add-skill 1.0.11 → 1.0.12

package/README.md

@@ -2,7 +2,9 @@
 
 Install agent skills onto your coding agents from any git repository.
 
-Supports [OpenCode](https://opencode.ai), [Claude Code](https://claude.ai/code), [Codex](https://developers.openai.com/codex), [Cursor](https://cursor.com), [Antigravity](https://antigravity.google), and [Roo Code](https://roocode.com).
+<!-- agent-list:start -->
+Supports **Opencode**, **Claude Code**, **Codex**, **Cursor**, and [11 more](#available-agents).
+<!-- agent-list:end -->
 
 ## Quick Start
 
@@ -47,7 +49,7 @@ npx add-skill git@github.com:vercel-labs/agent-skills.git
 | Option | Description |
 |--------|-------------|
 | `-g, --global` | Install to user directory instead of project |
-| `-a, --agent <agents...>` | Target specific agents: `opencode`, `claude-code`, `codex`, `cursor`, `antigravity` |
+| `-a, --agent <agents...>` | <!-- agent-names:start -->Target specific agents (e.g., `claude-code`, `codex`). See [Available Agents](#available-agents)<!-- agent-names:end --> |
 | `-s, --skill <skills...>` | Install specific skills by name |
 | `-l, --list` | List available skills without installing |
 | `-y, --yes` | Skip all confirmation prompts |
@@ -73,35 +75,29 @@ npx add-skill vercel-labs/agent-skills --skill frontend-design -g -a claude-code
 npx add-skill vercel-labs/agent-skills -y -g
 ```
 
-## Installation Paths
-
-Skills are installed to different locations depending on the agent and scope:
-
-### Project-level (default)
-
-Installed in your current working directory. Commit these to share with your team.
-
-| Agent | Path |
-|-------|------|
-| OpenCode | `.opencode/skill/<name>/` |
-| Claude Code | `.claude/skills/<name>/` |
-| Codex | `.codex/skills/<name>/` |
-| Cursor | `.cursor/skills/<name>/` |
-| Antigravity | `.agent/skills/<name>/` |
-| Roo Code | `.roo/skills/<name>/` |
-
-### Global (`--global`)
-
-Installed in your home directory. Available across all projects.
-
-| Agent | Path |
-|-------|------|
-| OpenCode | `~/.config/opencode/skill/<name>/` |
-| Claude Code | `~/.claude/skills/<name>/` |
-| Codex | `~/.codex/skills/<name>/` |
-| Cursor | `~/.cursor/skills/<name>/` |
-| Antigravity | `~/.gemini/antigravity/skills/<name>/` |
-| Roo Code | `~/.roo/skills/<name>/` |
+## Available Agents
+
+Skills can be installed to any of these supported agents. Use `-g, --global` to install to the global path instead of project-level.
+
+<!-- available-agents:start -->
+| Agent | Project Path | Global Path |
+|-------|--------------|-------------|
+| OpenCode | `.opencode/skill/` | `~/.config/opencode/skill/` |
+| Claude Code | `.claude/skills/` | `~/.claude/skills/` |
+| Codex | `.codex/skills/` | `~/.codex/skills/` |
+| Cursor | `.cursor/skills/` | `~/.cursor/skills/` |
+| Amp | `.agents/skills/` | `~/.config/agents/skills/` |
+| Kilo Code | `.kilocode/skills/` | `~/.kilocode/skills/` |
+| Roo Code | `.roo/skills/` | `~/.roo/skills/` |
+| Goose | `.goose/skills/` | `~/.config/goose/skills/` |
+| Gemini CLI | `.gemini/skills/` | `~/.gemini/skills/` |
+| Antigravity | `.agent/skills/` | `~/.gemini/antigravity/skills/` |
+| GitHub Copilot | `.github/skills/` | `~/.copilot/skills/` |
+| Clawdbot | `skills/` | `~/.clawdbot/skills/` |
+| Droid | `.factory/skills/` | `~/.factory/skills/` |
+| Gemini CLI | `.gemini/skills/` | `~/.gemini/skills/` |
+| Windsurf | `.windsurf/skills/` | `~/.codeium/windsurf/skills/` |
+<!-- available-agents:end -->
 
 ## Agent Detection
 
@@ -140,16 +136,27 @@ Describe the scenarios where this skill should be used.
 
 The CLI searches for skills in these locations within a repository:
 
+<!-- skill-discovery:start -->
 - Root directory (if it contains `SKILL.md`)
 - `skills/`
 - `skills/.curated/`
 - `skills/.experimental/`
 - `skills/.system/`
-- `.codex/skills/`
-- `.claude/skills/`
 - `.opencode/skill/`
+- `.claude/skills/`
+- `.codex/skills/`
 - `.cursor/skills/`
+- `.agents/skills/`
+- `.kilocode/skills/`
+- `.roo/skills/`
+- `.goose/skills/`
+- `.gemini/skills/`
 - `.agent/skills/`
+- `.github/skills/`
+- `./skills/`
+- `.factory/skills/`
+- `.windsurf/skills/`
+<!-- skill-discovery:end -->
 
 If no skills are found in standard locations, a recursive search is performed.
 
@@ -157,12 +164,12 @@ If no skills are found in standard locations, a recursive search is performed.
 
 Skills are generally compatible across agents since they follow a shared [Agent Skills specification](https://agentskills.io). However, some features may be agent-specific:
 
-| Feature | OpenCode | Claude Code | Codex | Cursor | Antigravity | Roo Code |
-|---------|----------|-------------|-------|--------|-------------|----------|
-| Basic skills | Yes | Yes | Yes | Yes | Yes | Yes |
-| `allowed-tools` | Yes | Yes | Yes | Yes | Yes | Yes |
-| `context: fork` | No | Yes | No | No | No | No |
-| Hooks | No | Yes | No | No | No | No |
+| Feature | OpenCode | Claude Code | Codex | Cursor | Antigravity | Roo Code | Github Copilot | Amp | Clawdbot |
+|---------|----------|-------------|-------|--------|-------------|----------|----------------|-----|----------|
+| Basic skills | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
+| `allowed-tools` | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
+| `context: fork` | No | Yes | No | No | No | No | No | No | No |
+| Hooks | No | Yes | No | No | No | No | No | No | No |
 
 ## Troubleshooting
 
@@ -188,8 +195,12 @@ Ensure you have write access to the target directory.
 - [Claude Code Skills Documentation](https://code.claude.com/docs/en/skills)
 - [Codex Skills Documentation](https://developers.openai.com/codex/skills)
 - [Cursor Skills Documentation](https://cursor.com/docs/context/skills)
+- [Gemini CLI Skills Documentation](https://geminicli.com/docs/cli/skills/)
+- [Amp Skills Documentation](https://ampcode.com/manual#agent-skills)
 - [Antigravity Skills Documentation](https://antigravity.google/docs/skills)
+- [GitHub Copilot Agent Skills](https://docs.github.com/en/copilot/concepts/agents/about-agent-skills)
 - [Roo Code Skills Documentation](https://docs.roocode.com/features/skills)
+- [Clawdbot Skills Documentation](https://docs.clawd.bot/tools/skills)
 
 ## License
 

package/dist/index.js

@@ -7,7 +7,7 @@ import chalk from "chalk";
 
 // src/git.ts
 import simpleGit from "simple-git";
-import { join } from "path";
+import { join, normalize, resolve, sep } from "path";
 import { mkdtemp, rm } from "fs/promises";
 import { tmpdir } from "os";
 function parseSource(input) {
@@ -72,6 +72,11 @@ async function cloneRepo(url) {
   return tempDir;
 }
 async function cleanupTempDir(dir) {
+  const normalizedDir = normalize(resolve(dir));
+  const normalizedTmpDir = normalize(resolve(tmpdir()));
+  if (!normalizedDir.startsWith(normalizedTmpDir + sep) && normalizedDir !== normalizedTmpDir) {
+    throw new Error("Attempted to clean up directory outside of temp directory");
+  }
   await rm(dir, { recursive: true, force: true });
 }
 
@@ -149,7 +154,8 @@ async function discoverSkills(basePath, subpath) {
     join2(searchPath, ".kilocode/skills"),
     join2(searchPath, ".roo/skills"),
     join2(searchPath, ".goose/skills"),
-    join2(searchPath, ".agent/skills")
+    join2(searchPath, ".agent/skills"),
+    join2(searchPath, ".github/skills")
   ];
   for (const dir of prioritySearchDirs) {
     try {
@@ -187,7 +193,7 @@ function getSkillDisplayName(skill) {
 
 // src/installer.ts
 import { mkdir, cp, access, readdir as readdir2 } from "fs/promises";
-import { join as join4, basename as basename2 } from "path";
+import { join as join4, basename as basename2, normalize as normalize2, resolve as resolve2, sep as sep2 } from "path";
 
 // src/agents.ts
 import { homedir } from "os";
@@ -267,6 +273,15 @@ var agents = {
       return existsSync(join3(home, ".config/goose"));
     }
   },
+  "gemini-cli": {
+    name: "gemini-cli",
+    displayName: "Gemini CLI",
+    skillsDir: ".gemini/skills",
+    globalSkillsDir: join3(home, ".gemini/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(home, ".gemini"));
+    }
+  },
   antigravity: {
     name: "antigravity",
     displayName: "Antigravity",
@@ -275,6 +290,51 @@ var agents = {
     detectInstalled: async () => {
       return existsSync(join3(process.cwd(), ".agent")) || existsSync(join3(home, ".gemini/antigravity"));
     }
+  },
+  "github-copilot": {
+    name: "github-copilot",
+    displayName: "GitHub Copilot",
+    skillsDir: ".github/skills",
+    globalSkillsDir: join3(home, ".copilot/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(process.cwd(), ".github")) || existsSync(join3(home, ".copilot"));
+    }
+  },
+  clawdbot: {
+    name: "clawdbot",
+    displayName: "Clawdbot",
+    skillsDir: "skills",
+    globalSkillsDir: join3(home, ".clawdbot/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(home, ".clawdbot"));
+    }
+  },
+  droid: {
+    name: "droid",
+    displayName: "Droid",
+    skillsDir: ".factory/skills",
+    globalSkillsDir: join3(home, ".factory/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(home, ".factory/skills"));
+    }
+  },
+  gemini: {
+    name: "gemini",
+    displayName: "Gemini CLI",
+    skillsDir: ".gemini/skills",
+    globalSkillsDir: join3(home, ".gemini/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(home, ".gemini"));
+    }
+  },
+  windsurf: {
+    name: "windsurf",
+    displayName: "Windsurf",
+    skillsDir: ".windsurf/skills",
+    globalSkillsDir: join3(home, ".codeium/windsurf/skills"),
+    detectInstalled: async () => {
+      return existsSync(join3(home, ".codeium/windsurf"));
+    }
   }
 };
 async function detectInstalledAgents() {
@@ -288,11 +348,36 @@ async function detectInstalledAgents() {
 }
 
 // src/installer.ts
+function sanitizeName(name) {
+  let sanitized = name.replace(/[\/\\:\0]/g, "");
+  sanitized = sanitized.replace(/^[.\s]+|[.\s]+$/g, "");
+  sanitized = sanitized.replace(/^\.+/, "");
+  if (!sanitized || sanitized.length === 0) {
+    sanitized = "unnamed-skill";
+  }
+  if (sanitized.length > 255) {
+    sanitized = sanitized.substring(0, 255);
+  }
+  return sanitized;
+}
+function isPathSafe(basePath, targetPath) {
+  const normalizedBase = normalize2(resolve2(basePath));
+  const normalizedTarget = normalize2(resolve2(targetPath));
+  return normalizedTarget.startsWith(normalizedBase + sep2) || normalizedTarget === normalizedBase;
+}
 async function installSkillForAgent(skill, agentType, options = {}) {
   const agent = agents[agentType];
-  const skillName = skill.name || basename2(skill.path);
+  const rawSkillName = skill.name || basename2(skill.path);
+  const skillName = sanitizeName(rawSkillName);
   const targetBase = options.global ? agent.globalSkillsDir : join4(options.cwd || process.cwd(), agent.skillsDir);
   const targetDir = join4(targetBase, skillName);
+  if (!isPathSafe(targetBase, targetDir)) {
+    return {
+      success: false,
+      path: targetDir,
+      error: "Invalid skill name: potential path traversal detected"
+    };
+  }
   try {
     await mkdir(targetDir, { recursive: true });
     await copyDirectory(skill.path, targetDir);
@@ -332,8 +417,12 @@ async function copyDirectory(src, dest) {
 }
 async function isSkillInstalled(skillName, agentType, options = {}) {
   const agent = agents[agentType];
+  const sanitized = sanitizeName(skillName);
   const targetBase = options.global ? agent.globalSkillsDir : join4(options.cwd || process.cwd(), agent.skillsDir);
-  const skillDir = join4(targetBase, skillName);
+  const skillDir = join4(targetBase, sanitized);
+  if (!isPathSafe(targetBase, skillDir)) {
+    return false;
+  }
   try {
     await access(skillDir);
     return true;
@@ -343,8 +432,13 @@ async function isSkillInstalled(skillName, agentType, options = {}) {
 }
 function getInstallPath(skillName, agentType, options = {}) {
   const agent = agents[agentType];
+  const sanitized = sanitizeName(skillName);
   const targetBase = options.global ? agent.globalSkillsDir : join4(options.cwd || process.cwd(), agent.skillsDir);
-  return join4(targetBase, skillName);
+  const installPath = join4(targetBase, sanitized);
+  if (!isPathSafe(targetBase, installPath)) {
+    throw new Error("Invalid skill name: potential path traversal detected");
+  }
+  return installPath;
 }
 
 // src/telemetry.ts
@@ -383,7 +477,7 @@ function track(data) {
 // package.json
 var package_default = {
   name: "add-skill",
-  version: "1.0.11",
+  version: "1.0.12",
   description: "Install agent skills onto coding agents (OpenCode, Claude Code, Codex, Cursor)",
   type: "module",
   bin: {
@@ -396,7 +490,8 @@ var package_default = {
   scripts: {
     build: "tsup src/index.ts --format esm --dts --clean",
     dev: "tsx src/index.ts",
-    prepublishOnly: "npm run build"
+    prepublishOnly: "npm run build",
+    "update-readme": "tsx scripts/update-readme.ts"
   },
   keywords: [
     "cli",
@@ -405,6 +500,7 @@ var package_default = {
     "claude-code",
     "codex",
     "cursor",
+    "amp",
     "antigravity",
     "roo-code",
     "ai-agents"
@@ -440,7 +536,25 @@ var package_default = {
 // src/index.ts
 var version = package_default.version;
 setVersion(version);
-program.name("add-skill").description("Install skills onto coding agents (OpenCode, Claude Code, Codex, Cursor, Antigravity, Roo Code)").version(version).argument("<source>", "Git repo URL, GitHub shorthand (owner/repo), or direct path to skill").option("-g, --global", "Install skill globally (user-level) instead of project-level").option("-a, --agent <agents...>", "Specify agents to install to (opencode, claude-code, codex, cursor, antigravity, roo)").option("-s, --skill <skills...>", "Specify skill names to install (skip selection prompt)").option("-l, --list", "List available skills in the repository without installing").option("-y, --yes", "Skip confirmation prompts").action(async (source, options) => {
+program.name("add-skill").description("Install skills onto coding agents (OpenCode, Claude Code, Codex, Cursor, Antigravity, Github Copilot, Roo Code)").version(version).argument("<source>", "Git repo URL, GitHub shorthand (owner/repo), or direct path to skill").option("-g, --global", "Install skill globally (user-level) instead of project-level").option("-a, --agent <agents...>", "Specify agents to install to (opencode, claude-code, codex, cursor, antigravity, gitub-copilot, roo)").option("-s, --skill <skills...>", "Specify skill names to install (skip selection prompt)").option("-l, --list", "List available skills in the repository without installing").option("-y, --yes", "Skip confirmation prompts").configureOutput({
+  outputError: (str, write) => {
+    if (str.includes("missing required argument")) {
+      console.log();
+      console.log(chalk.bgRed.white.bold(" ERROR ") + " " + chalk.red("Missing required argument: source"));
+      console.log();
+      console.log(chalk.dim("  Usage:"));
+      console.log(`    ${chalk.cyan("npx add-skill")} ${chalk.yellow("<source>")} ${chalk.dim("[options]")}`);
+      console.log();
+      console.log(chalk.dim("  Example:"));
+      console.log(`    ${chalk.cyan("npx add-skill")} ${chalk.yellow("vercel-labs/agent-skills")}`);
+      console.log();
+      console.log(chalk.dim("  Run") + ` ${chalk.cyan("npx add-skill --help")} ` + chalk.dim("for more information."));
+      console.log();
+    } else {
+      write(str);
+    }
+  }
+}).action(async (source, options) => {
   await main(source, options);
 });
 program.parse();
@@ -521,8 +635,8 @@ async function main(source, options) {
       selectedSkills = selected;
     }
     let targetAgents;
+    const validAgents = Object.keys(agents);
     if (options.agent && options.agent.length > 0) {
-      const validAgents = ["opencode", "claude-code", "codex", "cursor", "antigravity", "roo"];
       const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
       if (invalidAgents.length > 0) {
         p.log.error(`Invalid agents: ${invalidAgents.join(", ")}`);
@@ -537,7 +651,7 @@ async function main(source, options) {
       spinner2.stop(`Detected ${installedAgents.length} agent${installedAgents.length !== 1 ? "s" : ""}`);
       if (installedAgents.length === 0) {
         if (options.yes) {
-          targetAgents = ["opencode", "claude-code", "codex", "cursor", "antigravity", "roo"];
+          targetAgents = validAgents;
           p.log.info("Installing to all agents (none detected)");
         } else {
           p.log.warn("No coding agents detected. You can still install skills.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "add-skill",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "Install agent skills onto coding agents (OpenCode, Claude Code, Codex, Cursor)",
   "type": "module",
   "bin": {
@@ -13,7 +13,8 @@
   "scripts": {
     "build": "tsup src/index.ts --format esm --dts --clean",
     "dev": "tsx src/index.ts",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "update-readme": "tsx scripts/update-readme.ts"
   },
   "keywords": [
     "cli",
@@ -22,6 +23,7 @@
     "claude-code",
     "codex",
     "cursor",
+    "amp",
     "antigravity",
     "roo-code",
     "ai-agents"