@seojin08/skill-finder 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 새 버전의 항목은 `npm run package`가 내려받기 페이지의 meta.json에 서명과 함께 넣고, 앱의 "새 버전" 표시를 누르면 보입니다. 한 줄이 한 항목입니다.
 
+## 0.3.4 (2026-11-03)
+
+- 처음 실행할 때 함께 들어 있는 스킬 색인을 바로 씁니다. 몇 분씩 모으기를 기다리지 않아도 스킬 1만여 개를 몇 초 만에 검색할 수 있습니다.
+- 처음 실행하면 Anthropic 공식 스킬부터 모읍니다.
+- 지워진 저장소나 커밋을 동기화 때마다 다시 묻지 않고, GitHub가 요청이 많다고 하면 잠깐 쉬었다가 다시 받습니다.
+- GitHub가 잠깐 답하지 않아도 저장소 별 수 갱신을 멈추지 않고, 나눠서 다시 묻습니다.
+- 검색에 나오는 GitHub 저장소 카드에도 별을 눌러 즐겨찾기에 넣을 수 있습니다.
+- 즐겨찾기 화면 왼쪽에서 종류(스킬·GitHub 저장소)·제공자·카테고리·설치 방식으로 골라 볼 수 있습니다.
+- Windows에 설치하면 터미널 명령 skill-finder가 생깁니다(사용자 PATH에 추가). 새로 연 터미널에서 skill-finder --version으로 설치된 버전을 보고, skill-finder로 앱을 켭니다.
+- Firefox·Safari 등 번역 기능이 없는 브라우저에서도 스킬 설명을 화면 언어(한국어·일본어)로 번역합니다. 버튼을 누르지 않아도 처음 한 번 Firefox와 같은 Mozilla 번역 모델(약 46MB)을 받고, 번역은 이 PC 안에서만 합니다. Chrome은 페이지에서 처음 클릭하거나 입력할 때 번역 모델을 받습니다.
+- 이미 한국어·일본어인 설명이나 기호뿐인 글은 번역하지 않습니다. README 추천의 요약이 엉뚱한 글자로 바뀌던 문제가 고쳐졌습니다.
+- README 추천 결과에서 이미 설치한 스킬(고른 프로젝트·개인 범위)에 "설치됨"이 붙고, 칩을 눌러 숨길 수 있습니다. 왼쪽 필터로 제공자·카테고리·설치 방식을 골라 볼 수 있습니다.
+- 설치됨 화면에 플러그인 안에 든 스킬도 나오고, 고른 프로젝트와 상관없는 다른 폴더의 플러그인은 빠집니다. 스킬 목록을 범위·설치 경로·위험·색인·제공자·카테고리로 골라 보고, 5·10·20개씩 페이지로 넘깁니다.
+- README 추천이나 설치됨 화면에서 연 스킬은 그 화면에서 고른 프로젝트 폴더에 설치하도록 열립니다(범위는 바꿀 수 있음). 위험 등급이 주의 이상인 스킬을 개인 범위로 설치하려 하면 이 프로젝트에만 설치하는 것도 고려하라고 알려 줍니다.
+
+## 0.3.3 (2026-11-03)
+
+- 스킬 설치에 쓰는 skills CLI를 1.7.6으로 올렸습니다. 저장소 안의 바로가기(symlink)를 통해 스킬 폴더 밖의 파일이 함께 복사될 수 있던 보안 문제가 막혔습니다.
+- 이제 Node.js 22.20 이상이 필요합니다. 더 낮은 버전이면 실행할 때 업데이트 안내가 나옵니다.
+
 ## 0.3.2 (2026-11-02)
 
 - 영어·일본어 화면에서 숫자·이름·명령이 끼는 문장이 그 언어의 어순으로 자연스럽게 나옵니다.

package/README.md

@@ -23,7 +23,7 @@ Claude Code 스킬을 한곳에서 찾아 점수·위험 신호와 함께 보고
 
 ### macOS·Linux·Windows (npx)
 
-Node.js 22.18 이상이 있으면 설치 없이 실행합니다. 데이터는 사용자 폴더(macOS `~/Library/Application Support/Skill Finder`, Linux `~/.local/share/skill-finder`, Windows `%LOCALAPPDATA%\SkillFinder\npx-data`)에 남습니다.
+Node.js 22.20 이상이 있으면 설치 없이 실행합니다. 데이터는 사용자 폴더(macOS `~/Library/Application Support/Skill Finder`, Linux `~/.local/share/skill-finder`, Windows `%LOCALAPPDATA%\SkillFinder\npx-data`)에 남습니다.
 
 ```bash
 npx @seojin08/skill-finder
@@ -45,7 +45,7 @@ npx @seojin08/skill-finder stop               # 백그라운드로 켠 앱 끄
 
 ### 소스에서
 
-필요한 것: Node.js 22.18 이상(24 권장), git, Claude Code(`claude` 명령).
+필요한 것: Node.js 22.20 이상(24 권장), git, Claude Code(`claude` 명령).
 
 ```bash
 npm install

package/bin/skill-finder.mjs

@@ -34,7 +34,7 @@ const T = {
 
 공통: --json(기계가 읽는 출력), --port N, --no-open, --lang ko|en|ja
 설치·삭제는 앱 화면의 확인 창에서만 합니다.`,
-    node: (v) => `Node.js ${v}는 너무 오래됐습니다. 22.18 이상이 필요합니다: https://nodejs.org`,
+    node: (v) => `Node.js ${v}는 너무 오래됐습니다. 22.20 이상이 필요합니다: https://nodejs.org`,
     noWeb: '웹 화면이 빌드되지 않았습니다. 먼저 npm run build를 실행하세요.',
     starting: (p) => `Skill Finder를 켜는 중입니다 (127.0.0.1:${p})…`,
     background: (p) => `Skill Finder를 백그라운드로 켰습니다 (127.0.0.1:${p}). 끄려면: skill-finder stop`,
@@ -70,7 +70,7 @@ Usage:
 
 Common: --json (machine-readable), --port N, --no-open, --lang ko|en|ja
 Installing and removing happen only in the app's confirm dialog.`,
-    node: (v) => `Node.js ${v} is too old. 22.18 or later is needed: https://nodejs.org`,
+    node: (v) => `Node.js ${v} is too old. 22.20 or later is needed: https://nodejs.org`,
     noWeb: 'The web app is not built. Run npm run build first.',
     starting: (p) => `Starting Skill Finder (127.0.0.1:${p})…`,
     background: (p) => `Started Skill Finder in the background (127.0.0.1:${p}). To stop it: skill-finder stop`,
@@ -106,7 +106,7 @@ Installing and removing happen only in the app's confirm dialog.`,
 
 共通: --json(機械向け出力), --port N, --no-open, --lang ko|en|ja
 インストールと削除はアプリの確認画面でのみ行います。`,
-    node: (v) => `Node.js ${v} は古すぎます。22.18 以上が必要です: https://nodejs.org`,
+    node: (v) => `Node.js ${v} は古すぎます。22.20 以上が必要です: https://nodejs.org`,
     noWeb: 'Web 画面がビルドされていません。先に npm run build を実行してください。',
     starting: (p) => `Skill Finder を起動しています (127.0.0.1:${p})…`,
     background: (p) => `Skill Finder をバックグラウンドで起動しました (127.0.0.1:${p})。止めるには: skill-finder stop`,
@@ -204,7 +204,7 @@ function readPid() {
 /** Starts the server: in this terminal (`start`), or detached for the read commands. Resolves its port. */
 async function startServer(background) {
   const [major, minor] = process.versions.node.split('.').map(Number);
-  if (major < 22 || (major === 22 && minor < 18)) throw new Error(t.node(process.versions.node));
+  if (major < 22 || (major === 22 && minor < 20)) throw new Error(t.node(process.versions.node));
   if (!existsSync(join(ROOT, 'web', 'dist', 'index.html'))) throw new Error(t.noWeb);
   let port = Number(portArg) || Number(process.env.PORT) || DEFAULT_PORT;
   if (!(await portFree(port))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seojin08/skill-finder",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Find Claude Code skills across marketplaces, skills.sh and GitHub, see their risk signals, and install them after checking what comes along. Local web app and read-only CLI.",
   "license": "MIT",
   "type": "module",
@@ -8,11 +8,11 @@
     "skill-finder": "bin/skill-finder.mjs"
   },
   "engines": {
-    "node": ">=22.18"
+    "node": ">=22.20"
   },
   "dependencies": {
     "express": "5.3.0",
-    "skills": "1.7.4",
+    "skills": "1.7.6",
     "yaml": "2.9.1",
     "zod": "4.6.7"
   },
@@ -33,6 +33,7 @@
     "bin",
     "server",
     "web/dist",
+    "seed-index.json.gz",
     "README.md",
     "LICENSE",
     "CHANGELOG.md",

package/server/src/app.js

@@ -10,6 +10,7 @@ import { favoritesRouter } from "./routes/favorites.js";
 import { recommendRouter } from "./routes/recommend.js";
 import { searchRouter } from "./routes/search.js";
 import { skillsRouter } from "./routes/skills.js";
+import { translateFiles, translateRouter } from "./routes/translate.js";
 import { CSP, securityMiddleware } from "./security.js";
 export function createApp(ctx, opts = {}) {
     const app = express();
@@ -27,12 +28,14 @@ export function createApp(ctx, opts = {}) {
     app.use('/api', favoritesRouter(ctx));
     app.use('/api', recommendRouter(ctx));
     app.use('/api', adminRouter(ctx));
+    app.use('/api', translateRouter(ctx));
     // any other /api path, in any case (/API/... is not an API route and not a page either)
     app.use((req, res, next) => {
         if (!req.path.toLowerCase().startsWith('/api'))
             return next();
         res.status(404).json({ error: '없는 API 주소입니다' });
     });
+    app.use(translateFiles(ctx));
     if (existsSync(WEB_DIST_DIR)) {
         app.use((_req, res, next) => {
             res.setHeader('Content-Security-Policy', CSP);

package/server/src/bootstrap.js

@@ -6,13 +6,14 @@ import { Indexer } from "./indexer.js";
 import { Jobs } from "./jobs.js";
 import { seedMarketplaces } from "./settings.js";
 import { GitHub } from "./sources/github.js";
+import { TranslateModels } from "./translate/models.js";
 import { APP_VERSION } from "./version.js";
 export function createContext(config, dbPath = join(config.dataDir, 'skill-finder.db')) {
     const store = new Store(openDb(dbPath, { backupLabel: dbPath === ':memory:' ? null : APP_VERSION }));
     seedMarketplaces(store);
     const github = new GitHub(store, config);
     const indexer = new Indexer(store, github);
-    return { config, store, github, indexer, jobs: new Jobs() };
+    return { config, store, github, indexer, jobs: new Jobs(), translateModels: new TranslateModels(join(config.dataDir, 'translate-models')) };
 }
 /**
  * createContext for the server: a damaged database file (project review #4) is moved aside and the newest backup

package/server/src/config.js

@@ -7,19 +7,31 @@ export const SERVER_DIR = join(ROOT_DIR, 'server');
 export const WEB_DIST_DIR = join(ROOT_DIR, 'web', 'dist');
 /** The release launcher keeps the token outside the app folder (UI debate D-6); from the environment only. */
 export const ENV_PATH = process.env.SKILL_FINDER_ENV_PATH ? resolve(process.env.SKILL_FINDER_ENV_PATH) : join(ROOT_DIR, '.env');
-export const SKILLS_CLI_VERSION = '1.7.4';
 /** The bundled skills CLI: under the app, or wherever npm put it when installed as a package (npx hoists it). */
-export const SKILLS_CLI_PATH = (() => {
-    const local = join(ROOT_DIR, 'node_modules', 'skills', 'bin', 'cli.mjs');
+const SKILLS_DIR = (() => {
+    const local = join(ROOT_DIR, 'node_modules', 'skills');
     if (existsSync(local))
         return local;
     try {
-        return join(dirname(createRequire(import.meta.url).resolve('skills/package.json')), 'bin', 'cli.mjs');
+        return dirname(createRequire(import.meta.url).resolve('skills/package.json'));
     }
     catch {
         return local;
     }
 })();
+export const SKILLS_CLI_PATH = join(SKILLS_DIR, 'bin', 'cli.mjs');
+/**
+ * The version the app runs, read from the bundled package so the commands it shows for running by hand name the same
+ * one (it was written here by hand and could fall behind the package, review 2026-11-03).
+ */
+export const SKILLS_CLI_VERSION = (() => {
+    try {
+        return String(JSON.parse(readFileSync(join(SKILLS_DIR, 'package.json'), 'utf8')).version);
+    }
+    catch {
+        return 'latest'; // no bundled CLI: installing fails anyway, and the shown command still runs
+    }
+})();
 /** Vite dev server port (web/vite.config.ts); allowed as a Host/Origin in --dev mode only. */
 export const DEV_VITE_PORT = 5174;
 function parseEnvFile(text) {

package/server/src/db/schema.js

@@ -92,4 +92,7 @@ export const MIGRATIONS = [
   ALTER TABLE favorites_local RENAME TO favorites;
   DELETE FROM settings WHERE key = 'sessionKey';
   `,
+    // Favorite GitHub repositories (user request 2026-11-03) are `repo:owner/name` rows; the description and topics the
+    // search showed are kept with them, since the index has neither.
+    `ALTER TABLE favorites ADD COLUMN meta_json TEXT;`,
 ];

package/server/src/db/seed.js

@@ -0,0 +1,89 @@
+// A prebuilt index shipped with a release (first-run speed, 2026-11-03): the default marketplaces' plugins, their
+// skills and the star counts of the repos they come from, taken from the index the release was built with. Nothing
+// a user searched for, set, starred or installed is in it. A new install puts it into its empty database at
+// startup, so the first searches need not wait ~20 minutes for 2,600 plugins to be read from GitHub (without a
+// token); the normal sync then reads only what changed since.
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { DatabaseSync } from 'node:sqlite';
+import { join, resolve } from 'node:path';
+import { gunzipSync, gzipSync } from 'node:zlib';
+import { ROOT_DIR } from "../config.js";
+import { RISK_RULES_VERSION } from "../analyze/risk.js";
+import { pluginFtsText } from "../indexer.js";
+import { DEFAULT_MARKETPLACES } from "../settings.js";
+const FORMAT = 1;
+/** Next to server/ and web/ in a release (the package scripts write it); a checkout has none. */
+export const SEED_PATH = process.env.SKILL_FINDER_SEED_PATH ? resolve(process.env.SKILL_FINDER_SEED_PATH) : join(ROOT_DIR, 'seed-index.json.gz');
+/** Plugin errors kept in the seed: the lasting verdicts the app shows. Others are retried anyway and may name local paths. */
+const lastingError = (e) => (e && /^(설치 불가:|GitHub 외 출처)/.test(e) ? e : null);
+/** The marketplaces a new install has on: one turned on later on the building PC would be searched though off. */
+export function exportSeed(db, now = new Date()) {
+    const all = (sql, ...args) => db.prepare(sql).all(...args).map((r) => ({ ...r }));
+    const marketplaces = DEFAULT_MARKETPLACES.filter((d) => d.enabled).flatMap((d) => all('SELECT name, repo, commit_sha, etag, plugin_count FROM marketplaces WHERE name = ? AND repo = ? AND commit_sha IS NOT NULL', d.name, d.repo));
+    const names = JSON.stringify(marketplaces.map((m) => m.name));
+    const ofSeed = 'SELECT id FROM plugins WHERE marketplace IN (SELECT value FROM json_each(?))';
+    const plugins = all(`SELECT * FROM plugins WHERE id IN (${ofSeed}) ORDER BY id`, names).map((p) => ({ ...p, error: lastingError(p.error) }));
+    const skills = all(`SELECT * FROM skills WHERE origin = 'plugin' AND plugin_id IN (${ofSeed}) ORDER BY id`, names);
+    const repos = all(`SELECT * FROM repos WHERE lower(full_name) IN (
+       SELECT lower(repo) FROM plugins WHERE id IN (${ofSeed}) AND repo IS NOT NULL
+       UNION SELECT lower(repo) FROM skills WHERE origin = 'plugin' AND plugin_id IN (${ofSeed}) AND repo IS NOT NULL)
+     ORDER BY full_name`, names, names);
+    return { format: FORMAT, createdAt: now.toISOString(), marketplaces, plugins, skills, repos };
+}
+/**
+ * Writes the seed of the database at `dbPath` as gzip JSON: read-only and in one read transaction, so a running app
+ * may hold it and a sync it is doing meanwhile does not split plugins from their skills. Refuses an index that would
+ * undo the point: empty, or checked with older risk rules (every install would download all SKILL.md files again).
+ */
+export function writeSeedFile(dbPath, outPath) {
+    const db = new DatabaseSync(dbPath, { readOnly: true });
+    try {
+        db.exec('BEGIN');
+        const seed = exportSeed(db);
+        db.exec('COMMIT');
+        if (seed.plugins.length === 0 || seed.skills.length === 0)
+            throw new Error('색인에 기본 마켓플레이스의 스킬이 없습니다. 앱으로 한 번 동기화한 뒤 만드세요');
+        const old = seed.skills.filter((s) => s.risk_rules != null && s.risk_rules < RISK_RULES_VERSION).length;
+        if (old > 0)
+            throw new Error(`스킬 ${old}개가 옛 위험 규칙으로 검사돼 있습니다. 앱을 실행해 다시 검사가 끝난 뒤 만드세요`);
+        const gz = gzipSync(JSON.stringify(seed), { level: 9 });
+        writeFileSync(outPath, gz);
+        return { plugins: seed.plugins.length, skills: seed.skills.length, repos: seed.repos.length, bytes: gz.length };
+    }
+    finally {
+        db.close();
+    }
+}
+/**
+ * Puts the seed at `path` into a database with no plugins and no skills yet (a new install); does nothing otherwise
+ * or without the file. Marketplaces whose repo differs from the seed's are left to the sync. Star counts are dated
+ * when the seed was made, so searches stop trusting them a week after the release as they would any other count.
+ */
+export function importSeed(store, path) {
+    if (!existsSync(path) || store.countPlugins() > 0 || store.countSkills() > 0)
+        return null;
+    const seed = JSON.parse(gunzipSync(readFileSync(path)).toString('utf8'));
+    if (seed.format !== FORMAT)
+        throw new Error(`알 수 없는 색인 형식 ${seed.format}`);
+    const local = new Map(store.listMarketplaces().map((m) => [m.name, m.repo]));
+    const marketplaces = seed.marketplaces.filter((m) => local.get(m.name) === m.repo);
+    const names = new Set(marketplaces.map((m) => m.name));
+    const plugins = new Map(seed.plugins.filter((p) => names.has(p.marketplace)).map((p) => [p.id, p]));
+    const skills = seed.skills.filter((s) => s.plugin_id && plugins.has(s.plugin_id));
+    // never later than the counts themselves (the building PC refreshes them every 6 hours)
+    const madeAt = seed.createdAt;
+    store.transaction(() => {
+        for (const m of marketplaces)
+            store.updateMarketplaceSync(m.name, { etag: m.etag, plugin_count: m.plugin_count ?? undefined, commit_sha: m.commit_sha });
+        for (const p of plugins.values()) {
+            store.upsertPlugin(p);
+            if (p.skills_indexed_at)
+                store.markPluginIndexed(p.id, p.skills_indexed_sha, p.signals_json ? JSON.parse(p.signals_json) : null, p.error);
+        }
+        for (const s of skills)
+            store.upsertSkill(s, pluginFtsText(plugins.get(s.plugin_id)));
+        for (const r of seed.repos)
+            store.upsertRepo({ ...r, fetched_at: r.fetched_at && r.fetched_at < madeAt ? r.fetched_at : madeAt });
+    });
+    return { plugins: plugins.size, skills: skills.length, repos: seed.repos.length };
+}

package/server/src/db/store.js

@@ -316,15 +316,16 @@ export class Store {
             .slice(0, limit);
     }
     // ── favorites: this PC's, no accounts (user decision 2026-11-02) ──
-    addFavorite(skillId, skillName) {
-        this.run('INSERT INTO favorites (skill_id, skill_name, created_at) VALUES (?, ?, ?) ON CONFLICT DO NOTHING', skillId, skillName, now());
+    /** `meta`: what a repository favorite shows beyond its name (description, topics). */
+    addFavorite(skillId, skillName, meta = null) {
+        this.run('INSERT INTO favorites (skill_id, skill_name, created_at, meta_json) VALUES (?, ?, ?, ?) ON CONFLICT DO NOTHING', skillId, skillName, now(), meta == null ? null : JSON.stringify(meta));
     }
     removeFavorite(skillId) {
         this.run('DELETE FROM favorites WHERE skill_id = ?', skillId);
     }
     /** Newest first. */
     listFavorites() {
-        return this.all('SELECT skill_id, skill_name, created_at FROM favorites ORDER BY created_at DESC, rowid DESC');
+        return this.all('SELECT skill_id, skill_name, created_at, meta_json FROM favorites ORDER BY created_at DESC, rowid DESC');
     }
     /** Skills the app installed into a skills folder (skills CLI), newest first, to match those folders to the index. */
     listInstalledSkillLog() {

package/server/src/discovery/genericRules.js

@@ -1,5 +1,7 @@
 import { basename, joinPath, skillMdPath } from "./tree.js";
-// Mirrors skills CLI 1.7.4 src/skills.ts (discoverSkills) so that what we list is what `skills add --skill` can install.
+// Mirrors skills CLI 1.7.6 src/skills.ts (discoverSkills) so that what we list is what `skills add --skill` can install.
+// Unchanged since 1.7.4 except two things not mirrored: extra search dirs a repo can list in skills.sh.json (`paths`),
+// and skipping a skill whose name or description is empty once control characters are removed.
 export const SKIP_DIRS = ['node_modules', '.git', 'dist', 'build', '__pycache__'];
 export const AGENT_PROJECT_SKILL_DIRS = [
     '.agents/skills',

package/server/src/index.js

@@ -2,6 +2,7 @@ import { config, ensureDataDirs } from "./config.js";
 import { createApp } from "./app.js";
 import { openContext } from "./bootstrap.js";
 import { DataTooNewError } from "./db/index.js";
+import { importSeed, SEED_PATH } from "./db/seed.js";
 import { startUpdateChecks } from "./update.js";
 import { startLogFile } from "./util/log.js";
 import { pruneSearchLog, recheckRiskRules, refreshRepoMeta, relevelRisk, REPO_META_EVERY_MS, startSync } from "./tasks.js";
@@ -26,6 +27,16 @@ const ctx = (() => {
         process.exit(1);
     }
 })();
+// A new install starts from the index shipped with the release instead of an empty one; any problem only costs speed.
+try {
+    const t0 = Date.now();
+    const seeded = importSeed(ctx.store, SEED_PATH);
+    if (seeded)
+        console.log(`[seed] 미리 만든 색인을 넣었습니다: 스킬 ${seeded.skills}개, 플러그인 ${seeded.plugins}개, 저장소 ${seeded.repos}개 (${((Date.now() - t0) / 1000).toFixed(1)}초)`);
+}
+catch (err) {
+    console.warn('[seed] 미리 만든 색인을 넣지 못해 GitHub에서 처음부터 모읍니다:', String(err.message ?? err).slice(0, 200));
+}
 const app = createApp(ctx);
 // Express' listen(port) binds 0.0.0.0; always pass the loopback host explicitly.
 const server = app.listen(config.port, HOST, () => {

package/server/src/indexer.js

@@ -6,6 +6,7 @@ import { discoverRepo, parseJsonObject, PLUGIN_JSON } from "./discovery/classify
 import { genericAcceptor } from "./discovery/genericRules.js";
 import { discoverPluginSkills } from "./discovery/pluginRules.js";
 import { basename, joinPath, skillMdPath, TreeIndex } from "./discovery/tree.js";
+import { RepoUnreachableError } from "./sources/gitTree.js";
 import { RAW_MAX_BYTES } from "./sources/github.js";
 import { normalizeSource, resolveRelativeRoot } from "./sources/pluginSource.js";
 import { pool } from "./util/limiter.js";
@@ -280,7 +281,10 @@ export class Indexer {
         const path = msg.match(/^플러그인 경로가 없습니다: (.*)$/);
         if (path)
             return `마켓플레이스가 가리키는 폴더가 저장소에 없습니다 (${path[1]})`;
-        if (/^tree 422|^tree 409/.test(msg))
+        if (err instanceof RepoUnreachableError)
+            return '저장소가 삭제됐거나 비공개입니다';
+        // "not our ref": git's answer for a pinned commit no branch holds any more (the tree API says 422)
+        if (/^tree 422|^tree 409|not our ref/.test(msg))
             return '마켓플레이스가 고정한 커밋이 저장소 기록에서 지워졌습니다';
         if (/^tree 404|커밋을 찾을 수 없습니다/.test(msg)) {
             const exists = await this.github.repoExists(repo);

package/server/src/install/installed.js

@@ -1,9 +1,9 @@
 // What is installed on this PC and how it matches the index (UI debate stage 3: shown only, nothing is run).
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
-import { readdir, readFile } from 'node:fs/promises';
+import { readdir, readFile, realpath } from 'node:fs/promises';
 import { homedir } from 'node:os';
-import { join, posix } from 'node:path';
+import { basename, join, posix, resolve, sep } from 'node:path';
 import { extractSkillMeta } from "../analyze/frontmatter.js";
 import { riskLevel, skillRiskFlags } from "../analyze/risk.js";
 import { runClaude } from "../claude/cli.js";
@@ -56,7 +56,7 @@ function readLock(file) {
     }
     return byFolder;
 }
-/** The folder the skills CLI installs a skill into (its `sanitizeName`, skills@1.7.4). */
+/** The folder the skills CLI installs a skill into (its `sanitizeName`, the same in skills@1.7.4 and 1.7.6). */
 export function skillFolderName(name) {
     return name.toLowerCase().replace(/[^a-z0-9._]+/g, '-').replace(/^[.\-]+|[.\-]+$/g, '').slice(0, 255) || 'unnamed-skill';
 }
@@ -89,36 +89,106 @@ export async function scanInstalledSkills(store, scope, projectPath, onlyFolder)
         if (onlyFolder && folder.toLowerCase() !== onlyFolder.toLowerCase())
             continue;
         const path = join(dir, folder);
-        let raw;
-        try {
-            raw = await readFile(join(path, 'SKILL.md'), 'utf8');
-        }
-        catch {
+        const hit = await inspectSkill(store, path, folder, (name) => {
+            const log = logged.get(name.toLowerCase()) ?? logged.get(folder.toLowerCase());
+            const fromLock = lock.get(folder.toLowerCase());
+            const id = (fromLock && store.getSkill(fromLock)?.id) || (log && store.getSkill(log.id) ? log.id : null);
+            return { id: id || null, installedRisk: log && log.id === id ? log.risk : null };
+        });
+        if (!hit)
             continue; // not a skill folder
-        }
-        const meta = extractSkillMeta(raw, folder);
-        const hash = mdHash(raw);
-        const log = logged.get(meta.name.toLowerCase()) ?? logged.get(folder.toLowerCase());
-        const fromLock = lock.get(folder.toLowerCase());
-        const skillId = (fromLock && store.getSkill(fromLock)?.id) || (log && store.getSkill(log.id) ? log.id : null) || store.findSkillIdByMdSha(hash);
-        const indexed = skillId ? store.getSkill(skillId) : undefined;
-        const flags = skillRiskFlags({ files: await listFiles(path), allowedTools: meta.allowedTools, body: meta.body, hasHooks: meta.hasHooks, raw });
         out.push({
+            ...hit,
             scope,
-            path,
-            folder,
-            name: meta.name,
-            description: truncate(meta.description, 200),
             removeCommand: `npx skills@${SKILLS_CLI_VERSION} remove ${/\s/.test(folder) ? `"${folder}"` : folder} -a claude-code -y${scope === 'user' ? ' -g' : ''}`,
-            skillId,
-            risk: { level: riskLevel(flags), flags },
-            installedRisk: (log?.id === skillId ? log?.risk : null) ?? null,
-            change: !indexed?.skill_md_sha256 ? 'unknown' : indexed.skill_md_sha256 === hash ? 'same' : 'changed',
-            tokens: skillTokens(meta.name, meta.description, raw),
         });
     }
     return out;
 }
+/**
+ * One skill folder as installed: its SKILL.md, the current risk rules run on its files, and its index row — the one
+ * `known` names (lock file, install log, plugin), else an indexed copy of the same SKILL.md. Null without a SKILL.md.
+ */
+async function inspectSkill(store, path, folder, known) {
+    let raw;
+    try {
+        raw = await readFile(join(path, 'SKILL.md'), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const meta = extractSkillMeta(raw, folder);
+    const hash = mdHash(raw);
+    const { id, installedRisk } = known(meta.name);
+    const skillId = id ?? store.findSkillIdByMdSha(hash);
+    const indexed = skillId ? store.getSkill(skillId) : undefined;
+    const flags = skillRiskFlags({ files: await listFiles(path), allowedTools: meta.allowedTools, body: meta.body, hasHooks: meta.hasHooks, raw });
+    return {
+        path,
+        folder,
+        name: meta.name,
+        description: truncate(meta.description, 200),
+        skillId,
+        risk: { level: riskLevel(flags), flags },
+        installedRisk: id && id === skillId ? installedRisk : null,
+        change: !indexed?.skill_md_sha256 ? 'unknown' : indexed.skill_md_sha256 === hash ? 'same' : 'changed',
+        tokens: skillTokens(meta.name, meta.description, raw),
+    };
+}
+/**
+ * The skills inside an installed plugin, read from its install folder (user report 2026-11-04: the 설치됨 screen
+ * listed a plugin's skills only when the index knew them, folded away, so a project's skills looked incomplete).
+ * Claude Code reads the plugin's `skills/` folder plus the `skills` path(s) of `.claude-plugin/plugin.json`; each
+ * path is a skill folder or a folder of them, and must stay inside the install folder.
+ */
+export async function scanPluginSkills(store, plugin) {
+    if (typeof plugin.installPath !== 'string' || !plugin.installPath)
+        return [];
+    const root = resolve(plugin.installPath);
+    let declared;
+    try {
+        declared = JSON.parse(await readFile(join(root, '.claude-plugin', 'plugin.json'), 'utf8')).skills;
+    }
+    catch {
+        // no manifest: the default folder only
+    }
+    const paths = ['skills', ...(typeof declared === 'string' ? [declared] : Array.isArray(declared) ? declared.filter((p) => typeof p === 'string') : [])];
+    const candidates = [];
+    for (const p of paths) {
+        const dir = resolve(root, p);
+        if (existsSync(join(dir, 'SKILL.md'))) {
+            candidates.push(dir);
+            continue;
+        }
+        try {
+            for (const e of await readdir(dir, { withFileTypes: true }))
+                if (e.isDirectory() || e.isSymbolicLink())
+                    candidates.push(join(dir, e.name));
+        }
+        catch {
+            // no such folder
+        }
+    }
+    // a path or a link leading out of the plugin is not read: compared by where it really is
+    const realRoot = await realpath(root).catch(() => null);
+    if (!realRoot)
+        return [];
+    const dirs = new Set();
+    for (const dir of candidates) {
+        const real = await realpath(dir).catch(() => null);
+        if (real && (real === realRoot || real.startsWith(realRoot + sep)))
+            dirs.add(dir);
+    }
+    const indexedByName = new Map(pluginSkills(store, plugin.id).map((s) => [s.name.toLowerCase(), s.id]));
+    const out = [];
+    for (const path of [...dirs].sort()) {
+        const folder = basename(path);
+        const hit = await inspectSkill(store, path, folder, (name) => ({ id: indexedByName.get(name.toLowerCase()) ?? indexedByName.get(folder.toLowerCase()) ?? null, installedRisk: null }));
+        if (hit)
+            out.push({ ...hit, scope: plugin.scope === 'project' || plugin.scope === 'local' ? 'project' : 'user', plugin: { id: plugin.id, scope: plugin.scope, enabled: plugin.enabled } });
+    }
+    return out;
+}
 export async function existingSkillFolder(store, skillId, skillName, scope, projectPath) {
     const folder = skillFolderName(skillName);
     const path = join(scope === 'user' ? homedir() : projectPath, '.claude', 'skills', folder);
@@ -181,7 +251,7 @@ export function installedPluginCommits() {
     return out;
 }
 /** Windows paths compared as Claude Code writes them: backslashes, no trailing one, any case. */
-const pathKey = (p) => p.replace(/\//g, '\\').replace(/\\+$/, '').toLowerCase();
+export const pathKey = (p) => p.replace(/\//g, '\\').replace(/\\+$/, '').toLowerCase();
 export const pluginCommitKey = (id, scope, projectPath) => `${id}|${scope}|${scope === 'user' ? '' : pathKey(projectPath ?? '')}`;
 /** How a plugin install compares with the index: its skills' top risk and whether it came from the indexed commit. */
 /** The indexed skills a plugin install brought in (its own, or those whose install plan names it), for the 설치됨 screen. */

package/server/src/recommend/readme.js

@@ -150,8 +150,20 @@ function inlineText(s) {
         .replace(/\s+/g, ' ')
         .trim();
 }
+/** Markdown and HTML links with their text: what is left of a row of links ("Docs · Discord · Blog") is its separators. */
+const LINKS = /\[[^[\]]*\]\((?:[^()]|\([^()]*\))*\)|\[[^[\]]*\]\[[^[\]]*\]|<a\b[^<>]*>[^<]*<\/a>/gi;
 /**
- * Title (first H1, else the folder name), intro (first paragraph of 20+ chars), features (first list under a
+ * A paragraph that reads as a sentence, for the summary's intro: mostly letters (not a row of symbols) and 20+
+ * characters without its links' text (not a navigation row). Others still count as body text.
+ */
+function isProse(raw, text) {
+    const letters = text.match(/\p{L}/gu)?.length ?? 0;
+    if (letters < text.replace(/\s/g, '').length * 0.6)
+        return false;
+    return inlineText(raw.replace(LINKS, ' ')).length >= CONFIG.minParagraphChars;
+}
+/**
+ * Title (first H1, else the folder name), intro (first paragraph of 20+ chars that reads as prose), features (first list under a
  * "feature/기능/특징" heading, up to 5), other headings, body text and code-block languages. Code itself is
  * dropped: README code and badges otherwise dominate any word statistics.
  */
@@ -166,7 +178,7 @@ export function extractReadme(md, fallbackTitle) {
         const text = html ? inlineText(raw.replace(TAG, ' ')) : inlineText(raw);
         if (text.length < CONFIG.minParagraphChars)
             return; // badge rows and short lines
-        if (!out.intro)
+        if (!out.intro && isProse(raw, text))
             out.intro = text;
         else
             out.body.push(text);