agent-skill-manager 2.19.0 → 2.20.1

package/README.md

@@ -200,12 +200,12 @@ asm audit residency --json
 
 The advice assumes this demotion ladder:
 
-| Tier                      | `asm` mechanism                           | Residency                    |
-| ------------------------- | ----------------------------------------- | ---------------------------- |
-| Installed (auto-triggers) | provider directory / `asm activate`       | description resident, always |
-| Saved (adapt, no trigger) | `asm install --library`, `asm deactivate` | none until `asm activate`    |
-| Disabled (kept on disk)   | `asm disable` (reverse with `asm enable`) | none                         |
-| Reference (read on use)   | `asm get` — nothing on disk at all        | none                         |
+| Tier                      | `asm` mechanism                            | Residency                    |
+| ------------------------- | ------------------------------------------ | ---------------------------- |
+| Installed (auto-triggers) | provider directory / `asm activate`        | description resident, always |
+| Saved (adapt, no trigger) | `asm install --library`, `asm deactivate`  | none until `asm activate`    |
+| Disabled (kept on disk)   | `asm disable` (reverse with `asm enable`)  | none                         |
+| Reference (read on use)   | default `asm get` — no retained skill copy | none                         |
 
 Which command a candidate gets depends on how it is installed. `asm deactivate`
 only works on a live symlink into the `asm` library, so it is suggested only
@@ -229,8 +229,8 @@ entirely against your local filesystem.
 
 Demoting a skill does not mean losing it. `asm get <skill>` resolves a skill and
 writes its `SKILL.md` body to **stdout** — no provider directory, no library
-entry, no residency. The skill is paid for once, at the point of use, and costs
-nothing afterwards.
+entry, no residency. Default `get` retains no skill copy. With `--path`, it
+instead borrows a full directory on disk until you explicitly clean it up.
 
 ```bash
 asm get code-review                       # body to stdout
@@ -265,13 +265,44 @@ The catalog stores metadata, not bodies, so an `index`, `registry` or remote
 `asm get` costs a shallow clone into a temp directory, which is deleted before
 the command returns. Those fetches run the **same pre-install security scan
 `asm install` runs**; the verdict goes to stderr and into `--json` under
-`security`. It reports rather than blocks — `asm get` writes nothing — and
+`security`. It reports rather than blocks — `asm get` never installs or executes the skill — and
 `--audit` prints the full `asm audit security` report for the fetched skill.
 
 Output discipline: stdout carries the body (or, with `--json`, a single JSON
 object) and nothing else, so piping and redirecting are safe. Provenance,
 progress, and the security verdict go to stderr.
 
+#### Borrow the full skill directory
+
+When a skill needs supporting scripts, templates, references or binary assets:
+
+```bash
+borrowed_path="$(asm get --path code-review)"  # also: asm get code-review --path
+# Read "$borrowed_path/SKILL.md" and its supporting files after get exits.
+asm cleanup "$borrowed_path"                 # caller cleans up when finished
+```
+
+Every source tier is **copied**, including local paths, installed skills and
+library entries. The original is never changed or deleted. The copy lives under
+ASM's config directory in `get-borrows/`, independently of dependency sessions;
+the remote staging clone is still deleted before `get` returns. There is no
+exit-triggered borrow deletion and no `--keep` requirement. `asm install` remains
+the permanent installation workflow.
+
+Plain `--path` stdout is one absolute directory path plus a newline; provenance,
+security and cleanup guidance stay on stderr. `--path --json` (or `--machine`)
+returns `path`, sorted relative `files`, existing provenance/security fields,
+and `cleanup: {command: "asm", args: ["cleanup", path]}` instead of `content`.
+Git internals and ASM ownership metadata are omitted from the file list; `.git`
+is not copied. Executable modes and binary files are preserved. Installed root
+symlinks are resolved before copying; nested symlinks are refused.
+
+`asm cleanup <borrowed-path>` accepts only an exact registered borrow root, not
+an original source, parent, child, or symlink alias. Unknown and repeated cleanup
+are safe no-ops. Missing or mismatched ownership proof refuses deletion and may
+quarantine suspicious replacement content for inspection. Cleanup also supports
+`--json` and `--machine`.
+
 ### Just-in-time optional dependencies
 
 A skill can declare optional skill dependencies without installing them:
@@ -606,7 +637,8 @@ Multiple `asm` binaries on `PATH` can shadow a fresh upgrade.
 | `asm search <query>` | Search by name/description/provider |
 | `asm tag add\|remove` | Edit local tags on an installed skill |
 | `asm inspect <skill-name>` | Show detailed info for a skill |
-| `asm get <skill>` | Print a skill's body, install nothing |
+| `asm get <skill>` | Print a skill's body, install nothing — `--path` borrows the full directory |
+| `asm cleanup <path>` | Remove a directory borrowed by `asm get --path` |
 | `asm deps discover\|acquire\|release\|cleanup` | Manage caller-owned temporary dependency leases |
 | `asm install <source>` | Install from GitHub or registry |
 | `asm publish [path]` | Publish to ASM Registry |

package/data/repo-stars.json

@@ -1,42 +1,42 @@
 {
-  "generatedAt": "2026-09-09T08:23:22.764Z",
+  "generatedAt": "2026-09-13T05:18:31.864Z",
   "stars": {
-    "Affitor/affiliate-skills": 654,
-    "AvdLee/Core-Data-Agent-Skill": 304,
-    "AvdLee/Swift-Concurrency-Agent-Skill": 1645,
-    "AvdLee/Swift-Testing-Agent-Skill": 446,
-    "AvdLee/SwiftUI-Agent-Skill": 3508,
-    "AvdLee/Xcode-Build-Optimization-Agent-Skill": 1215,
-    "ComposioHQ/awesome-claude-skills": 74716,
-    "Dimillian/Skills": 3949,
-    "Egonex-AI/Understand-Anything": 81854,
-    "Eronred/aso-skills": 1842,
-    "GPTomics/bioSkills": 1199,
-    "Galaxy-Dawn/claude-scholar": 5404,
-    "Imbad0202/academic-research-skills": 47151,
-    "JuliusBrussee/caveman": 104422,
-    "K-Dense-AI/claude-scientific-skills": 43979,
-    "Leonxlnx/taste-skill": 85585,
-    "Master-cai/Research-Paper-Writing-Skills": 6660,
-    "MiniMax-AI/skills": 13525,
-    "Nutlope/hallmark": 28312,
-    "Paramchoudhary/ResumeSkills": 2185,
-    "ParthJadhav/app-store-screenshots": 6846,
-    "addyosmani/agent-skills": 93102,
-    "affaan-m/everything-claude-code": 254624,
-    "alirezarezvani/claude-skills": 25739,
-    "anthropics/skills": 175314,
-    "antithesishq/antithesis-skills": 267,
-    "antonbabenko/terraform-skill": 2333,
-    "ayghri/i-have-adhd": 31966,
-    "badlogic/pi-skills": 2508,
-    "blader/humanizer": 45629,
+    "Affitor/affiliate-skills": 659,
+    "AvdLee/Core-Data-Agent-Skill": 307,
+    "AvdLee/Swift-Concurrency-Agent-Skill": 1649,
+    "AvdLee/Swift-Testing-Agent-Skill": 450,
+    "AvdLee/SwiftUI-Agent-Skill": 3522,
+    "AvdLee/Xcode-Build-Optimization-Agent-Skill": 1224,
+    "ComposioHQ/awesome-claude-skills": 74927,
+    "Dimillian/Skills": 3961,
+    "Egonex-AI/Understand-Anything": 82338,
+    "Eronred/aso-skills": 1857,
+    "GPTomics/bioSkills": 1202,
+    "Galaxy-Dawn/claude-scholar": 5448,
+    "Imbad0202/academic-research-skills": 47791,
+    "JuliusBrussee/caveman": 105262,
+    "K-Dense-AI/claude-scientific-skills": 44629,
+    "Leonxlnx/taste-skill": 86638,
+    "Master-cai/Research-Paper-Writing-Skills": 6750,
+    "MiniMax-AI/skills": 13544,
+    "Nutlope/hallmark": 28497,
+    "Paramchoudhary/ResumeSkills": 2256,
+    "ParthJadhav/app-store-screenshots": 6872,
+    "addyosmani/agent-skills": 93773,
+    "affaan-m/everything-claude-code": 257212,
+    "alirezarezvani/claude-skills": 25891,
+    "anthropics/skills": 176024,
+    "antithesishq/antithesis-skills": 268,
+    "antonbabenko/terraform-skill": 2339,
+    "ayghri/i-have-adhd": 43567,
+    "badlogic/pi-skills": 2518,
+    "blader/humanizer": 47395,
     "briiirussell/cybersecurity-skills": 384,
-    "bytedance/deer-flow": 82107,
+    "bytedance/deer-flow": 82330,
     "cathrynlavery/diagram-design": 35685,
-    "charlie947/answer-first": 14,
-    "charlie947/voiceprint": 61,
-    "cloudai-x/threejs-skills": 3270,
+    "charlie947/answer-first": 15,
+    "charlie947/voiceprint": 62,
+    "cloudai-x/threejs-skills": 3291,
     "coreyhaines31/marketingskills": 49045,
     "davidondrej/skills": 3987,
     "emilkowalski/skills": 36331,
@@ -56,7 +56,7 @@
     "luongnv89/skills": 123,
     "mattpocock/skills": 248024,
     "mvanhorn/last30days-skill": 61182,
-    "DietrichGebert/ponytail": 132654,
+    "DietrichGebert/ponytail": 136757,
     "multica-ai/andrej-karpathy-skills": 209970,
     "oliver-zehentleitner/keep-the-why": 146,
     "obra/superpowers": 281464,
@@ -75,6 +75,6 @@
     "sickn33/antigravity-awesome-skills": 45946,
     "zarazhangrui/frontend-slides": 28703,
     "zarazhangrui/follow-builders": 6610,
-    "affaan-m/ECC": 254624
+    "affaan-m/ECC": 257212
   }
 }