel.toLowerCase()} skills found.${RESET$1}`);
-		if (scope) console.log(`${DIM$1}Try listing project skills without -g${RESET$1}`);
-		else console.log(`${DIM$1}Try listing global skills with -g${RESET$1}`);
+		console.log(`${DIM$2}No ${scopeLabel.toLowerCase()} skills found.${RESET$2}`);
+		if (scope) console.log(`${DIM$2}Try listing project skills without -g${RESET$2}`);
+		else console.log(`${DIM$2}Try listing global skills with -g${RESET$2}`);
 		return;
 	}
 	function printSkill(skill, indent = false) {
 		const prefix = indent ? "  " : "";
 		const shortPath = shortenPath(skill.canonicalPath, cwd);
 		const agentNames = skill.agents.map((a) => agents[a].displayName);
-		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW}not linked${RESET$1}`;
-		console.log(`${prefix}${CYAN}${skill.name}${RESET$1} ${DIM$1}${shortPath}${RESET$1}`);
-		console.log(`${prefix}  ${DIM$1}Agents:${RESET$1} ${agentInfo}`);
+		const agentInfo = skill.agents.length > 0 ? formatList(agentNames) : `${YELLOW}not linked${RESET$2}`;
+		console.log(`${prefix}${CYAN}${skill.name}${RESET$2} ${DIM$2}${shortPath}${RESET$2}`);
+		console.log(`${prefix}  ${DIM$2}Agents:${RESET$2} ${agentInfo}`);
 	}
-	console.log(`${BOLD$1}${scopeLabel} Skills${RESET$1}`);
+	console.log(`${BOLD$2}${scopeLabel} Skills${RESET$2}`);
 	console.log();
 	const groupedSkills = {};
 	const ungroupedSkills = [];
@@ -4034,13 +4643,13 @@ async function runList(args) {
 		const sortedGroups = Object.keys(groupedSkills).sort();
 		for (const group of sortedGroups) {
 			const title = group.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
-			console.log(`${BOLD$1}${title}${RESET$1}`);
+			console.log(`${BOLD$2}${title}${RESET$2}`);
 			const skills = groupedSkills[group];
 			if (skills) for (const skill of skills) printSkill(skill, true);
 			console.log();
 		}
 		if (ungroupedSkills.length > 0) {
-			console.log(`${BOLD$1}General${RESET$1}`);
+			console.log(`${BOLD$2}General${RESET$2}`);
 			for (const skill of ungroupedSkills) printSkill(skill, true);
 			console.log();
 		}
@@ -4076,14 +4685,16 @@ async function removeCommand(skillNames, options) {
 		Se(import_picocolors.default.yellow("No skills found to remove."));
 		return;
 	}
+	let normalizedAgentFilter;
 	if (options.agent && options.agent.length > 0) {
 		const validAgents = Object.keys(agents);
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
+		const { normalizedAgents, invalidAgents } = normalizeAgentTypes(options.agent);
 		if (invalidAgents.length > 0) {
 			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
 			M.info(`Valid agents: ${validAgents.join(", ")}`);
 			process.exit(1);
 		}
+		normalizedAgentFilter = normalizedAgents;
 	}
 	let selectedSkills = [];
 	if (options.all) selectedSkills = installedSkills;
@@ -4110,7 +4721,7 @@ async function removeCommand(skillNames, options) {
 		selectedSkills = selected;
 	}
 	let targetAgents;
-	if (options.agent && options.agent.length > 0) targetAgents = options.agent;
+	if (normalizedAgentFilter && normalizedAgentFilter.length > 0) targetAgents = normalizedAgentFilter;
 	else {
 		targetAgents = Object.keys(agents);
 		spinner.stop(`Targeting ${targetAgents.length} potential agent(s)`);
@@ -4239,124 +4850,1586 @@ function parseRemoveOptions(args) {
 		options
 	};
 }
-const __dirname = dirname(fileURLToPath(import.meta.url));
-function getVersion() {
+function formatSourceInput(sourceUrl, ref) {
+	if (!ref) return sourceUrl;
+	return `${sourceUrl}#${ref}`;
+}
+function deriveSkillFolder(skillPath) {
+	let folder = skillPath;
+	if (folder.endsWith("/SKILL.md")) folder = folder.slice(0, -9);
+	else if (folder.endsWith("SKILL.md")) folder = folder.slice(0, -8);
+	if (folder.endsWith("/")) folder = folder.slice(0, -1);
+	return folder;
+}
+function supportsAppendedSubpath(source) {
+	if (source.startsWith("git@")) return false;
+	if (source.endsWith(".git")) return false;
+	if (source.startsWith("http://") || source.startsWith("https://")) try {
+		const host = new URL(source).hostname;
+		return host === "github.com" || host === "gitlab.com";
+	} catch {
+		return false;
+	}
+	return true;
+}
+function sourceUrlAlreadyTargetsTreePath(sourceUrl) {
+	return /github\.com\/[^/]+\/[^/]+\/tree\/[^/]+\/.+/.test(sourceUrl);
+}
+function appendFolderAndRef(source, skillPath, ref) {
+	if (!supportsAppendedSubpath(source)) return formatSourceInput(source, ref);
+	const folder = deriveSkillFolder(skillPath);
+	const withFolder = folder ? `${source}/${folder}` : source;
+	return ref ? `${withFolder}#${ref}` : withFolder;
+}
+function buildUpdateInstallSource(entry, updateSource = entry.sourceUrl) {
+	if (entry.sourceType === "hub") return updateSource;
+	if (!entry.skillPath) return formatSourceInput(entry.sourceUrl, entry.ref);
+	if (sourceUrlAlreadyTargetsTreePath(entry.sourceUrl)) return entry.sourceUrl;
+	return appendFolderAndRef(entry.source, entry.skillPath, entry.ref);
+}
+function buildLocalUpdateSource(entry) {
+	if (!entry.skillPath) return formatSourceInput(entry.source, entry.ref);
+	return appendFolderAndRef(entry.source, entry.skillPath, entry.ref);
+}
+var blob_exports = /* @__PURE__ */ __exportAll({
+	BLOB_ALLOWED_REPOS: () => BLOB_ALLOWED_REPOS,
+	fetchRepoTree: () => fetchRepoTree,
+	findSkillMdPaths: () => findSkillMdPaths,
+	getSkillFolderHashFromTree: () => getSkillFolderHashFromTree,
+	toSkillSlug: () => toSkillSlug,
+	tryBlobInstall: () => tryBlobInstall
+});
+const DOWNLOAD_BASE_URL = process.env.SKILLS_DOWNLOAD_URL || "https://skills.sh";
+const BLOB_ALLOWED_REPOS = { "zapier/connectors": { downloadUrl: (slug) => `https://connectors-skills.zapier.com/download/${encodeURIComponent(slug)}/snapshot.json` } };
+const FETCH_TIMEOUT = 1e4;
+function toSkillSlug(name) {
+	return name.toLowerCase().replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+let _rateLimitedThisSession = false;
+async function fetchTreeBranch(ownerRepo, branch, token) {
 	try {
-		const pkgPath = join(__dirname, "..", "package.json");
-		return JSON.parse(readFileSync(pkgPath, "utf-8")).version;
+		const url = `https://api.github.com/repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+		const headers = {
+			Accept: "application/vnd.github.v3+json",
+			"User-Agent": "skills-cli"
+		};
+		if (token) headers["Authorization"] = `Bearer ${token}`;
+		const response = await fetch(url, {
+			headers,
+			signal: AbortSignal.timeout(FETCH_TIMEOUT)
+		});
+		if (response.ok) {
+			const data = await response.json();
+			return {
+				tree: {
+					sha: data.sha,
+					branch,
+					tree: data.tree
+				},
+				rateLimited: false
+			};
+		}
+		return {
+			tree: null,
+			rateLimited: response.status === 403 && response.headers.get("x-ratelimit-remaining") === "0"
+		};
 	} catch {
-		return "0.0.0";
+		return {
+			tree: null,
+			rateLimited: false
+		};
 	}
 }
-const VERSION = getVersion();
-initTelemetry(VERSION);
-const RESET = "\x1B[0m";
-const BOLD = "\x1B[1m";
-const DIM = "\x1B[38;5;102m";
-const TEXT = "\x1B[38;5;145m";
-const LOGO_HEIGHT = 7;
-const LOGO_GLYPHS = {
-	s: [
-		" █████ ",
-		"█      ",
-		"█      ",
-		" ████  ",
-		"     █ ",
-		"█     █",
-		" █████ "
-	],
-	a: [
-		"  ███  ",
-		" █   █ ",
-		" █   █ ",
-		" █████ ",
-		" █   █ ",
-		" █   █ ",
-		" █   █ "
-	],
-	f: [
-		"██████ ",
-		"█      ",
-		"█      ",
-		"█████  ",
-		"█      ",
-		"█      ",
-		"█      "
-	],
-	e: [
-		"██████ ",
-		"█      ",
-		"█      ",
-		"█████  ",
-		"█      ",
-		"█      ",
-		"██████ "
-	],
-	k: [
-		"█   █  ",
-		"█  █   ",
-		"█ █    ",
-		"███    ",
-		"█ █    ",
-		"█  █   ",
-		"█   █  "
-	],
-	i: [
-		"█████  ",
-		"  █    ",
-		"  █    ",
-		"  █    ",
-		"  █    ",
-		"  █    ",
-		"█████  "
-	],
-	l: [
-		"█      ",
-		"█      ",
-		"█      ",
-		"█      ",
-		"█      ",
-		"█      ",
-		"██████ "
-	]
-};
-function buildLogoLines() {
-	const words = ["Safe", "Skill"];
-	const lines = Array.from({ length: LOGO_HEIGHT }, () => "");
-	for (const word of words) {
-		for (const character of word) {
-			const glyph = LOGO_GLYPHS[character.toLowerCase()];
-			if (!glyph) continue;
-			for (let i = 0; i < LOGO_HEIGHT; i++) lines[i] += `${glyph[i] ?? ""} `;
+async function fetchRepoTree(ownerRepo, ref, getToken) {
+	const branches = ref ? [ref] : [
+		"HEAD",
+		"main",
+		"master"
+	];
+	if (_rateLimitedThisSession && getToken) {
+		const token = getToken();
+		if (!token) return null;
+		for (const branch of branches) {
+			const result = await fetchTreeBranch(ownerRepo, branch, token);
+			if (result.tree) return result.tree;
 		}
-		for (let i = 0; i < LOGO_HEIGHT; i++) lines[i] += "  ";
+		return null;
 	}
-	return lines.map((line) => line.replace(/\s+$/, ""));
+	let rateLimited = false;
+	for (const branch of branches) {
+		const result = await fetchTreeBranch(ownerRepo, branch, null);
+		if (result.tree) return result.tree;
+		if (result.rateLimited) {
+			rateLimited = true;
+			break;
+		}
+	}
+	if (!rateLimited || !getToken) return null;
+	_rateLimitedThisSession = true;
+	const token = getToken();
+	if (!token) return null;
+	for (const branch of branches) {
+		const result = await fetchTreeBranch(ownerRepo, branch, token);
+		if (result.tree) return result.tree;
+	}
+	return null;
 }
-const GRAYS = [
-	"\x1B[38;5;250m",
-	"\x1B[38;5;248m",
-	"\x1B[38;5;245m",
-	"\x1B[38;5;243m",
-	"\x1B[38;5;240m",
-	"\x1B[38;5;238m",
-	"\x1B[38;5;236m"
+function getSkillFolderHashFromTree(tree, skillPath) {
+	let folderPath = skillPath.replace(/\\/g, "/");
+	if (folderPath.toLowerCase().endsWith("/skill.md")) folderPath = folderPath.slice(0, -9);
+	else if (folderPath.toLowerCase().endsWith("skill.md")) folderPath = folderPath.slice(0, -8);
+	if (folderPath.endsWith("/")) folderPath = folderPath.slice(0, -1);
+	if (!folderPath) return tree.sha;
+	return tree.tree.find((e) => e.type === "tree" && e.path === folderPath)?.sha ?? null;
+}
+const PRIORITY_PREFIXES = [
+	"",
+	"skills/",
+	"skills/.curated/",
+	"skills/.experimental/",
+	"skills/.system/",
+	".agents/skills/",
+	".claude/skills/",
+	".cline/skills/",
+	".codebuddy/skills/",
+	".codex/skills/",
+	".commandcode/skills/",
+	".continue/skills/",
+	".github/skills/",
+	".goose/skills/",
+	".iflow/skills/",
+	".junie/skills/",
+	".kilocode/skills/",
+	".kiro/skills/",
+	".mux/skills/",
+	".neovate/skills/",
+	".opencode/skills/",
+	".openhands/skills/",
+	".pi/skills/",
+	".qoder/skills/",
+	".roo/skills/",
+	".trae/skills/",
+	".windsurf/skills/",
+	".zencoder/skills/"
 ];
-function showLogo() {
-	console.log();
-	buildLogoLines().forEach((line, i) => {
-		console.log(`${GRAYS[i]}${line}${RESET}`);
+function findSkillMdPaths(tree, subpath) {
+	const allSkillMds = tree.tree.filter((e) => {
+		if (e.type !== "blob") return false;
+		return e.path.replace(/\\/g, "/").split("/").pop()?.toLowerCase() === "skill.md";
+	}).map((e) => e.path);
+	const prefix = subpath ? subpath.endsWith("/") ? subpath : subpath + "/" : "";
+	const filtered = prefix ? allSkillMds.filter((p) => p.startsWith(prefix) || p === prefix + "SKILL.md") : allSkillMds;
+	if (filtered.length === 0) return [];
+	const priorityResults = [];
+	const seen = /* @__PURE__ */ new Set();
+	const SKIP_DIRS = new Set([
+		"node_modules",
+		".git",
+		"dist",
+		"build",
+		"__pycache__"
+	]);
+	const lowerSkillMdSet = new Set(filtered.map((p) => p.toLowerCase()));
+	for (const priorityPrefix of PRIORITY_PREFIXES) {
+		const fullPrefix = prefix + priorityPrefix;
+		const isContainer = priorityPrefix !== "";
+		for (const skillMd of filtered) {
+			if (!skillMd.startsWith(fullPrefix)) continue;
+			const rest = skillMd.slice(fullPrefix.length);
+			if (rest.toLowerCase() === "skill.md") {
+				if (!seen.has(skillMd)) {
+					priorityResults.push(skillMd);
+					seen.add(skillMd);
+				}
+				continue;
+			}
+			const parts = rest.split("/");
+			if (parts.length === 2 && parts[1].toLowerCase() === "skill.md") {
+				if (!seen.has(skillMd)) {
+					priorityResults.push(skillMd);
+					seen.add(skillMd);
+				}
+				continue;
+			}
+			if (isContainer && parts.length === 3 && parts[2].toLowerCase() === "skill.md" && !SKIP_DIRS.has(parts[0]) && !SKIP_DIRS.has(parts[1])) {
+				const parentSkillMd = `${fullPrefix}${parts[0]}/SKILL.md`.toLowerCase();
+				if (!lowerSkillMdSet.has(parentSkillMd) && !seen.has(skillMd)) {
+					priorityResults.push(skillMd);
+					seen.add(skillMd);
+				}
+			}
+		}
+	}
+	if (priorityResults.length > 0) return priorityResults;
+	return filtered.filter((p) => {
+		return p.split("/").length <= 6;
 	});
 }
-function showBanner() {
-	showLogo();
-	console.log();
+async function fetchSkillMdContent(ownerRepo, branch, skillMdPath) {
+	try {
+		const url = `https://raw.githubusercontent.com/${ownerRepo}/${branch}/${skillMdPath}`;
+		const response = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+		if (!response.ok) return null;
+		return await response.text();
+	} catch {
+		return null;
+	}
+}
+async function fetchSkillDownload(source, slug) {
+	try {
+		const [owner, repo] = source.split("/");
+		const defaultUrl = `${DOWNLOAD_BASE_URL}/api/download/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/${encodeURIComponent(slug)}`;
+		const url = BLOB_ALLOWED_REPOS[source.toLowerCase()]?.downloadUrl(slug) ?? defaultUrl;
+		const response = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT) });
+		if (!response.ok) return null;
+		return await response.json();
+	} catch {
+		return null;
+	}
+}
+function computeSnapshotHash(files) {
+	const hash = createHash$1("sha256");
+	for (const file of [...files].sort((a, b) => a.path.localeCompare(b.path))) {
+		hash.update(file.path);
+		hash.update(file.contents);
+	}
+	return hash.digest("hex");
+}
+function normalizeSnapshotFilePath(filePath) {
+	if (typeof filePath !== "string") return null;
+	const normalized = filePath.replace(/\\/g, "/");
+	if (normalized.trim() === "") return null;
+	if (normalized.startsWith("/")) return null;
+	if (/^[a-zA-Z]:\//.test(normalized)) return null;
+	const segments = normalized.split("/");
+	if (segments.some((segment) => segment === "" || segment === "..")) return null;
+	return segments.join("/");
+}
+function normalizeSnapshotFiles(files) {
+	const normalizedFiles = [];
+	for (const file of files) {
+		const normalizedPath = normalizeSnapshotFilePath(file.path);
+		if (!normalizedPath || typeof file.contents !== "string") return null;
+		normalizedFiles.push({
+			path: normalizedPath,
+			contents: file.contents
+		});
+	}
+	return normalizedFiles;
+}
+async function tryBlobInstall(ownerRepo, options = {}) {
+	const tree = await fetchRepoTree(ownerRepo, options.ref, options.getToken);
+	if (!tree) return null;
+	let skillMdPaths = findSkillMdPaths(tree, options.subpath);
+	if (skillMdPaths.length === 0) return null;
+	if (options.skillFilter) {
+		const filterSlug = toSkillSlug(options.skillFilter);
+		const filtered = skillMdPaths.filter((p) => {
+			const parts = p.split("/");
+			if (parts.length < 2) return false;
+			const folderName = parts[parts.length - 2];
+			return toSkillSlug(folderName) === filterSlug;
+		});
+		if (filtered.length > 0) skillMdPaths = filtered;
+	}
+	const mdFetches = await Promise.all(skillMdPaths.map(async (mdPath) => {
+		return {
+			mdPath,
+			content: await fetchSkillMdContent(ownerRepo, tree.branch, mdPath)
+		};
+	}));
+	const parsedSkills = [];
+	for (const { mdPath, content } of mdFetches) {
+		if (!content) return null;
+		const { data } = parseFrontmatter(content);
+		if (!data.name || !data.description) return null;
+		if (typeof data.name !== "string" || typeof data.description !== "string") return null;
+		if (data.metadata?.internal === true && !options.includeInternal) continue;
+		const safeName = sanitizeMetadata(data.name);
+		const safeDescription = sanitizeMetadata(data.description);
+		if (!safeName || !safeDescription) return null;
+		parsedSkills.push({
+			mdPath,
+			name: safeName,
+			description: safeDescription,
+			content,
+			slug: toSkillSlug(safeName),
+			metadata: data.metadata
+		});
+	}
+	if (parsedSkills.length === 0) return null;
+	let filteredSkills = parsedSkills;
+	if (options.skillFilter) {
+		const filterSlug = toSkillSlug(options.skillFilter);
+		const nameFiltered = parsedSkills.filter((s) => s.slug === filterSlug);
+		if (nameFiltered.length > 0) filteredSkills = nameFiltered;
+		else return null;
+	}
+	const source = ownerRepo.toLowerCase();
+	const downloads = await Promise.all(filteredSkills.map(async (skill) => {
+		return {
+			skill,
+			download: await fetchSkillDownload(source, skill.slug)
+		};
+	}));
+	if (!downloads.every((d) => d.download !== null)) return null;
+	const normalizedDownloads = downloads.map(({ skill, download }) => {
+		return {
+			skill,
+			download,
+			files: normalizeSnapshotFiles(download.files)
+		};
+	});
+	if (normalizedDownloads.some(({ files }) => files === null)) return null;
+	return {
+		skills: normalizedDownloads.map(({ skill, download, files }) => {
+			const mdPathLower = skill.mdPath.toLowerCase();
+			const selectedFiles = (mdPathLower.endsWith("/skill.md") ? skill.mdPath.slice(0, -9) : mdPathLower === "skill.md" ? "" : skill.mdPath.slice(0, -9)) ? files : files.filter((file) => file.path.toLowerCase() === "skill.md");
+			return {
+				name: skill.name,
+				description: skill.description,
+				path: "",
+				rawContent: skill.content,
+				metadata: skill.metadata,
+				files: selectedFiles,
+				snapshotHash: selectedFiles.length === files.length ? download.hash : computeSnapshotHash(selectedFiles),
+				repoPath: skill.mdPath
+			};
+		}),
+		tree
+	};
+}
+const __dirname$1 = dirname(fileURLToPath(import.meta.url));
+const RESET$1 = "\x1B[0m";
+const BOLD$1 = "\x1B[1m";
+const DIM$1 = "\x1B[38;5;102m";
+const TEXT$1 = "\x1B[38;5;145m";
+function parseUpdateOptions(args) {
+	const options = {};
+	const positional = [];
+	for (const arg of args) if (arg === "-g" || arg === "--global") options.global = true;
+	else if (arg === "-p" || arg === "--project") options.project = true;
+	else if (arg === "-y" || arg === "--yes") options.yes = true;
+	else if (!arg.startsWith("-")) positional.push(arg);
+	if (positional.length > 0) options.skills = positional;
+	return options;
+}
+function hasProjectSkills(cwd) {
+	const dir = cwd || process.cwd();
+	if (existsSync(join(dir, "skills-lock.json"))) return true;
+	const skillsDir = join(dir, ".agents", "skills");
+	try {
+		const entries = readdirSync(skillsDir, { withFileTypes: true });
+		for (const entry of entries) if (entry.isDirectory() && existsSync(join(skillsDir, entry.name, "SKILL.md"))) return true;
+	} catch {}
+	return false;
+}
+async function resolveUpdateScope(options) {
+	if (options.skills && options.skills.length > 0) {
+		if (options.global) return "global";
+		if (options.project) return "project";
+		return "both";
+	}
+	if (options.global && options.project) return "both";
+	if (options.global) return "global";
+	if (options.project) return "project";
+	if (options.yes || !process.stdin.isTTY) return hasProjectSkills() ? "project" : "global";
+	const scope = await ve({
+		message: "Update scope",
+		options: [
+			{
+				value: "project",
+				label: "Project",
+				hint: "Update skills in current directory"
+			},
+			{
+				value: "global",
+				label: "Global",
+				hint: "Update skills in home directory"
+			},
+			{
+				value: "both",
+				label: "Both",
+				hint: "Update all skills"
+			}
+		]
+	});
+	if (pD(scope)) {
+		xe("Cancelled");
+		process.exit(0);
+	}
+	return scope;
+}
+function matchesSkillFilter(name, filter) {
+	if (!filter || filter.length === 0) return true;
+	const lower = name.toLowerCase();
+	return filter.some((f) => f.toLowerCase() === lower);
+}
+function getSkipReason(entry) {
+	if (entry.sourceType === "local") return "Local path";
+	if (entry.sourceType === "hub") {
+		if (!entry.resolvedVersion) return "No hub version recorded";
+		if (!entry.artifactDigest) return "No hub artifact metadata";
+		return "No version tracking";
+	}
+	if (entry.sourceType === "well-known") return "Well-known skill";
+	if (!entry.skillFolderHash) return "No version hash available";
+	if (!entry.skillPath) return "No skill path recorded";
+	return "No version tracking";
+}
+function replaceHubSourceVersion(source, version) {
+	const trimmedSource = source.trim();
+	if (!trimmedSource) return source;
+	return `${trimmedSource.replace(/@[^/@]+$/, "")}@${version}`;
+}
+function getInstallSource(skill) {
+	let url = skill.sourceUrl;
+	if (skill.sourceType === "well-known") {
+		const idx = url.indexOf("/.well-known/");
+		if (idx !== -1) url = url.slice(0, idx);
+	}
+	return formatSourceInput(url, skill.ref);
+}
+function getProjectHubSkipReason(entry) {
+	if (!entry.resolvedVersion) return "No hub version recorded";
+	if (!entry.artifactDigest) return "No hub artifact metadata";
+	return "No hub update metadata";
+}
+function getSourceRefKey(source, ref) {
+	return `${source}\0${ref ?? ""}`;
+}
+function hasSameSourceAndRef(entry, source, ref) {
+	return entry.source === source && (entry.ref ?? "") === (ref ?? "");
+}
+function printSkippedSkills(skipped) {
+	if (skipped.length === 0) return;
+	console.log();
+	console.log(`${DIM$1}${skipped.length} skill(s) cannot be checked automatically:${RESET$1}`);
+	const grouped = /* @__PURE__ */ new Map();
+	for (const skill of skipped) {
+		const source = getInstallSource(skill);
+		const existing = grouped.get(source) || [];
+		existing.push(skill);
+		grouped.set(source, existing);
+	}
+	for (const [source, skills] of grouped) {
+		if (skills.length === 1) {
+			const skill = skills[0];
+			console.log(`  ${TEXT$1}-${RESET$1} ${sanitizeMetadata(skill.name)} ${DIM$1}(${skill.reason})${RESET$1}`);
+		} else {
+			const reason = skills[0].reason;
+			const names = skills.map((s) => sanitizeMetadata(s.name)).join(", ");
+			console.log(`  ${TEXT$1}-${RESET$1} ${names} ${DIM$1}(${reason})${RESET$1}`);
+		}
+		console.log(`    ${DIM$1}To update: ${TEXT$1}npx safeskill add ${source} -g -y${RESET$1}`);
+	}
+}
+function printSkippedProjectHubSkills(skipped) {
+	if (skipped.length === 0) return;
+	console.log();
+	console.log(`${DIM$1}${skipped.length} project hub skill(s) require manual refresh:${RESET$1}`);
+	for (const skill of skipped) {
+		console.log(`  ${TEXT$1}-${RESET$1} ${sanitizeMetadata(skill.name)} ${DIM$1}(${getProjectHubSkipReason(skill.entry)})${RESET$1}`);
+		console.log(`    ${DIM$1}To refresh: ${TEXT$1}npx safeskill add ${skill.entry.source} -y${RESET$1}`);
+	}
+}
+async function getProjectSkillsForUpdate(skillFilter) {
+	const localLock = await readLocalLock();
+	const skills = [];
+	for (const [name, entry] of Object.entries(localLock.skills)) {
+		if (!matchesSkillFilter(name, skillFilter)) continue;
+		if (entry.sourceType === "node_modules" || entry.sourceType === "local") continue;
+		skills.push({
+			name,
+			source: entry.source,
+			entry
+		});
+	}
+	return skills;
+}
+async function checkAndPromptForDeletions(source, allLockedForSource, lockSkills, isGlobal, options, discoveredPaths, mode = "update") {
+	const deletedSkills = allLockedForSource.filter((name) => {
+		const entry = lockSkills[name];
+		if (!entry?.skillPath) return false;
+		return !discoveredPaths.includes(entry.skillPath);
+	});
+	if (deletedSkills.length > 0) {
+		console.log();
+		console.log(`${DIM$1}Warning:${RESET$1} The following skills from ${DIM$1}${source}${RESET$1} appear to have been deleted upstream:`);
+		for (const s of deletedSkills) console.log(`  ${DIM$1}-${RESET$1} ${s}`);
+		if (mode === "check") {
+			console.log(`${DIM$1}Skipping deletion in check mode.${RESET$1}`);
+			return deletedSkills;
+		}
+		if (options.yes || !process.stdin.isTTY) console.log(`${DIM$1}Skipping deletion in non-interactive mode.${RESET$1}`);
+		else {
+			const confirmed = await ye({ message: `Would you like to remove the local copies of these deleted skills?` });
+			if (confirmed && !pD(confirmed)) for (const s of deletedSkills) {
+				console.log(`${DIM$1}Removing${RESET$1} ${s}...`);
+				await removeCommand([s], {
+					yes: true,
+					global: isGlobal
+				});
+			}
+		}
+	}
+	return deletedSkills;
+}
+async function updateGlobalSkills(options = {}, region, mode = "update") {
+	const lock = await readSkillLock();
+	const skillNames = Object.keys(lock.skills);
+	let successCount = 0;
+	let failCount = 0;
+	let checkFailCount = 0;
+	if (skillNames.length === 0) {
+		if (!options.skills) {
+			console.log(`${DIM$1}No global skills tracked in lock file.${RESET$1}`);
+			console.log(`${DIM$1}Install skills with${RESET$1} ${TEXT$1}npx safeskill add <package> -g${RESET$1}`);
+		}
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			checkedCount: 0,
+			updateCount: 0
+		};
+	}
+	const updates = [];
+	const skipped = [];
+	const checkable = [];
+	const hubEntries = [];
+	for (const skillName of skillNames) {
+		if (!matchesSkillFilter(skillName, options.skills)) continue;
+		const entry = lock.skills[skillName];
+		if (!entry) continue;
+		if (entry.sourceType === "hub") {
+			if (!entry.resolvedVersion || !entry.artifactDigest) {
+				skipped.push({
+					name: skillName,
+					reason: getSkipReason(entry),
+					sourceUrl: entry.sourceUrl,
+					sourceType: entry.sourceType,
+					ref: entry.ref
+				});
+				continue;
+			}
+			hubEntries.push({
+				name: skillName,
+				entry
+			});
+			continue;
+		}
+		if (!entry.skillFolderHash || !entry.skillPath) {
+			skipped.push({
+				name: skillName,
+				reason: getSkipReason(entry),
+				sourceUrl: entry.sourceUrl,
+				sourceType: entry.sourceType,
+				ref: entry.ref
+			});
+			continue;
+		}
+		checkable.push({
+			name: skillName,
+			entry
+		});
+	}
+	if (hubEntries.length > 0) try {
+		(await checkHubUpdates(hubEntries.map(({ entry }) => ({
+			source: entry.sourceUrl,
+			version: entry.resolvedVersion,
+			artifact_digest: entry.artifactDigest
+		})))).items.forEach((item, index) => {
+			const hubEntry = hubEntries[index];
+			if (!hubEntry || !item.has_update || !item.latest_version) return;
+			updates.push({
+				name: hubEntry.name,
+				source: hubEntry.entry.sourceUrl,
+				installSource: replaceHubSourceVersion(hubEntry.entry.sourceUrl, item.latest_version),
+				entry: hubEntry.entry
+			});
+		});
+	} catch {
+		checkFailCount += hubEntries.length;
+		console.log(`  ${DIM$1}Failed to check hub skills${RESET$1}`);
+	}
+	const bySource = /* @__PURE__ */ new Map();
+	for (const item of checkable) {
+		const source = getSourceRefKey(item.entry.source, item.entry.ref);
+		const existing = bySource.get(source) || [];
+		existing.push(item);
+		bySource.set(source, existing);
+	}
+	for (const [, itemsForSource] of bySource) {
+		const firstEntry = itemsForSource[0].entry;
+		const source = firstEntry.source;
+		const ref = firstEntry.ref;
+		const sourceUrl = firstEntry.sourceUrl || firstEntry.source;
+		let tempDir = null;
+		const sourceLabel = ref ? `${source}#${ref}` : source;
+		process.stdout.write(`\r${DIM$1}Checking skills from source: ${sourceLabel}${RESET$1}\x1b[K\n`);
+		try {
+			if (firstEntry.sourceType === "github") {
+				const tree = await fetchRepoTree(source, firstEntry.ref, getGitHubToken);
+				if (!tree) {
+					console.log(`  ${DIM$1}Failed to fetch tree for ${source}${RESET$1}`);
+					checkFailCount += itemsForSource.length;
+					continue;
+				}
+				const discoveredPaths = findSkillMdPaths(tree);
+				const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([, entry]) => hasSameSourceAndRef(entry, source, ref)).map(([name]) => name), lock.skills, true, options, discoveredPaths, mode);
+				const deletedSkillSet = new Set(deletedSkills);
+				for (const { name: skillName, entry } of itemsForSource) {
+					if (deletedSkillSet.has(skillName)) continue;
+					const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
+					if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+						name: skillName,
+						source,
+						entry
+					});
+				}
+				continue;
+			}
+			tempDir = await cloneRepo(sourceUrl, ref);
+			const discoveredPaths = (await discoverSkills(tempDir)).map((skill) => {
+				return join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/");
+			});
+			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([, entry]) => hasSameSourceAndRef(entry, source, ref)).map(([name]) => name), lock.skills, true, options, discoveredPaths, mode);
+			const deletedSkillSet = new Set(deletedSkills);
+			for (const { name: skillName, entry } of itemsForSource) {
+				if (deletedSkillSet.has(skillName)) continue;
+				const skillPath = entry.skillPath;
+				if (!discoveredPaths.includes(skillPath)) continue;
+				const latestHash = await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
+				if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+					name: skillName,
+					source,
+					entry
+				});
+			}
+		} catch {
+			console.log(`  ${DIM$1}Failed to check skills from ${source}${RESET$1}`);
+			checkFailCount += itemsForSource.length;
+		} finally {
+			if (tempDir) await cleanupTempDir(tempDir);
+		}
+	}
+	if (checkable.length > 0) process.stdout.write("\r\x1B[K");
+	const checkedCount = checkable.length + hubEntries.length + skipped.length;
+	if (checkable.length === 0 && hubEntries.length === 0 && skipped.length === 0) {
+		if (!options.skills) console.log(`${DIM$1}No global skills to check.${RESET$1}`);
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			checkedCount: 0,
+			updateCount: 0
+		};
+	}
+	if (checkable.length === 0 && hubEntries.length === 0 && skipped.length > 0) {
+		printSkippedSkills(skipped);
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			checkedCount,
+			updateCount: 0
+		};
+	}
+	if (updates.length === 0) {
+		if (checkFailCount > 0) console.log(`${DIM$1}Failed to check ${checkFailCount} global skill(s)${RESET$1}`);
+		else console.log(`${TEXT$1}All global skills are up to date${RESET$1}`);
+		printSkippedSkills(skipped);
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			checkedCount,
+			updateCount: 0
+		};
+	}
+	if (mode === "check") {
+		console.log(`${TEXT$1}Found ${updates.length} global update(s)${RESET$1}`);
+		console.log();
+		for (const update of updates) {
+			console.log(`  ${TEXT$1}-${RESET$1} ${sanitizeMetadata(update.name)}`);
+			console.log(`    ${DIM$1}source: ${getInstallSource({
+				name: update.name,
+				reason: "",
+				sourceUrl: update.installSource || update.entry.sourceUrl,
+				sourceType: update.entry.sourceType,
+				ref: update.entry.ref
+			})}${RESET$1}`);
+		}
+		printSkippedSkills(skipped);
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			checkedCount,
+			updateCount: updates.length
+		};
+	}
+	console.log(`${TEXT$1}Found ${updates.length} global update(s)${RESET$1}`);
+	console.log();
+	for (const update of updates) {
+		const safeName = sanitizeMetadata(update.name);
+		console.log(`${TEXT$1}Updating ${safeName}...${RESET$1}`);
+		const installUrl = buildUpdateInstallSource(update.entry, update.installSource);
+		const cliEntry = join(__dirname$1, "..", "bin", "cli.mjs");
+		if (!existsSync(cliEntry)) {
+			failCount++;
+			console.log(`  ${DIM$1}Failed to update ${safeName}: CLI entrypoint not found at ${cliEntry}${RESET$1}`);
+			continue;
+		}
+		const addArgs = region ? [
+			cliEntry,
+			"--region",
+			region,
+			"add",
+			installUrl,
+			"-g",
+			"-y"
+		] : [
+			cliEntry,
+			"add",
+			installUrl,
+			"-g",
+			"-y"
+		];
+		if (spawnSync(process.execPath, addArgs, {
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			encoding: "utf-8",
+			shell: process.platform === "win32"
+		}).status === 0) {
+			successCount++;
+			console.log(`  ${TEXT$1}Updated ${safeName}${RESET$1}`);
+		} else {
+			failCount++;
+			console.log(`  ${DIM$1}Failed to update ${safeName}${RESET$1}`);
+		}
+	}
+	printSkippedSkills(skipped);
+	return {
+		successCount,
+		failCount,
+		checkFailCount,
+		checkedCount,
+		updateCount: updates.length
+	};
+}
+async function updateProjectSkills(options = {}, regionOrMode, maybeMode) {
+	const region = regionOrMode === "check" || regionOrMode === "update" ? void 0 : regionOrMode;
+	const mode = regionOrMode === "check" || regionOrMode === "update" ? regionOrMode : maybeMode || "update";
+	const projectSkills = await getProjectSkillsForUpdate(options.skills);
+	let successCount = 0;
+	let failCount = 0;
+	let checkFailCount = 0;
+	let updateCount = 0;
+	if (projectSkills.length === 0) {
+		if (!options.skills) {
+			console.log(`${DIM$1}No project skills to update.${RESET$1}`);
+			console.log(`${DIM$1}Install project skills with${RESET$1} ${TEXT$1}npx safeskill add <package>${RESET$1}`);
+		}
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			foundCount: 0,
+			updateCount
+		};
+	}
+	const updatable = projectSkills.filter((s) => s.entry.skillPath);
+	const legacy = projectSkills.filter((s) => !s.entry.skillPath);
+	const hubUpdatable = updatable.filter((s) => s.entry.sourceType === "hub" && s.entry.resolvedVersion && s.entry.artifactDigest);
+	const skippedHub = updatable.filter((s) => s.entry.sourceType === "hub" && (!s.entry.resolvedVersion || !s.entry.artifactDigest));
+	const sourceUpdatable = updatable.filter((s) => s.entry.sourceType !== "hub");
+	if (updatable.length === 0) {
+		console.log(`${DIM$1}No project skills can be updated in place.${RESET$1}`);
+		printLegacyProjectSkills(legacy);
+		return {
+			successCount,
+			failCount,
+			checkFailCount,
+			foundCount: projectSkills.length,
+			updateCount
+		};
+	}
+	const cwd = process.cwd();
+	const targetAgentNames = [];
+	let hasUniversal = false;
+	for (const [type, config] of Object.entries(agents)) if (isUniversalAgent(type)) {
+		if (!hasUniversal && existsSync(join(cwd, ".agents"))) hasUniversal = true;
+	} else {
+		const agentRoot = config.skillsDir.split("/")[0];
+		if (existsSync(join(cwd, agentRoot))) targetAgentNames.push(config.displayName);
+	}
+	const targetParts = [];
+	if (hasUniversal) targetParts.push("Universal");
+	targetParts.push(...targetAgentNames);
+	if (targetParts.length > 0) {
+		const action = mode === "check" ? "Checking" : "Updating";
+		console.log(`${TEXT$1}${action} for: ${targetParts.join(", ")}${RESET$1}`);
+	}
+	console.log(mode === "check" ? `${TEXT$1}Checking ${sourceUpdatable.length + hubUpdatable.length} project skill(s)...${RESET$1}` : `${TEXT$1}Refreshing ${sourceUpdatable.length + hubUpdatable.length} skill(s)...${RESET$1}`);
+	console.log();
+	const hubInstallSources = /* @__PURE__ */ new Map();
+	if (hubUpdatable.length > 0) try {
+		(await checkHubUpdates(hubUpdatable.map(({ entry }) => ({
+			source: entry.source,
+			version: entry.resolvedVersion,
+			artifact_digest: entry.artifactDigest
+		})))).items.forEach((item, index) => {
+			const hubSkill = hubUpdatable[index];
+			if (!hubSkill || !item.has_update || !item.latest_version) return;
+			updateCount++;
+			hubInstallSources.set(hubSkill.name, replaceHubSourceVersion(hubSkill.entry.source, item.latest_version));
+		});
+	} catch {
+		console.log(`${DIM$1}Failed to check project hub skills${RESET$1}`);
+		checkFailCount += hubUpdatable.length;
+	}
+	const bySource = /* @__PURE__ */ new Map();
+	for (const skill of sourceUpdatable) {
+		const source = getSourceRefKey(skill.entry.source, skill.entry.ref);
+		const existing = bySource.get(source) || [];
+		existing.push(skill);
+		bySource.set(source, existing);
+	}
+	const localLock = await readLocalLock();
+	const cliEntry = join(__dirname$1, "..", "bin", "cli.mjs");
+	if (mode === "update" && !existsSync(cliEntry)) {
+		console.log(`${DIM$1}CLI entrypoint not found at ${cliEntry}${RESET$1}`);
+		return {
+			successCount,
+			failCount: updatable.length,
+			checkFailCount,
+			foundCount: projectSkills.length,
+			updateCount
+		};
+	}
+	for (const [, skillsForSource] of bySource) {
+		const firstEntry = skillsForSource[0].entry;
+		const sourceUrl = firstEntry.source;
+		const ref = firstEntry.ref;
+		const allLockedForSource = Object.entries(localLock.skills).filter(([, entry]) => hasSameSourceAndRef(entry, sourceUrl, ref)).map(([name]) => name);
+		let tempDir = null;
+		let deletedSkills = [];
+		let discoveredPaths = [];
+		let sourceCheckFailed = false;
+		try {
+			tempDir = await cloneRepo(sourceUrl, ref);
+			discoveredPaths = (await discoverSkills(tempDir)).map((s) => {
+				return join(relative(tempDir, s.path), "SKILL.md").split(sep).join("/");
+			});
+			deletedSkills = await checkAndPromptForDeletions(sourceUrl, allLockedForSource, localLock.skills, false, options, discoveredPaths, mode);
+		} catch {
+			console.log(`${DIM$1}Failed to check skills from ${sourceUrl}${RESET$1}`);
+			checkFailCount += skillsForSource.length;
+			sourceCheckFailed = true;
+		} finally {
+			if (tempDir && (mode === "update" || sourceCheckFailed)) await cleanupTempDir(tempDir);
+		}
+		if (sourceCheckFailed) continue;
+		const remainingSkills = skillsForSource.filter((s) => !deletedSkills.includes(s.name));
+		if (mode === "check") {
+			if (tempDir) try {
+				for (const skill of remainingSkills) {
+					const skillPath = skill.entry.skillPath;
+					if (!discoveredPaths.includes(skillPath)) continue;
+					const latestHash = await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
+					if (latestHash && latestHash !== skill.entry.computedHash) updateCount++;
+				}
+			} finally {
+				await cleanupTempDir(tempDir);
+			}
+			continue;
+		}
+		for (const skill of remainingSkills) {
+			const safeName = sanitizeMetadata(skill.name);
+			console.log(`${TEXT$1}Updating ${safeName}...${RESET$1}`);
+			const installUrl = buildLocalUpdateSource(skill.entry);
+			const subagentArgs = skill.entry.subagents?.length ? ["--subagent", ...skill.entry.subagents.map((s) => s === "" ? "root" : s)] : [];
+			const regionArgs = region ? ["--region", region] : [];
+			if (spawnSync(process.execPath, [
+				cliEntry,
+				...regionArgs,
+				"add",
+				installUrl,
+				"--skill",
+				skill.name,
+				...subagentArgs,
+				"-y"
+			], {
+				stdio: [
+					"inherit",
+					"pipe",
+					"pipe"
+				],
+				encoding: "utf-8",
+				shell: process.platform === "win32"
+			}).status === 0) {
+				successCount++;
+				console.log(`  ${TEXT$1}Updated ${safeName}${RESET$1}`);
+			} else {
+				failCount++;
+				console.log(`  ${DIM$1}Failed to update ${safeName}${RESET$1}`);
+			}
+		}
+	}
+	if (mode === "update") for (const skill of hubUpdatable) {
+		const installUrl = hubInstallSources.get(skill.name);
+		if (!installUrl) continue;
+		const safeName = sanitizeMetadata(skill.name);
+		console.log(`${TEXT$1}Updating ${safeName}...${RESET$1}`);
+		const subagentArgs = skill.entry.subagents?.length ? ["--subagent", ...skill.entry.subagents.map((s) => s === "" ? "root" : s)] : [];
+		const regionArgs = region ? ["--region", region] : [];
+		if (spawnSync(process.execPath, [
+			cliEntry,
+			...regionArgs,
+			"add",
+			installUrl,
+			"--skill",
+			skill.name,
+			...subagentArgs,
+			"-y"
+		], {
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			encoding: "utf-8",
+			shell: process.platform === "win32"
+		}).status === 0) {
+			successCount++;
+			console.log(`  ${TEXT$1}Updated ${safeName}${RESET$1}`);
+		} else {
+			failCount++;
+			console.log(`  ${DIM$1}Failed to update ${safeName}${RESET$1}`);
+		}
+	}
+	if (mode === "check") if (updateCount > 0) console.log(`${TEXT$1}Found ${updateCount} project update(s)${RESET$1}`);
+	else if (checkFailCount > 0) console.log(`${DIM$1}Failed to check ${checkFailCount} project skill(s)${RESET$1}`);
+	else console.log(`${TEXT$1}All project skills are up to date${RESET$1}`);
+	printLegacyProjectSkills(legacy);
+	printSkippedProjectHubSkills(skippedHub);
+	return {
+		successCount,
+		failCount,
+		checkFailCount,
+		foundCount: projectSkills.length,
+		updateCount
+	};
+}
+function printLegacyProjectSkills(legacy) {
+	if (legacy.length === 0) return;
+	console.log();
+	console.log(`${DIM$1}${legacy.length} project skill(s) cannot be updated automatically (installed before skillPath tracking):${RESET$1}`);
+	for (const skill of legacy) {
+		const reinstall = formatSourceInput(skill.entry.source, skill.entry.ref);
+		console.log(`  ${TEXT$1}-${RESET$1} ${sanitizeMetadata(skill.name)}`);
+		console.log(`    ${DIM$1}To refresh: ${TEXT$1}npx safeskill add ${reinstall} -y${RESET$1}`);
+	}
+}
+async function runUpdate(args = [], region) {
+	const options = parseUpdateOptions(args);
+	const scope = await resolveUpdateScope(options);
+	if (options.skills) console.log(`${TEXT$1}Updating ${options.skills.join(", ")}...${RESET$1}`);
+	else console.log(`${TEXT$1}Checking for skill updates...${RESET$1}`);
+	console.log();
+	let totalSuccess = 0;
+	let totalFail = 0;
+	let totalCheckFail = 0;
+	let totalFound = 0;
+	if (scope === "global" || scope === "both") {
+		if (scope === "both" && !options.skills) console.log(`${BOLD$1}Global Skills${RESET$1}`);
+		const { successCount, failCount, checkFailCount, checkedCount } = await updateGlobalSkills(options, region);
+		totalSuccess += successCount;
+		totalFail += failCount;
+		totalCheckFail += checkFailCount;
+		totalFound += checkedCount;
+		if (scope === "both" && !options.skills) console.log();
+	}
+	if (scope === "project" || scope === "both") {
+		if (scope === "both" && !options.skills) console.log(`${BOLD$1}Project Skills${RESET$1}`);
+		const { successCount, failCount, checkFailCount, foundCount } = await updateProjectSkills(options, region);
+		totalSuccess += successCount;
+		totalFail += failCount;
+		totalCheckFail += checkFailCount;
+		totalFound += foundCount;
+	}
+	if (options.skills && totalFound === 0) console.log(`${DIM$1}No installed skills found matching: ${options.skills.join(", ")}${RESET$1}`);
+	console.log();
+	if (totalSuccess > 0) console.log(`${TEXT$1}Updated ${totalSuccess} skill(s)${RESET$1}`);
+	if (totalFail > 0) console.log(`${DIM$1}Failed to update ${totalFail} skill(s)${RESET$1}`);
+	if (totalCheckFail > 0) console.log(`${DIM$1}Failed to check ${totalCheckFail} skill(s)${RESET$1}`);
+	track({
+		event: "update",
+		scope,
+		skillCount: String(totalSuccess + totalFail),
+		successCount: String(totalSuccess),
+		failCount: String(totalFail),
+		checkFailCount: String(totalCheckFail)
+	});
+	console.log();
+}
+async function runCheck(args = []) {
+	const options = parseUpdateOptions(args);
+	const scope = await resolveUpdateScope(options);
+	if (options.skills) console.log(`${TEXT$1}Checking ${options.skills.join(", ")}...${RESET$1}`);
+	else console.log(`${TEXT$1}Checking for skill updates...${RESET$1}`);
+	console.log();
+	let totalFound = 0;
+	let totalUpdates = 0;
+	let totalFail = 0;
+	if (scope === "global" || scope === "both") {
+		if (scope === "both" && !options.skills) console.log(`${BOLD$1}Global Skills${RESET$1}`);
+		const { failCount, checkFailCount, checkedCount, updateCount } = await updateGlobalSkills(options, void 0, "check");
+		totalFail += failCount + checkFailCount;
+		totalFound += checkedCount;
+		totalUpdates += updateCount;
+		if (scope === "both" && !options.skills) console.log();
+	}
+	if (scope === "project" || scope === "both") {
+		if (scope === "both" && !options.skills) console.log(`${BOLD$1}Project Skills${RESET$1}`);
+		const { failCount, checkFailCount, foundCount, updateCount } = await updateProjectSkills(options, "check");
+		totalFail += failCount + checkFailCount;
+		totalFound += foundCount;
+		totalUpdates += updateCount;
+	}
+	if (options.skills && totalFound === 0) console.log(`${DIM$1}No installed skills found matching: ${options.skills.join(", ")}${RESET$1}`);
+	if (totalFail > 0) {
+		console.log();
+		console.log(`${DIM$1}Failed to check ${totalFail} skill(s)${RESET$1}`);
+	}
+	track({
+		event: "check",
+		skillCount: String(totalFound),
+		updatesAvailable: String(totalUpdates),
+		failCount: String(totalFail)
+	});
+	console.log();
+}
+const BLOB_ALLOWED_OWNERS = [
+	"vercel",
+	"vercel-labs",
+	"heygen-com"
+];
+const EXCLUDE_FILES = new Set(["metadata.json"]);
+const EXCLUDE_DIRS = new Set([
+	".git",
+	"__pycache__",
+	"__pypackages__"
+]);
+const USE_AGENT_CONFIGS = {
+	"claude-code": {
+		command: "claude",
+		args: []
+	},
+	codex: {
+		command: "codex",
+		args: []
+	}
+};
+const SUPPORTED_USE_AGENTS = Object.keys(USE_AGENT_CONFIGS);
+function parseUseOptions(args) {
+	const source = [];
+	const options = {};
+	const errors = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (!arg) continue;
+		if (arg === "--help" || arg === "-h") options.help = true;
+		else if (arg === "--full-depth") options.fullDepth = true;
+		else if (arg === "--dangerously-accept-openclaw-risks") options.dangerouslyAcceptOpenclawRisks = true;
+		else if (arg === "--skill" || arg === "-s") {
+			const value = args[i + 1];
+			if (!value || value.startsWith("-")) errors.push(`${arg} requires a skill name`);
+			else if (options.skill) {
+				errors.push("Only one --skill value can be provided");
+				i++;
+			} else {
+				options.skill = value;
+				i++;
+			}
+		} else if (arg === "--agent" || arg === "-a") {
+			options.agent = options.agent || [];
+			i++;
+			let nextArg = args[i];
+			const startCount = options.agent.length;
+			while (i < args.length && nextArg && !nextArg.startsWith("-")) {
+				options.agent.push(nextArg);
+				i++;
+				nextArg = args[i];
+			}
+			if (options.agent.length === startCount) errors.push(`${arg} requires an agent name`);
+			i--;
+		} else if (arg.startsWith("-")) errors.push(`Unknown option: ${arg}`);
+		else source.push(arg);
+	}
+	errors.push(...validateUseAgentOption(options.agent));
+	return {
+		source,
+		options,
+		errors
+	};
+}
+function buildUsePrompt(input) {
+	const sections = [
+		"You are being given a Skill to execute for the user's next request.",
+		"Use the following SKILL.md as your instructions:",
+		`<SKILL.md>\n${input.skillMd}\n</SKILL.md>`
+	];
+	if (input.hasSupportingFiles && input.supportDir) sections.push(`Supporting files for this skill were downloaded to:\n${input.supportDir}\n\nWhen the SKILL.md references relative paths, read them from that directory.`);
+	return sections.join("\n\n") + "\n";
+}
+async function materializeUseSkill(skill) {
+	const tempRoot = await mkdtemp(join(tmpdir(), "safeskill-use-"));
+	const skillDir = join(tempRoot, sanitizeName(skill.directoryName || skill.name));
+	if (!isPathSafe(tempRoot, skillDir)) throw new Error("Invalid skill name: potential path traversal detected");
+	await mkdir(skillDir, { recursive: true });
+	if (skill.kind === "blob") await writeSnapshotFiles(skillDir, skill.files);
+	else if (skill.kind === "well-known") await writeMapFiles(skillDir, skill.files);
+	else await copySkillDirectory(skill.path, skillDir);
+	return {
+		tempRoot,
+		skillDir,
+		skillMd: skill.rawContent ?? await readFile(join(skillDir, "SKILL.md"), "utf-8"),
+		hasSupportingFiles: await containsSupportingFiles(skillDir, skillDir)
+	};
+}
+async function runUse(sourceArgs, options = {}, parseErrors = []) {
+	let cloneTempDir = null;
+	try {
+		if (options.help) {
+			console.log(getUseHelp());
+			return;
+		}
+		if (parseErrors.length > 0) fail(parseErrors.join("\n"));
+		if (sourceArgs.length === 0) fail(`Missing required argument: source\n\n${getUseHelp()}`);
+		if (sourceArgs.length > 1) fail(`Expected one source, received ${sourceArgs.length}: ${sourceArgs.join(", ")}`);
+		const useAgent = options.agent?.[0];
+		if (useAgent && !USE_AGENT_CONFIGS[useAgent]) fail(formatUnsupportedAgentError(useAgent));
+		const source = sourceArgs[0];
+		const parsed = parseSource(source);
+		if (getOwnerRepo(parsed)?.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) fail([
+			"OpenClaw skills are unverified community submissions.",
+			"Skills run with full agent permissions and could be malicious.",
+			`If you understand the risks, re-run with: safeskill use ${source} --dangerously-accept-openclaw-risks`
+		].join("\n"));
+		const selector = resolveSelector(parsed.skillFilter, options.skill);
+		const includeInternal = selector !== void 0;
+		let selectedSkill;
+		if (parsed.type === "well-known") selectedSkill = selectWellKnownSkill(await wellKnownProvider.fetchAllSkills(parsed.url), selector, source);
+		else {
+			let skills;
+			let blobResult = null;
+			if (parsed.type === "local") {
+				if (!existsSync(parsed.localPath)) fail(`Local path does not exist: ${parsed.localPath}`);
+				skills = await discoverSkills(parsed.localPath, parsed.subpath, {
+					includeInternal,
+					fullDepth: options.fullDepth
+				});
+			} else if (parsed.type === "hub") {
+				const downloaded = await downloadHubSource(source);
+				cloneTempDir = downloaded.tempDir;
+				skills = await discoverSkills(downloaded.tempDir, parsed.subpath, {
+					includeInternal,
+					fullDepth: options.fullDepth
+				});
+				if (skills.length === 0 && !parsed.subpath && downloaded.resolved.skill) {
+					const fallbackSkill = await parseSkillMd(join(downloaded.tempDir, "SKILL.md"), {
+						includeInternal,
+						fallbackName: downloaded.resolved.skill.display_name || downloaded.resolved.skill.name,
+						fallbackDescription: downloaded.resolved.skill.summary || downloaded.resolved.skill.name,
+						fallbackSlug: downloaded.resolved.skill.name,
+						fallbackInstallName: downloaded.resolved.skill.name
+					});
+					if (fallbackSkill) {
+						fallbackSkill.rawContent = withFallbackFrontmatter(fallbackSkill);
+						skills = [fallbackSkill];
+					}
+				}
+			} else if (parsed.type === "github" && !options.fullDepth) {
+				const ownerRepo = getOwnerRepo(parsed);
+				const owner = ownerRepo?.split("/")[0]?.toLowerCase();
+				if (ownerRepo && owner && BLOB_ALLOWED_OWNERS.includes(owner)) blobResult = await tryBlobInstall(ownerRepo, {
+					subpath: parsed.subpath,
+					skillFilter: selector,
+					ref: parsed.ref,
+					getToken: getGitHubToken,
+					includeInternal
+				});
+				if (blobResult) skills = blobResult.skills;
+				else {
+					cloneTempDir = await cloneRepo(parsed.url, parsed.ref);
+					skills = await discoverSkills(cloneTempDir, parsed.subpath, {
+						includeInternal,
+						fullDepth: options.fullDepth
+					});
+				}
+			} else {
+				cloneTempDir = await cloneRepo(parsed.url, parsed.ref);
+				skills = await discoverSkills(cloneTempDir, parsed.subpath, {
+					includeInternal,
+					fullDepth: options.fullDepth
+				});
+			}
+			const selected = selectSkill(skills, selector, source);
+			if (blobResult && isBlobSkill(selected)) selectedSkill = {
+				kind: "blob",
+				name: selected.name,
+				directoryName: getDirectoryName(selected),
+				rawContent: selected.rawContent ?? getSkillMdFromSnapshot(selected.files),
+				files: selected.files
+			};
+			else selectedSkill = {
+				kind: "disk",
+				name: selected.name,
+				directoryName: getDirectoryName(selected),
+				rawContent: selected.rawContent,
+				path: selected.path
+			};
+		}
+		const materialized = await materializeUseSkill(selectedSkill);
+		await cleanupClone(cloneTempDir);
+		cloneTempDir = null;
+		const prompt = buildUsePrompt({
+			skillMd: materialized.skillMd,
+			supportDir: materialized.skillDir,
+			hasSupportingFiles: materialized.hasSupportingFiles
+		});
+		if (useAgent) {
+			const exitCode = await launchAgentInteractively(useAgent, prompt);
+			if (exitCode !== 0) process.exit(exitCode);
+			return;
+		}
+		process.stdout.write(prompt);
+	} catch (error) {
+		await cleanupClone(cloneTempDir);
+		if (error instanceof GitCloneError) fail(error.message);
+		if (error instanceof UseCommandError) fail(error.message);
+		fail(error instanceof Error ? error.message : "Unknown error");
+	}
+}
+async function launchAgentInteractively(agent, prompt, spawnImpl = spawnAgent) {
+	const config = USE_AGENT_CONFIGS[agent];
+	if (!config) throw new UseCommandError(formatUnsupportedAgentError(agent));
+	return new Promise((resolve, reject) => {
+		const child = spawnImpl(config.command, [...config.args, prompt], { stdio: "inherit" });
+		let settled = false;
+		child.on("error", (error) => {
+			if (settled) return;
+			settled = true;
+			if (error.code === "ENOENT") {
+				reject(new UseCommandError(`Could not launch ${agents[agent].displayName}: command not found: ${config.command}`));
+				return;
+			}
+			reject(error);
+		});
+		child.on("close", (code) => {
+			if (settled) return;
+			settled = true;
+			resolve(code ?? 1);
+		});
+	});
+}
+function spawnAgent(command, args) {
+	return spawn(command, args, { stdio: "inherit" });
+}
+function getUseHelp() {
+	return `Usage: safeskill use <source>[@<skill>] [options]
+
+Generate a prompt for using one skill without installing it.
+
+Options:
+  -s, --skill <skill>   Select the skill to use
+  -a, --agent <agent>   Start one supported agent interactively (${SUPPORTED_USE_AGENTS.join(", ")})
+  --full-depth          Search nested directories like safeskill add --full-depth
+  --dangerously-accept-openclaw-risks
+                         Allow unverified OpenClaw community skills
+  -h, --help            Show this help message
+
+Examples:
+  safeskill use vercel-labs/agent-skills@web-design-guidelines | claude
+  safeskill use vercel-labs/agent-skills --skill web-design-guidelines --agent claude-code
+  safeskill use vercel-labs/agent-skills@web-design-guidelines --agent codex`;
+}
+function resolveSelector(sourceSelector, optionSelector) {
+	if (sourceSelector && optionSelector) {
+		if (sourceSelector.toLowerCase() !== optionSelector.toLowerCase()) throw new UseCommandError(`Conflicting skill selectors: source selects "${sourceSelector}" but --skill selects "${optionSelector}". Provide one selector.`);
+		return optionSelector;
+	}
+	return optionSelector ?? sourceSelector;
+}
+function selectSkill(skills, selector, source) {
+	if (skills.length === 0) throw new UseCommandError("No valid skills found. Skills require a SKILL.md with name and description.");
+	if (!selector) {
+		if (skills.length === 1) return skills[0];
+		throw new UseCommandError(formatMultipleSkillsError(source, skills.map(getSkillDisplayName)));
+	}
+	const selected = filterSkills(skills, [selector]);
+	if (selected.length === 0) throw new UseCommandError(formatNoMatchError(selector, skills.map(getSkillDisplayName)));
+	if (selected.length > 1) throw new UseCommandError(`Skill selector "${selector}" matched multiple skills.`);
+	return selected[0];
+}
+function selectWellKnownSkill(skills, selector, source) {
+	if (skills.length === 0) throw new UseCommandError("No skills found at this URL. Make sure the server has a /.well-known/agent-skills/index.json or /.well-known/skills/index.json file.");
+	let selected;
+	if (!selector) {
+		if (skills.length !== 1) throw new UseCommandError(formatMultipleSkillsError(source, skills.map((s) => s.installName)));
+		selected = skills;
+	} else {
+		selected = skills.filter((skill) => skill.installName.toLowerCase() === selector.toLowerCase() || skill.name.toLowerCase() === selector.toLowerCase());
+		if (selected.length === 0) throw new UseCommandError(formatNoMatchError(selector, skills.map((s) => s.installName)));
+		if (selected.length > 1) throw new UseCommandError(`Skill selector "${selector}" matched multiple skills.`);
+	}
+	const skill = selected[0];
+	return {
+		kind: "well-known",
+		name: skill.name,
+		directoryName: skill.installName,
+		rawContent: skill.content,
+		files: skill.files
+	};
+}
+function formatMultipleSkillsError(source, names) {
+	return [
+		"This source contains multiple skills. Specify exactly one skill:",
+		...names.map((name) => `  - ${name}`),
+		"",
+		`Examples:\n  safeskill use ${source}@${names[0] ?? "<skill>"}\n  safeskill use ${source} --skill ${names[0] ?? "<skill>"}`
+	].join("\n");
+}
+function formatNoMatchError(selector, names) {
+	return [
+		`No matching skill found for: ${selector}`,
+		"Available skills:",
+		...names.map((name) => `  - ${name}`)
+	].join("\n");
+}
+function validateUseAgentOption(agentValues) {
+	if (!agentValues || agentValues.length === 0) return [];
+	const errors = [];
+	const validAgents = Object.keys(agents);
+	const invalidAgents = agentValues.filter((agent) => agent !== "*" && !validAgents.includes(agent));
+	if (agentValues.includes("*")) errors.push("safeskill use --agent does not support '*'; specify exactly one agent.");
+	if (agentValues.length > 1) errors.push("safeskill use --agent accepts exactly one agent.");
+	if (invalidAgents.length > 0) errors.push(`Invalid agents: ${invalidAgents.join(", ")}\nValid agents: ${validAgents.join(", ")}`);
+	return errors;
+}
+function formatUnsupportedAgentError(agent) {
+	return [`Running ${agents[agent].displayName} is not supported yet.`, `Supported agents for safeskill use --agent: ${SUPPORTED_USE_AGENTS.join(", ")}`].join("\n");
+}
+async function writeSnapshotFiles(targetDir, files) {
+	for (const file of files) await writeSafeFile(targetDir, file.path, file.contents);
+}
+async function writeMapFiles(targetDir, files) {
+	for (const [path, contents] of files) await writeSafeFile(targetDir, path, contents);
+}
+async function writeSafeFile(targetDir, filePath, contents) {
+	const fullPath = join(targetDir, filePath);
+	if (!isPathSafe(targetDir, fullPath)) return;
+	await mkdir(dirname(fullPath), { recursive: true });
+	if (typeof contents === "string") await writeFile(fullPath, contents, "utf-8");
+	else await writeFile(fullPath, contents);
+}
+async function copySkillDirectory(src, dest) {
+	await mkdir(dest, { recursive: true });
+	const entries = await readdir(src, { withFileTypes: true });
+	await Promise.all(entries.filter((entry) => !isExcluded(entry.name, entry.isDirectory())).map(async (entry) => {
+		const srcPath = join(src, entry.name);
+		const destPath = join(dest, entry.name);
+		if (!isPathSafe(dest, destPath)) return;
+		if (entry.isDirectory()) {
+			await copySkillDirectory(srcPath, destPath);
+			return;
+		}
+		try {
+			await cp(srcPath, destPath, {
+				dereference: true,
+				recursive: true
+			});
+		} catch (err) {
+			if (err instanceof Error && "code" in err && err.code === "ENOENT" && entry.isSymbolicLink()) {
+				console.error(`Skipping broken symlink: ${srcPath}`);
+				return;
+			}
+			throw err;
+		}
+	}));
+}
+async function containsSupportingFiles(rootDir, currentDir) {
+	const entries = await readdir(currentDir, { withFileTypes: true });
+	for (const entry of entries) {
+		const entryPath = join(currentDir, entry.name);
+		const relPath = relative(rootDir, entryPath).split(sep).join("/");
+		if (entry.isDirectory()) {
+			if (await containsSupportingFiles(rootDir, entryPath)) return true;
+		} else if (relPath.toLowerCase() !== "skill.md") return true;
+	}
+	return false;
+}
+function isBlobSkill(skill) {
+	return Array.isArray(skill.files);
+}
+function getSkillMdFromSnapshot(files) {
+	return files.find((file) => file.path.toLowerCase() === "skill.md")?.contents ?? "";
+}
+function getDirectoryName(skill) {
+	return skill.installName || skill.name;
+}
+function withFallbackFrontmatter(skill) {
+	if (!skill.rawContent || skill.rawContent.trimStart().startsWith("---")) return skill.rawContent;
+	return [
+		"---",
+		`name: ${skill.name}`,
+		`description: ${skill.description}`,
+		"---",
+		"",
+		skill.rawContent
+	].join("\n");
+}
+function isExcluded(name, isDirectory) {
+	return EXCLUDE_FILES.has(name) || isDirectory && EXCLUDE_DIRS.has(name);
+}
+function isPathSafe(basePath, targetPath) {
+	const normalizedBase = normalize(resolve(basePath));
+	const normalizedTarget = normalize(resolve(targetPath));
+	return normalizedTarget.startsWith(normalizedBase + sep) || normalizedTarget === normalizedBase;
+}
+async function cleanupClone(tempDir) {
+	if (tempDir) await cleanupTempDir(tempDir).catch(() => {});
+}
+function fail(message) {
+	console.error(message);
+	process.exit(1);
+}
+var UseCommandError = class extends Error {};
+const __dirname = dirname(fileURLToPath(import.meta.url));
+function getVersion() {
+	try {
+		const pkgPath = join(__dirname, "..", "package.json");
+		return JSON.parse(readFileSync(pkgPath, "utf-8")).version;
+	} catch {
+		return "0.0.0";
+	}
+}
+const VERSION = getVersion();
+initTelemetry(VERSION);
+const RESET = "\x1B[0m";
+const BOLD = "\x1B[1m";
+const DIM = "\x1B[38;5;102m";
+const TEXT = "\x1B[38;5;145m";
+const LOGO_HEIGHT = 7;
+const LOGO_GLYPHS = {
+	s: [
+		" █████ ",
+		"█      ",
+		"█      ",
+		" ████  ",
+		"     █ ",
+		"█     █",
+		" █████ "
+	],
+	a: [
+		"  ███  ",
+		" █   █ ",
+		" █   █ ",
+		" █████ ",
+		" █   █ ",
+		" █   █ ",
+		" █   █ "
+	],
+	f: [
+		"██████ ",
+		"█      ",
+		"█      ",
+		"█████  ",
+		"█      ",
+		"█      ",
+		"█      "
+	],
+	e: [
+		"██████ ",
+		"█      ",
+		"█      ",
+		"█████  ",
+		"█      ",
+		"█      ",
+		"██████ "
+	],
+	k: [
+		"█   █  ",
+		"█  █   ",
+		"█ █    ",
+		"███    ",
+		"█ █    ",
+		"█  █   ",
+		"█   █  "
+	],
+	i: [
+		"█████  ",
+		"  █    ",
+		"  █    ",
+		"  █    ",
+		"  █    ",
+		"  █    ",
+		"█████  "
+	],
+	l: [
+		"█      ",
+		"█      ",
+		"█      ",
+		"█      ",
+		"█      ",
+		"█      ",
+		"██████ "
+	]
+};
+function buildLogoLines() {
+	const words = ["Safe", "Skill"];
+	const lines = Array.from({ length: LOGO_HEIGHT }, () => "");
+	for (const word of words) {
+		for (const character of word) {
+			const glyph = LOGO_GLYPHS[character.toLowerCase()];
+			if (!glyph) continue;
+			for (let i = 0; i < LOGO_HEIGHT; i++) lines[i] += `${glyph[i] ?? ""} `;
+		}
+		for (let i = 0; i < LOGO_HEIGHT; i++) lines[i] += "  ";
+	}
+	return lines.map((line) => line.replace(/\s+$/, ""));
+}
+const GRAYS = [
+	"\x1B[38;5;250m",
+	"\x1B[38;5;248m",
+	"\x1B[38;5;245m",
+	"\x1B[38;5;243m",
+	"\x1B[38;5;240m",
+	"\x1B[38;5;238m",
+	"\x1B[38;5;236m"
+];
+function showLogo() {
+	console.log();
+	buildLogoLines().forEach((line, i) => {
+		console.log(`${GRAYS[i]}${line}${RESET}`);
+	});
+}
+function showBanner() {
+	showLogo();
+	console.log();
 	console.log(`${DIM}SafeSkill CLI for the open agent skills ecosystem${RESET}`);
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill add ${DIM}<package>${RESET}        ${DIM}Add a new skill${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill remove${RESET}            ${DIM}Remove installed skills${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill list${RESET}              ${DIM}List installed skills${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill find ${DIM}[query]${RESET}       ${DIM}Search for skills${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill use ${DIM}<package>${RESET}        ${DIM}Use a skill without installing${RESET}`);
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill check${RESET}             ${DIM}Check for updates${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx safeskill update${RESET}            ${DIM}Update all skills${RESET}`);
@@ -4382,6 +6455,7 @@ ${BOLD}Manage Skills:${RESET}
   remove [skills]      Remove installed skills
   list, ls             List installed skills
   find [query]         Search for skills interactively
+  use <package>        Generate a one-shot prompt for a skill
 
 ${BOLD}Updates:${RESET}
   check                Check for available skill updates
@@ -4439,6 +6513,8 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} safeskill ls --json                     ${DIM}# JSON output${RESET}
   ${DIM}$${RESET} safeskill find                          ${DIM}# interactive search${RESET}
   ${DIM}$${RESET} safeskill find typescript               ${DIM}# search by keyword${RESET}
+  ${DIM}$${RESET} safeskill use example-org/agent-skills@web-design
+  ${DIM}$${RESET} safeskill use safeskill://official/acme/code-review@1.2.0
   ${DIM}$${RESET} safeskill check
   ${DIM}$${RESET} safeskill update
   ${DIM}$${RESET} safeskill experimental_install          ${DIM}# restore from skills-lock.json${RESET}
@@ -4526,327 +6602,6 @@ Describe when this skill should be used.
 	console.log(`Browse existing skills for inspiration at ${TEXT}https://skills.sh/${RESET}`);
 	console.log();
 }
-const AGENTS_DIR = ".agents";
-const LOCK_FILE = ".skill-lock.json";
-const CURRENT_LOCK_VERSION = 4;
-function getSkillLockPath() {
-	const xdgStateHome = process.env.XDG_STATE_HOME;
-	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
-	return join(homedir(), AGENTS_DIR, LOCK_FILE);
-}
-function readSkillLock() {
-	const lockPath = getSkillLockPath();
-	try {
-		const content = readFileSync(lockPath, "utf-8");
-		const parsed = JSON.parse(content);
-		if (typeof parsed.version !== "number" || !parsed.skills) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-		if (parsed.version < CURRENT_LOCK_VERSION) return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-		return parsed;
-	} catch {
-		return {
-			version: CURRENT_LOCK_VERSION,
-			skills: {}
-		};
-	}
-}
-function getSkipReason(entry) {
-	if (entry.sourceType === "local") return "Local path";
-	if (entry.sourceType === "hub") {
-		if (!entry.resolvedVersion) return "No hub version recorded";
-		if (!entry.artifactDigest) return "No hub artifact metadata";
-		return "No version tracking";
-	}
-	if (entry.sourceType === "git") return "Git URL (hash tracking not supported)";
-	if (!entry.skillFolderHash) return "No version hash available";
-	if (!entry.skillPath) return "No skill path recorded";
-	return "No version tracking";
-}
-function replaceHubSourceVersion(source, version) {
-	const trimmedSource = source.trim();
-	if (!trimmedSource) return source;
-	return `${trimmedSource.replace(/@[^/@]+$/, "")}@${version}`;
-}
-function printSkippedSkills(skipped) {
-	if (skipped.length === 0) return;
-	console.log();
-	console.log(`${DIM}${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
-	for (const skill of skipped) {
-		console.log(`  ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
-		console.log(`    ${DIM}To update: ${TEXT}npx safeskill add ${skill.sourceUrl} -g -y${RESET}`);
-	}
-}
-async function runCheck(args = []) {
-	console.log(`${TEXT}Checking for skill updates...${RESET}`);
-	console.log();
-	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
-		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
-		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx safeskill add <package>${RESET}`);
-		return;
-	}
-	const token = getGitHubToken();
-	const skillsBySource = /* @__PURE__ */ new Map();
-	const hubEntries = [];
-	const skipped = [];
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType === "hub") {
-			if (!entry.resolvedVersion || !entry.artifactDigest) {
-				skipped.push({
-					name: skillName,
-					reason: getSkipReason(entry),
-					sourceUrl: entry.sourceUrl
-				});
-				continue;
-			}
-			hubEntries.push({
-				name: skillName,
-				entry
-			});
-			continue;
-		}
-		if (!entry.skillFolderHash || !entry.skillPath) {
-			skipped.push({
-				name: skillName,
-				reason: getSkipReason(entry),
-				sourceUrl: entry.sourceUrl
-			});
-			continue;
-		}
-		const existing = skillsBySource.get(entry.source) || [];
-		existing.push({
-			name: skillName,
-			entry
-		});
-		skillsBySource.set(entry.source, existing);
-	}
-	const totalSkills = skillNames.length - skipped.length;
-	if (totalSkills === 0) {
-		console.log(`${DIM}No GitHub skills to check.${RESET}`);
-		printSkippedSkills(skipped);
-		return;
-	}
-	console.log(`${DIM}Checking ${totalSkills} skill(s) for updates...${RESET}`);
-	const updates = [];
-	const errors = [];
-	if (hubEntries.length > 0) try {
-		(await checkHubUpdates(hubEntries.map(({ entry }) => ({
-			source: entry.sourceUrl,
-			version: entry.resolvedVersion,
-			artifact_digest: entry.artifactDigest
-		})))).items.forEach((item, index) => {
-			const hubEntry = hubEntries[index];
-			if (!hubEntry) return;
-			if (item.has_update) updates.push({
-				name: hubEntry.name,
-				source: hubEntry.entry.sourceUrl
-			});
-		});
-	} catch (err) {
-		hubEntries.forEach(({ name, entry }) => {
-			errors.push({
-				name,
-				source: entry.sourceUrl,
-				error: err instanceof Error ? err.message : "Unknown error"
-			});
-		});
-	}
-	for (const [source, skills] of skillsBySource) for (const { name, entry } of skills) try {
-		const latestHash = await fetchSkillFolderHash(source, entry.skillPath, token);
-		if (!latestHash) {
-			errors.push({
-				name,
-				source,
-				error: "Could not fetch from GitHub"
-			});
-			continue;
-		}
-		if (latestHash !== entry.skillFolderHash) updates.push({
-			name,
-			source
-		});
-	} catch (err) {
-		errors.push({
-			name,
-			source,
-			error: err instanceof Error ? err.message : "Unknown error"
-		});
-	}
-	console.log();
-	if (updates.length === 0) console.log(`${TEXT}✓ All skills are up to date${RESET}`);
-	else {
-		console.log(`${TEXT}${updates.length} update(s) available:${RESET}`);
-		console.log();
-		for (const update of updates) {
-			console.log(`  ${TEXT}↑${RESET} ${update.name}`);
-			console.log(`    ${DIM}source: ${update.source}${RESET}`);
-		}
-		console.log();
-		console.log(`${DIM}Run${RESET} ${TEXT}npx safeskill update${RESET} ${DIM}to update all skills${RESET}`);
-	}
-	if (errors.length > 0) {
-		console.log();
-		console.log(`${DIM}Could not check ${errors.length} skill(s) (may need reinstall)${RESET}`);
-		console.log();
-		for (const error of errors) {
-			console.log(`  ${DIM}✗${RESET} ${error.name}`);
-			console.log(`    ${DIM}source: ${error.source}${RESET}`);
-		}
-	}
-	printSkippedSkills(skipped);
-	track({
-		event: "check",
-		skillCount: String(totalSkills),
-		updatesAvailable: String(updates.length)
-	});
-	console.log();
-}
-async function runUpdate(region) {
-	console.log(`${TEXT}Checking for skill updates...${RESET}`);
-	console.log();
-	const lock = readSkillLock();
-	const skillNames = Object.keys(lock.skills);
-	if (skillNames.length === 0) {
-		console.log(`${DIM}No skills tracked in lock file.${RESET}`);
-		console.log(`${DIM}Install skills with${RESET} ${TEXT}npx safeskill add <package>${RESET}`);
-		return;
-	}
-	const token = getGitHubToken();
-	const updates = [];
-	const hubEntries = [];
-	const skipped = [];
-	for (const skillName of skillNames) {
-		const entry = lock.skills[skillName];
-		if (!entry) continue;
-		if (entry.sourceType === "hub") {
-			if (!entry.resolvedVersion || !entry.artifactDigest) {
-				skipped.push({
-					name: skillName,
-					reason: getSkipReason(entry),
-					sourceUrl: entry.sourceUrl
-				});
-				continue;
-			}
-			hubEntries.push({
-				name: skillName,
-				entry
-			});
-			continue;
-		}
-		if (!entry.skillFolderHash || !entry.skillPath) {
-			skipped.push({
-				name: skillName,
-				reason: getSkipReason(entry),
-				sourceUrl: entry.sourceUrl
-			});
-			continue;
-		}
-		try {
-			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
-			if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-				name: skillName,
-				source: entry.source,
-				entry
-			});
-		} catch {}
-	}
-	if (hubEntries.length > 0) try {
-		(await checkHubUpdates(hubEntries.map(({ entry }) => ({
-			source: entry.sourceUrl,
-			version: entry.resolvedVersion,
-			artifact_digest: entry.artifactDigest
-		})))).items.forEach((item, index) => {
-			const hubEntry = hubEntries[index];
-			if (!hubEntry || !item.has_update || !item.latest_version) return;
-			updates.push({
-				name: hubEntry.name,
-				source: replaceHubSourceVersion(hubEntry.entry.sourceUrl, item.latest_version),
-				entry: hubEntry.entry
-			});
-		});
-	} catch {}
-	if (skillNames.length - skipped.length === 0) {
-		console.log(`${DIM}No skills to check.${RESET}`);
-		printSkippedSkills(skipped);
-		return;
-	}
-	if (updates.length === 0) {
-		console.log(`${TEXT}✓ All skills are up to date${RESET}`);
-		console.log();
-		return;
-	}
-	console.log(`${TEXT}Found ${updates.length} update(s)${RESET}`);
-	console.log();
-	let successCount = 0;
-	let failCount = 0;
-	for (const update of updates) {
-		console.log(`${TEXT}Updating ${update.name}...${RESET}`);
-		let installUrl = update.entry.sourceUrl;
-		if (update.entry.sourceType === "hub") installUrl = update.source;
-		else if (update.entry.skillPath) {
-			let skillFolder = update.entry.skillPath;
-			if (skillFolder.endsWith("/SKILL.md")) skillFolder = skillFolder.slice(0, -9);
-			else if (skillFolder.endsWith("SKILL.md")) skillFolder = skillFolder.slice(0, -8);
-			if (skillFolder.endsWith("/")) skillFolder = skillFolder.slice(0, -1);
-			installUrl = update.entry.sourceUrl.replace(/\.git$/, "").replace(/\/$/, "");
-			installUrl = `${installUrl}/tree/main/${skillFolder}`;
-		}
-		const cliEntry = join(__dirname, "..", "bin", "cli.mjs");
-		if (!existsSync(cliEntry)) {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${update.name}: CLI entrypoint not found at ${cliEntry}${RESET}`);
-			continue;
-		}
-		const addArgs = region ? [
-			cliEntry,
-			"--region",
-			region,
-			"add",
-			installUrl,
-			"-g",
-			"-y"
-		] : [
-			cliEntry,
-			"add",
-			installUrl,
-			"-g",
-			"-y"
-		];
-		if (spawnSync(process.execPath, addArgs, {
-			stdio: [
-				"inherit",
-				"pipe",
-				"pipe"
-			],
-			encoding: "utf-8",
-			shell: process.platform === "win32"
-		}).status === 0) {
-			successCount++;
-			console.log(`  ${TEXT}✓${RESET} Updated ${update.name}`);
-		} else {
-			failCount++;
-			console.log(`  ${DIM}✗ Failed to update ${update.name}${RESET}`);
-		}
-	}
-	console.log();
-	if (successCount > 0) console.log(`${TEXT}✓ Updated ${successCount} skill(s)${RESET}`);
-	if (failCount > 0) console.log(`${DIM}Failed to update ${failCount} skill(s)${RESET}`);
-	track({
-		event: "update",
-		skillCount: String(updates.length),
-		successCount: String(successCount),
-		failCount: String(failCount)
-	});
-	console.log();
-}
 function parseGlobalOptions(args) {
 	const parsedArgs = [];
 	let region;
@@ -4893,9 +6648,11 @@ async function main() {
 		return;
 	}
 	if (parsedGlobalOptions.region) setSafeSkillRegionOverride(parsedGlobalOptions.region);
+	const inAgent = await isRunningInAgent();
 	const args = parsedGlobalOptions.args;
 	if (args.length === 0) {
-		showBanner();
+		if (inAgent) showHelp();
+		else showBanner();
 		return;
 	}
 	const command = args[0];
@@ -4905,24 +6662,28 @@ async function main() {
 		case "search":
 		case "f":
 		case "s":
-			showLogo();
-			console.log();
+			if (!inAgent) {
+				showLogo();
+				console.log();
+			}
 			await runFind(restArgs);
 			break;
 		case "init":
-			showLogo();
-			console.log();
+			if (!inAgent) {
+				showLogo();
+				console.log();
+			}
 			runInit(restArgs);
 			break;
 		case "experimental_install":
-			showLogo();
+			if (!inAgent) showLogo();
 			await runInstallFromLock(restArgs);
 			break;
 		case "i":
 		case "install":
 		case "a":
 		case "add": {
-			showLogo();
+			if (!inAgent) showLogo();
 			const { source: addSource, options: addOpts } = parseAddOptions(restArgs);
 			await runAdd(addSource, addOpts);
 			break;
@@ -4938,7 +6699,7 @@ async function main() {
 			await removeCommand(skills, removeOptions);
 			break;
 		case "experimental_sync": {
-			showLogo();
+			if (!inAgent) showLogo();
 			const { options: syncOptions } = parseSyncOptions(restArgs);
 			await runSync(restArgs, syncOptions);
 			break;
@@ -4947,12 +6708,17 @@ async function main() {
 		case "ls":
 			await runList(restArgs);
 			break;
+		case "use": {
+			const { source: useSource, options: useOptions, errors: useErrors } = parseUseOptions(restArgs);
+			await runUse(useSource, useOptions, useErrors);
+			break;
+		}
 		case "check":
-			runCheck(restArgs);
+			await runCheck(restArgs);
 			break;
 		case "update":
 		case "upgrade":
-			runUpdate(parsedGlobalOptions.region);
+			await runUpdate(restArgs, parsedGlobalOptions.region);
 			break;
 		case "--help":
 		case "-h":
@@ -4967,5 +6733,9 @@ async function main() {
 			console.log(`Run ${BOLD}safeskill --help${RESET} for usage.`);
 	}
 }
-main();
+function isCliEntrypoint() {
+	const entrypoint = process.argv[1];
+	return entrypoint ? import.meta.url === pathToFileURL(entrypoint).href : false;
+}
+if (isCliEntrypoint()) main();
 export {};