agentinit 1.20.0 → 1.20.2

package/dist/cli.js

@@ -17098,6 +17098,174 @@ var init_marketplaceRegistry = __esm(() => {
   CUSTOM_MARKETPLACE_CACHE_TTL_MS = 3600000;
 });
 
+// dist/core/skillSecurityScanner.js
+import {promises as fs22} from "fs";
+import {join as join4, relative as relative2} from "path";
+
+class SkillSecurityScanner {
+  async scanSkill(skill) {
+    const findings = skill.generatedContent ? this.scanText(skill.generatedContent, "SKILL.md") : await this.scanDirectory(skill.path);
+    const stats = findings.reduce((acc, finding) => {
+      acc[finding.severity] += 1;
+      return acc;
+    }, { high: 0, medium: 0, low: 0 });
+    return {
+      blocked: findings.some((finding) => finding.blocking),
+      findings,
+      stats
+    };
+  }
+  formatShortSummary(result) {
+    const parts = [
+      result.stats.high ? `${result.stats.high} high` : null,
+      result.stats.medium ? `${result.stats.medium} medium` : null,
+      result.stats.low ? `${result.stats.low} low` : null
+    ].filter((value) => !!value);
+    return parts.length > 0 ? parts.join(", ") : "no findings";
+  }
+  formatBlockingReason(result) {
+    const finding = result.findings.find((entry) => entry.blocking) || result.findings.find((entry) => entry.severity === "high") || result.findings[0];
+    if (!finding) {
+      return "Security scan failed";
+    }
+    return `Security scan failed: ${finding.title} (${finding.ruleId}) at ${finding.filePath}:${finding.line}`;
+  }
+  async scanDirectory(rootPath) {
+    const findings = [];
+    await this.walk(rootPath, rootPath, findings);
+    return findings;
+  }
+  async walk(rootPath, currentPath, findings) {
+    const entries = await fs22.readdir(currentPath, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name === ".git" || entry.name === "node_modules") {
+        continue;
+      }
+      const entryPath = join4(currentPath, entry.name);
+      if (entry.isDirectory()) {
+        await this.walk(rootPath, entryPath, findings);
+        continue;
+      }
+      const relativePath = relative2(rootPath, entryPath).replace(/\\/g, "/");
+      const content = await this.readTextFile(entryPath);
+      if (content === null) {
+        continue;
+      }
+      findings.push(...this.scanText(content, relativePath, {
+        blockHighRisk: this.isExecutableTextFile(entryPath, content)
+      }));
+    }
+  }
+  async readTextFile(filePath) {
+    const extension = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")).toLowerCase() : "";
+    if (!SCANNED_TEXT_EXTENSIONS.has(extension)) {
+      return null;
+    }
+    const buffer = await fs22.readFile(filePath);
+    if (buffer.length > MAX_TEXT_FILE_BYTES || buffer.includes(0)) {
+      return null;
+    }
+    return buffer.toString("utf8");
+  }
+  isExecutableTextFile(filePath, content) {
+    const extension = filePath.includes(".") ? filePath.slice(filePath.lastIndexOf(".")).toLowerCase() : "";
+    return EXECUTABLE_TEXT_EXTENSIONS.has(extension) || content.startsWith("#!");
+  }
+  scanText(content, filePath, options2 = {}) {
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    lines.forEach((line, index) => {
+      for (const rule of SCAN_RULES) {
+        rule.regex.lastIndex = 0;
+        if (!rule.regex.test(line)) {
+          continue;
+        }
+        findings.push({
+          ruleId: rule.id,
+          title: rule.title,
+          severity: rule.severity,
+          filePath,
+          line: index + 1,
+          snippet: line.trim().slice(0, 160),
+          blocking: rule.severity === "high" && options2.blockHighRisk === true
+        });
+      }
+    });
+    return findings;
+  }
+}
+var SCAN_RULES, MAX_TEXT_FILE_BYTES, SCANNED_TEXT_EXTENSIONS, EXECUTABLE_TEXT_EXTENSIONS;
+var init_skillSecurityScanner = __esm(() => {
+  SCAN_RULES = [
+    {
+      id: "AI001",
+      title: "Prompt override language",
+      severity: "medium",
+      regex: /\b(ignore|disregard|override|bypass)\b.{0,40}\b(previous|prior|system|safety|guardrails?|instructions?)\b/i
+    },
+    {
+      id: "AI002",
+      title: "Secret or credential exfiltration",
+      severity: "high",
+      regex: /\b(exfiltrat\w*|upload|send|post|curl|wget)\b.{0,80}\b(secret|token|key|credential|cookie|session|\.ssh|id_rsa|env(?:ironment)? variables?)\b/i
+    },
+    {
+      id: "AI003",
+      title: "Destructive shell command",
+      severity: "high",
+      regex: /\b(rm\s+-rf\s+\/|sudo\s+rm\s+-rf|mkfs\b|dd\s+if=\/dev\/zero|chmod\s+-R\s+777\s+\/)\b/i
+    },
+    {
+      id: "AI004",
+      title: "Remote shell execution pipeline",
+      severity: "high",
+      regex: /\b(curl|wget)\b[^\n|]{0,160}\|\s*(sh|bash|zsh)\b/i
+    },
+    {
+      id: "AI005",
+      title: "Hardcoded credential material",
+      severity: "low",
+      regex: /\b(api[_-]?key|token|secret|password)\b\s*[:=]\s*['"][^'"]{8,}['"]/i
+    },
+    {
+      id: "AI006",
+      title: "Unicode bidi control characters",
+      severity: "low",
+      regex: /[\u202A-\u202E\u2066-\u2069]/
+    }
+  ];
+  MAX_TEXT_FILE_BYTES = 1024 * 1024;
+  SCANNED_TEXT_EXTENSIONS = new Set([
+    "",
+    ".md",
+    ".txt",
+    ".json",
+    ".yaml",
+    ".yml",
+    ".toml",
+    ".js",
+    ".ts",
+    ".mjs",
+    ".cjs",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".py",
+    ".ps1"
+  ]);
+  EXECUTABLE_TEXT_EXTENSIONS = new Set([
+    ".js",
+    ".ts",
+    ".mjs",
+    ".cjs",
+    ".sh",
+    ".bash",
+    ".zsh",
+    ".py",
+    ".ps1"
+  ]);
+});
+
 // dist/types/skills.js
 var SHARED_SKILLS_TARGET_ID, SHARED_SKILLS_TARGET_NAME;
 var init_skills = __esm(() => {
@@ -17106,9 +17274,9 @@ var init_skills = __esm(() => {
 });
 
 // dist/core/installLock.js
-import {promises as fs22} from "fs";
+import {promises as fs23} from "fs";
 import {homedir as homedir4} from "os";
-import {dirname as dirname2, join as join4, resolve as resolve7} from "path";
+import {dirname as dirname2, join as join5, resolve as resolve7} from "path";
 import {createHash, randomUUID} from "crypto";
 function getLockEntryTargetLabel(entry) {
   return entry.scope === "global" ? "Global scope" : entry.projectPath;
@@ -17122,16 +17290,16 @@ async function hashDirectory(rootPath) {
     return null;
   const hash = createHash("sha256");
   const walk = async (currentPath, relativePath) => {
-    const stat = await fs22.stat(currentPath);
+    const stat = await fs23.stat(currentPath);
     if (stat.isDirectory()) {
       hash.update(`dir:${relativePath}\n`);
-      const entries = await fs22.readdir(currentPath);
+      const entries = await fs23.readdir(currentPath);
       entries.sort();
       for (const entry of entries) {
-        await walk(join4(currentPath, entry), `${relativePath}/${entry}`);
+        await walk(join5(currentPath, entry), `${relativePath}/${entry}`);
       }
     } else {
-      const content = await fs22.readFile(currentPath);
+      const content = await fs23.readFile(currentPath);
       hash.update(`file:${relativePath}\n`);
       hash.update(content);
       hash.update("\n");
@@ -17167,12 +17335,12 @@ class InstallLock {
     if (!this.state)
       return;
     const lockPath = getLockPath();
-    await fs22.mkdir(dirname2(lockPath), { recursive: true });
-    await fs22.writeFile(lockPath, JSON.stringify(this.state, null, 2) + "\n", {
+    await fs23.mkdir(dirname2(lockPath), { recursive: true });
+    await fs23.writeFile(lockPath, JSON.stringify(this.state, null, 2) + "\n", {
       encoding: "utf8",
       mode: 384
     });
-    await fs22.chmod(lockPath, 384).catch(() => {
+    await fs23.chmod(lockPath, 384).catch(() => {
     });
   }
   async recordSkill(params) {
@@ -17351,7 +17519,7 @@ var init_installLock = __esm(() => {
   init_fs();
   init_logger();
   getLockPath = function() {
-    return join4(homedir4(), ".agentinit", LOCK_FILE);
+    return join5(homedir4(), ".agentinit", LOCK_FILE);
   };
   getEntryTargetKey = function(entry) {
     return entry.scope === "global" ? GLOBAL_TARGET_KEY : entry.projectPath;
@@ -17493,8 +17661,8 @@ __export(exports_pluginManager, {
     }
   }
 });
-import {resolve as resolve8, join as join5, basename as basename2, relative as relative2, dirname as dirname3} from "path";
-import {promises as fs24} from "fs";
+import {resolve as resolve8, join as join6, basename as basename2, relative as relative3, dirname as dirname3} from "path";
+import {promises as fs25} from "fs";
 import {homedir as homedir5} from "os";
 
 class MultipleBundlePluginsError extends Error {
@@ -17539,7 +17707,7 @@ class PluginManager {
   }
   async cleanupLoadedPluginContext(context) {
     if (context?.tempDir) {
-      await fs24.rm(context.tempDir, { recursive: true, force: true }).catch(() => {
+      await fs25.rm(context.tempDir, { recursive: true, force: true }).catch(() => {
       });
     }
   }
@@ -17617,7 +17785,7 @@ class PluginManager {
     return "unverified";
   }
   async resolvePreparedPluginDir(pluginDir, source) {
-    const claudeMarketplaceManifestPath = join5(pluginDir, ".claude-plugin", "marketplace.json");
+    const claudeMarketplaceManifestPath = join6(pluginDir, ".claude-plugin", "marketplace.json");
     if (!await fileExists(claudeMarketplaceManifestPath)) {
       return { pluginDir, warnings: [] };
     }
@@ -17653,7 +17821,7 @@ class PluginManager {
       selectedEntry = matched;
     }
     const selectedPluginDir = resolve8(pluginDir, selectedEntry.source);
-    const relativePath = relative2(resolve8(pluginDir), selectedPluginDir);
+    const relativePath = relative3(resolve8(pluginDir), selectedPluginDir);
     if (relativePath.startsWith("..") || relativePath.includes("/../") || relativePath.includes("\\..\\")) {
       throw new Error(`Invalid bundled plugin source path "${selectedEntry.source}" in ${claudeMarketplaceManifestPath}`);
     }
@@ -17765,15 +17933,15 @@ class PluginManager {
   }
   async getClaudeNativeFeatureKinds(pluginDir, manifest) {
     const featureChecks = await Promise.all([
-      (async () => !!manifest.commands || await isDirectory(join5(pluginDir, "commands")))(),
-      (async () => !!manifest.hooks || await isDirectory(join5(pluginDir, "hooks")))(),
-      (async () => !!manifest.agents || await isDirectory(join5(pluginDir, "agents")))(),
-      isDirectory(join5(pluginDir, "skills")),
-      (async () => !!manifest.mcpServers || await fileExists(join5(pluginDir, ".mcp.json")))(),
-      isDirectory(join5(pluginDir, "prompts")),
-      isDirectory(join5(pluginDir, "schemas")),
-      isDirectory(join5(pluginDir, "scripts")),
-      isDirectory(join5(pluginDir, "templates"))
+      (async () => !!manifest.commands || await isDirectory(join6(pluginDir, "commands")))(),
+      (async () => !!manifest.hooks || await isDirectory(join6(pluginDir, "hooks")))(),
+      (async () => !!manifest.agents || await isDirectory(join6(pluginDir, "agents")))(),
+      isDirectory(join6(pluginDir, "skills")),
+      (async () => !!manifest.mcpServers || await fileExists(join6(pluginDir, ".mcp.json")))(),
+      isDirectory(join6(pluginDir, "prompts")),
+      isDirectory(join6(pluginDir, "schemas")),
+      isDirectory(join6(pluginDir, "scripts")),
+      isDirectory(join6(pluginDir, "templates"))
     ]);
     return [
       ...featureChecks[0] ? ["commands"] : [],
@@ -17791,7 +17959,7 @@ class PluginManager {
     if (plugin.format !== "claude") {
       return null;
     }
-    const manifestContent = await readFileIfExists(join5(pluginDir, ".claude-plugin", "plugin.json"));
+    const manifestContent = await readFileIfExists(join6(pluginDir, ".claude-plugin", "plugin.json"));
     if (!manifestContent) {
       return null;
     }
@@ -17811,7 +17979,7 @@ class PluginManager {
     return {
       namespace,
       pluginKey: `${plugin.name}@${namespace}`,
-      installPath: join5(homedir5(), ".claude", "plugins", "cache", namespace, plugin.name, versionDir),
+      installPath: join6(homedir5(), ".claude", "plugins", "cache", namespace, plugin.name, versionDir),
       marketplacePath: getClaudeMarketplaceInstallPath(namespace),
       features
     };
@@ -17877,7 +18045,7 @@ class PluginManager {
   async findClaudeMarketplaceRoot(pluginDir) {
     let currentDir = resolve8(pluginDir);
     while (true) {
-      if (await fileExists(join5(currentDir, ".claude-plugin", "marketplace.json"))) {
+      if (await fileExists(join6(currentDir, ".claude-plugin", "marketplace.json"))) {
         return currentDir;
       }
       const parentDir = dirname3(currentDir);
@@ -17888,7 +18056,7 @@ class PluginManager {
     }
   }
   async readClaudeMarketplaceManifest(marketplaceDir) {
-    const manifestContent = await readFileIfExists(join5(marketplaceDir, ".claude-plugin", "marketplace.json"));
+    const manifestContent = await readFileIfExists(join6(marketplaceDir, ".claude-plugin", "marketplace.json"));
     if (!manifestContent) {
       return null;
     }
@@ -17907,19 +18075,19 @@ class PluginManager {
     }
   }
   async saveClaudeMarketplaceManifest(marketplaceDir, manifest) {
-    await fs24.mkdir(join5(marketplaceDir, ".claude-plugin"), { recursive: true });
-    await writeFile(join5(marketplaceDir, ".claude-plugin", "marketplace.json"), JSON.stringify(manifest, null, 2));
+    await fs25.mkdir(join6(marketplaceDir, ".claude-plugin"), { recursive: true });
+    await writeFile(join6(marketplaceDir, ".claude-plugin", "marketplace.json"), JSON.stringify(manifest, null, 2));
   }
   resolveMarketplaceSourcePath(baseDir, relativePath) {
     const resolvedPath = resolve8(baseDir, relativePath);
-    const relativePathFromBase = relative2(resolve8(baseDir), resolvedPath);
+    const relativePathFromBase = relative3(resolve8(baseDir), resolvedPath);
     if (relativePathFromBase.startsWith("..") || relativePathFromBase.includes("/../") || relativePathFromBase.includes("\\..\\")) {
       throw new Error(`Invalid marketplace source path "${relativePath}" in ${baseDir}`);
     }
     return resolvedPath;
   }
   async readClaudePluginMetadata(pluginDir) {
-    const manifestContent = await readFileIfExists(join5(pluginDir, ".claude-plugin", "plugin.json"));
+    const manifestContent = await readFileIfExists(join6(pluginDir, ".claude-plugin", "plugin.json"));
     if (!manifestContent) {
       return {};
     }
@@ -17935,11 +18103,11 @@ class PluginManager {
     }
   }
   async copyClaudeMarketplacePlugin(sourcePluginDir, marketplacePath, pluginName) {
-    const marketplacePluginPath = join5(marketplacePath, "plugins", pluginName);
-    await fs24.mkdir(dirname3(marketplacePluginPath), { recursive: true });
-    await fs24.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
+    const marketplacePluginPath = join6(marketplacePath, "plugins", pluginName);
+    await fs25.mkdir(dirname3(marketplacePluginPath), { recursive: true });
+    await fs25.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
     });
-    await fs24.cp(sourcePluginDir, marketplacePluginPath, { recursive: true, dereference: true });
+    await fs25.cp(sourcePluginDir, marketplacePluginPath, { recursive: true, dereference: true });
     return marketplacePluginPath;
   }
   getClaudeMarketplaceSource(plugin, marketplaceRoot, marketplacePath) {
@@ -17971,7 +18139,7 @@ class PluginManager {
   async materializeClaudeMarketplace(plugin, pluginDir, target) {
     const marketplaceRoot = await this.findClaudeMarketplaceRoot(pluginDir);
     const marketplaceSource = this.getClaudeMarketplaceSource(plugin, marketplaceRoot, target.marketplacePath);
-    await fs24.mkdir(target.marketplacePath, { recursive: true });
+    await fs25.mkdir(target.marketplacePath, { recursive: true });
     const existingManifest = await this.readClaudeMarketplaceManifest(target.marketplacePath);
     const sourceManifest = marketplaceRoot ? await this.readClaudeMarketplaceManifest(marketplaceRoot) : null;
     const mergedManifest = {
@@ -18043,10 +18211,10 @@ class PluginManager {
       warnings.push(`Skipped native Claude plugin install because Claude already has "${plugin.name}" installed as ${conflictingKey}.`);
       return { installed, skipped, warnings };
     }
-    await fs24.rm(nativeTarget.installPath, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(nativeTarget.installPath, { recursive: true, force: true }).catch(() => {
     });
-    await fs24.mkdir(dirname3(nativeTarget.installPath), { recursive: true });
-    await fs24.cp(pluginDir, nativeTarget.installPath, { recursive: true, dereference: true });
+    await fs25.mkdir(dirname3(nativeTarget.installPath), { recursive: true });
+    await fs25.cp(pluginDir, nativeTarget.installPath, { recursive: true, dereference: true });
     const marketplace = await this.materializeClaudeMarketplace(plugin, pluginDir, nativeTarget);
     const now = new Date().toISOString();
     claudeInstalled.plugins[nativeTarget.pluginKey] = [{
@@ -18086,7 +18254,7 @@ class PluginManager {
     };
     await this.saveClaudeKnownMarketplaces(knownMarketplaces);
     for (const entry of legacyEntries) {
-      await fs24.rm(entry.installPath, { recursive: true, force: true }).catch(() => {
+      await fs25.rm(entry.installPath, { recursive: true, force: true }).catch(() => {
       });
     }
     for (const legacyKey of legacyKeys) {
@@ -18134,7 +18302,7 @@ class PluginManager {
         delete knownMarketplaces[marketplaceNamespace];
         await this.saveClaudeKnownMarketplaces(knownMarketplaces);
       }
-      await fs24.rm(getClaudeMarketplaceInstallPath(marketplaceNamespace), { recursive: true, force: true }).catch(() => {
+      await fs25.rm(getClaudeMarketplaceInstallPath(marketplaceNamespace), { recursive: true, force: true }).catch(() => {
       });
     } else if (marketplaceNamespace) {
       const pluginName = component.pluginKey.split("@")[0] || "";
@@ -18142,14 +18310,14 @@ class PluginManager {
       const manifest = await this.readClaudeMarketplaceManifest(marketplacePath);
       if (pluginName && manifest) {
         manifest.plugins = (manifest.plugins || []).filter((entry) => entry.name !== pluginName);
-        const marketplacePluginPath = join5(marketplacePath, "plugins", pluginName);
-        await fs24.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
+        const marketplacePluginPath = join6(marketplacePath, "plugins", pluginName);
+        await fs25.rm(marketplacePluginPath, { recursive: true, force: true }).catch(() => {
         });
         await this.saveClaudeMarketplaceManifest(marketplacePath, manifest);
       }
     }
     await this.saveClaudeSettings(claudeSettings);
-    await fs24.rm(component.installPath, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(component.installPath, { recursive: true, force: true }).catch(() => {
     });
     return true;
   }
@@ -18222,7 +18390,7 @@ class PluginManager {
       throw new Error(`Unknown marketplace: ${registryId}. Available: ${this.getMarketplaceIds().join(", ")}`);
     }
     const cacheDir = getMarketplaceCacheDir(registryId);
-    const cacheMetaPath = join5(cacheDir, ".agentinit-cache-meta.json");
+    const cacheMetaPath = join6(cacheDir, ".agentinit-cache-meta.json");
     const cacheMeta = await this.readMarketplaceCacheMeta(cacheMetaPath);
     if (cacheMeta?.repoUrl === registry.repoUrl) {
       const age = Date.now() - cacheMeta.fetchedAt;
@@ -18230,10 +18398,10 @@ class PluginManager {
         return cacheDir;
       }
     }
-    if (await fileExists(join5(cacheDir, ".git"))) {
+    if (await fileExists(join6(cacheDir, ".git"))) {
       const originUrl = await this.getMarketplaceCacheOriginUrl(cacheDir);
       if (originUrl !== registry.repoUrl) {
-        await fs24.rm(cacheDir, { recursive: true, force: true });
+        await fs25.rm(cacheDir, { recursive: true, force: true });
         await this.cloneMarketplace(registry.repoUrl, cacheDir);
       } else {
         const { execFile } = await import("child_process");
@@ -18242,15 +18410,15 @@ class PluginManager {
         try {
           await exec("git", ["pull", "--ff-only"], { cwd: cacheDir, timeout: 30000 });
         } catch {
-          await fs24.rm(cacheDir, { recursive: true, force: true });
+          await fs25.rm(cacheDir, { recursive: true, force: true });
           await this.cloneMarketplace(registry.repoUrl, cacheDir);
         }
       }
     } else {
       await this.cloneMarketplace(registry.repoUrl, cacheDir);
     }
-    await fs24.mkdir(cacheDir, { recursive: true });
-    await fs24.writeFile(cacheMetaPath, JSON.stringify({
+    await fs25.mkdir(cacheDir, { recursive: true });
+    await fs25.writeFile(cacheMetaPath, JSON.stringify({
       fetchedAt: Date.now(),
       repoUrl: registry.repoUrl
     }));
@@ -18261,7 +18429,7 @@ class PluginManager {
       return null;
     }
     try {
-      const meta = JSON.parse(await fs24.readFile(cacheMetaPath, "utf8"));
+      const meta = JSON.parse(await fs25.readFile(cacheMetaPath, "utf8"));
       if (typeof meta.fetchedAt !== "number") {
         return null;
       }
@@ -18289,11 +18457,11 @@ class PluginManager {
     }
   }
   async cloneMarketplace(repoUrl, dest) {
-    await fs24.mkdir(dest, { recursive: true });
+    await fs25.mkdir(dest, { recursive: true });
     const { execFile } = await import("child_process");
     const { promisify } = await import("util");
     const exec = promisify(execFile);
-    await fs24.rm(dest, { recursive: true, force: true }).catch(() => {
+    await fs25.rm(dest, { recursive: true, force: true }).catch(() => {
     });
     await exec("git", ["clone", "--depth", "1", repoUrl, dest], { timeout: 60000 });
   }
@@ -18303,7 +18471,7 @@ class PluginManager {
       throw new Error(`Unknown marketplace: ${registryId}`);
     const cacheDir = await this.ensureMarketplaceCache(registryId);
     for (const dir of registry.pluginDirs) {
-      const pluginPath = join5(cacheDir, dir, name);
+      const pluginPath = join6(cacheDir, dir, name);
       if (await isDirectory(pluginPath)) {
         return pluginPath;
       }
@@ -18319,7 +18487,7 @@ class PluginManager {
     const cacheDir = await this.ensureMarketplaceCache(registryId);
     const results = [];
     for (const dir of registry.pluginDirs) {
-      const fullDir = join5(cacheDir, dir);
+      const fullDir = join6(cacheDir, dir);
       if (!await isDirectory(fullDir))
         continue;
       const cat = getMarketplaceCategoryForDir(dir);
@@ -18329,26 +18497,26 @@ class PluginManager {
       for (const entry of entries) {
         if (entry.startsWith("."))
           continue;
-        const entryPath = join5(fullDir, entry);
+        const entryPath = join6(fullDir, entry);
         if (!await isDirectory(entryPath))
           continue;
-        const manifestPath = join5(entryPath, ".claude-plugin", "plugin.json");
+        const manifestPath = join6(entryPath, ".claude-plugin", "plugin.json");
         let name = entry;
         let description = "";
         let version = "0.0.0";
         if (await fileExists(manifestPath)) {
           try {
-            const manifest = JSON.parse(await fs24.readFile(manifestPath, "utf8"));
+            const manifest = JSON.parse(await fs25.readFile(manifestPath, "utf8"));
             name = manifest.name || entry;
             description = manifest.description || "";
             version = manifest.version || "0.0.0";
           } catch {
           }
         } else {
-          const skillMdPath = join5(entryPath, "SKILL.md");
+          const skillMdPath = join6(entryPath, "SKILL.md");
           if (await fileExists(skillMdPath)) {
             try {
-              const parsed = import_gray_matter.default(await fs24.readFile(skillMdPath, "utf8"));
+              const parsed = import_gray_matter.default(await fs25.readFile(skillMdPath, "utf8"));
               if (parsed.data.name)
                 name = parsed.data.name;
               if (parsed.data.description)
@@ -18356,10 +18524,10 @@ class PluginManager {
             } catch {
             }
           } else {
-            const mcpPath = join5(entryPath, ".mcp.json");
+            const mcpPath = join6(entryPath, ".mcp.json");
             if (await fileExists(mcpPath)) {
               try {
-                const mcpConfig = JSON.parse(await fs24.readFile(mcpPath, "utf8"));
+                const mcpConfig = JSON.parse(await fs25.readFile(mcpPath, "utf8"));
                 const serverNames = Object.keys(mcpConfig.mcpServers || mcpConfig);
                 if (serverNames.length > 0) {
                   description = `MCP server(s): ${serverNames.join(", ")}`;
@@ -18381,10 +18549,10 @@ class PluginManager {
     return results.sort((a, b) => a.name.localeCompare(b.name));
   }
   async detectFormat(pluginDir) {
-    if (await fileExists(join5(pluginDir, ".claude-plugin", "plugin.json"))) {
+    if (await fileExists(join6(pluginDir, ".claude-plugin", "plugin.json"))) {
       return "claude";
     }
-    if (await fileExists(join5(pluginDir, ".cursor-plugin", "plugin.json"))) {
+    if (await fileExists(join6(pluginDir, ".cursor-plugin", "plugin.json"))) {
       return "cursor";
     }
     return "generic";
@@ -18401,7 +18569,7 @@ class PluginManager {
     }
   }
   async parseClaudePlugin(pluginDir, source) {
-    const manifestPath = join5(pluginDir, ".claude-plugin", "plugin.json");
+    const manifestPath = join6(pluginDir, ".claude-plugin", "plugin.json");
     const manifestContent = await readFileIfExists(manifestPath);
     if (!manifestContent) {
       throw new Error(`Missing .claude-plugin/plugin.json in ${pluginDir}`);
@@ -18412,10 +18580,10 @@ class PluginManager {
     const convertedSkills = await this.convertCommandsToSkills(pluginDir, manifest);
     skills.push(...convertedSkills);
     const mcpServers = await this.parseMcpJson(pluginDir);
-    if (await isDirectory(join5(pluginDir, "hooks")) || manifest.hooks) {
+    if (await isDirectory(join6(pluginDir, "hooks")) || manifest.hooks) {
       warnings.push("Hooks (hooks/) are Claude Code-specific");
     }
-    if (await isDirectory(join5(pluginDir, "agents")) || manifest.agents) {
+    if (await isDirectory(join6(pluginDir, "agents")) || manifest.agents) {
       warnings.push("Agent definitions (agents/) are Claude Code-specific");
     }
     return {
@@ -18430,7 +18598,7 @@ class PluginManager {
     };
   }
   async parseCursorPlugin(pluginDir, source) {
-    const manifestPath = join5(pluginDir, ".cursor-plugin", "plugin.json");
+    const manifestPath = join6(pluginDir, ".cursor-plugin", "plugin.json");
     const manifestContent = await readFileIfExists(manifestPath);
     if (!manifestContent) {
       throw new Error(`Missing .cursor-plugin/plugin.json in ${pluginDir}`);
@@ -18469,7 +18637,7 @@ class PluginManager {
     };
   }
   async parseMcpJson(pluginDir) {
-    const mcpPath = join5(pluginDir, ".mcp.json");
+    const mcpPath = join6(pluginDir, ".mcp.json");
     const content = await readFileIfExists(mcpPath);
     if (!content)
       return [];
@@ -18516,7 +18684,7 @@ class PluginManager {
         commandsDirs.push(resolve8(pluginDir, cmd));
       }
     } else {
-      commandsDirs.push(join5(pluginDir, "commands"));
+      commandsDirs.push(join6(pluginDir, "commands"));
     }
     for (const commandsDir of commandsDirs) {
       if (!await isDirectory(commandsDir))
@@ -18525,7 +18693,7 @@ class PluginManager {
       for (const entry of entries) {
         if (!entry.endsWith(".md"))
           continue;
-        const cmdPath = join5(commandsDir, entry);
+        const cmdPath = join6(commandsDir, entry);
         const skill = await this.convertSingleCommandToSkill(cmdPath, manifest.name);
         if (skill)
           skills.push(skill);
@@ -18839,7 +19007,7 @@ ${body.trim()}
       }
       if (!removedSkillPaths.has(skill.path)) {
         try {
-          await fs24.rm(skill.path, { recursive: true, force: true });
+          await fs25.rm(skill.path, { recursive: true, force: true });
           removedSkillPaths.add(skill.path);
         } catch {
           details.push(`Could not remove skill path: ${skill.path}`);
@@ -18848,7 +19016,7 @@ ${body.trim()}
       }
       if (skill.canonicalPath && skill.canonicalPath !== skill.path && !removedCanonicalPaths.has(skill.canonicalPath) && !sharedCanonicalPath) {
         try {
-          await fs24.rm(skill.canonicalPath, { recursive: true, force: true });
+          await fs25.rm(skill.canonicalPath, { recursive: true, force: true });
           removedCanonicalPaths.add(skill.canonicalPath);
         } catch {
           details.push(`Could not remove canonical skill path: ${skill.canonicalPath}`);
@@ -18954,31 +19122,31 @@ var init_pluginManager = __esm(() => {
   init_skillsManager();
   init_userConfig();
   getMarketplaceCacheDir = function(registryId) {
-    return join5(homedir5(), ".agentinit", "marketplace-cache", registryId);
+    return join6(homedir5(), ".agentinit", "marketplace-cache", registryId);
   };
   getRegistryPath = function(projectPath, global3) {
     if (global3) {
-      return join5(homedir5(), ".agentinit", "plugins.json");
+      return join6(homedir5(), ".agentinit", "plugins.json");
     }
-    return join5(projectPath, ".agentinit", "plugins.json");
+    return join6(projectPath, ".agentinit", "plugins.json");
   };
   getClaudeInstalledPluginsPath = function() {
-    return join5(homedir5(), ".claude", "plugins", "installed_plugins.json");
+    return join6(homedir5(), ".claude", "plugins", "installed_plugins.json");
   };
   getClaudeKnownMarketplacesPath = function() {
-    return join5(homedir5(), ".claude", "plugins", "known_marketplaces.json");
+    return join6(homedir5(), ".claude", "plugins", "known_marketplaces.json");
   };
   getClaudeMarketplaceInstallPath = function(namespace) {
-    return join5(homedir5(), ".claude", "plugins", "marketplaces", namespace);
+    return join6(homedir5(), ".claude", "plugins", "marketplaces", namespace);
   };
   getClaudeSettingsPath = function() {
-    return join5(homedir5(), ".claude", "settings.json");
+    return join6(homedir5(), ".claude", "settings.json");
   };
 });
 
 // dist/core/skillsManager.js
-import {resolve as resolve9, join as join6, relative as relative3, basename as basename3, dirname as dirname4} from "path";
-import {promises as fs26} from "fs";
+import {resolve as resolve9, join as join7, relative as relative4, basename as basename3, dirname as dirname4} from "path";
+import {promises as fs27} from "fs";
 import {homedir as homedir6, tmpdir} from "os";
 import {execFile} from "child_process";
 import {createHash as createHash2} from "crypto";
@@ -18987,6 +19155,7 @@ import {promisify} from "util";
 class SkillsManager {
   agentManager;
   preparedSourceContexts = new Map;
+  skillScanner = new SkillSecurityScanner;
   constructor(agentManager3) {
     this.agentManager = agentManager3 || new AgentManager;
   }
@@ -18994,11 +19163,15 @@ class SkillsManager {
     if (source.startsWith(".") || source.startsWith("/") || source.startsWith("~")) {
       return { type: "local", path: source };
     }
-    const githubUrlSource = this.parseGitHubHttpSource(source);
-    if (githubUrlSource) {
-      return githubUrlSource;
+    const httpSource = this.parseHttpRepositorySource(source);
+    if (httpSource) {
+      return httpSource;
     }
-    if (source.startsWith("git@") || source.endsWith(".git")) {
+    const sshSource = this.parseSshRepositorySource(source);
+    if (sshSource) {
+      return sshSource;
+    }
+    if (source.endsWith(".git")) {
       return { type: "github", url: source };
     }
     if (options2?.from) {
@@ -19011,6 +19184,14 @@ class SkillsManager {
         pluginName: source
       };
     }
+    const gitLabShorthandSource = this.parseGitLabShorthandSource(source);
+    if (gitLabShorthandSource) {
+      return gitLabShorthandSource;
+    }
+    const bitbucketShorthandSource = this.parseBitbucketShorthandSource(source);
+    if (bitbucketShorthandSource) {
+      return bitbucketShorthandSource;
+    }
     const githubShorthandSource = this.parseGitHubShorthandSource(source);
     if (githubShorthandSource?.subpath) {
       return githubShorthandSource;
@@ -19100,6 +19281,106 @@ class SkillsManager {
       return null;
     }
   }
+  parseGitLabHttpSource(source) {
+    if (!source.startsWith("https://gitlab.com/") && !source.startsWith("http://gitlab.com/")) {
+      return null;
+    }
+    try {
+      const parsedUrl = new URL(source);
+      const segments = parsedUrl.pathname.replace(/\/+$/, "").split("/").filter(Boolean);
+      const dashIndex = segments.indexOf("-");
+      const repoBoundary = dashIndex >= 0 ? dashIndex : segments.length;
+      if (repoBoundary < 2) {
+        return null;
+      }
+      const repo = segments[repoBoundary - 1];
+      const owner = segments.slice(0, repoBoundary - 1).join("/");
+      if (!owner || !repo) {
+        return null;
+      }
+      let subpath;
+      if (dashIndex >= 0) {
+        const marker = segments[dashIndex + 1];
+        if ((marker === "tree" || marker === "blob") && segments.length > dashIndex + 3) {
+          subpath = segments.slice(dashIndex + 3).join("/");
+        }
+      }
+      return {
+        type: "gitlab",
+        url: `https://gitlab.com/${owner}/${repo}.git`,
+        owner,
+        repo,
+        ...subpath ? { subpath } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  parseBitbucketHttpSource(source) {
+    if (!source.startsWith("https://bitbucket.org/") && !source.startsWith("http://bitbucket.org/")) {
+      return null;
+    }
+    try {
+      const parsedUrl = new URL(source);
+      const segments = parsedUrl.pathname.replace(/\/+$/, "").split("/").filter(Boolean);
+      if (segments.length < 2) {
+        return null;
+      }
+      const [owner, repo, marker, _commitish, ...rest] = segments;
+      if (!owner || !repo) {
+        return null;
+      }
+      let subpath;
+      if (marker === "src" && rest.length > 0) {
+        subpath = rest.join("/");
+      }
+      return {
+        type: "bitbucket",
+        url: `https://bitbucket.org/${owner}/${repo}.git`,
+        owner,
+        repo,
+        ...subpath ? { subpath } : {}
+      };
+    } catch {
+      return null;
+    }
+  }
+  parseHttpRepositorySource(source) {
+    return this.parseGitHubHttpSource(source) || this.parseGitLabHttpSource(source) || this.parseBitbucketHttpSource(source);
+  }
+  parseSshRepositorySource(source) {
+    const githubMatch = source.match(/^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (githubMatch) {
+      const [, owner, repo] = githubMatch;
+      return {
+        type: "github",
+        url: `git@github.com:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    const gitlabMatch = source.match(/^git@gitlab\.com:(.+)\/([^/]+?)(?:\.git)?$/);
+    if (gitlabMatch) {
+      const [, owner, repo] = gitlabMatch;
+      return {
+        type: "gitlab",
+        url: `git@gitlab.com:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    const bitbucketMatch = source.match(/^git@bitbucket\.org:([^/]+)\/([^/]+?)(?:\.git)?$/);
+    if (bitbucketMatch) {
+      const [, owner, repo] = bitbucketMatch;
+      return {
+        type: "bitbucket",
+        url: `git@bitbucket.org:${owner}/${repo}.git`,
+        owner,
+        repo
+      };
+    }
+    return null;
+  }
   parseGitHubShorthandSource(source) {
     const githubShorthandMatch = source.match(/^([a-zA-Z0-9._-]+)\/([a-zA-Z0-9._-]+)(?:\/(.+))?$/);
     if (!githubShorthandMatch) {
@@ -19114,6 +19395,50 @@ class SkillsManager {
       ...subpath ? { subpath } : {}
     };
   }
+  parseGitLabShorthandSource(source) {
+    const normalized = source.startsWith("gitlab:") ? source.slice("gitlab:".length) : source.startsWith("gitlab.com/") ? source.slice("gitlab.com/".length) : null;
+    if (!normalized) {
+      return null;
+    }
+    const [repoSpec = normalized, subpathSpec] = normalized.split("//", 2);
+    const segments = repoSpec.split("/").filter(Boolean);
+    if (segments.length < 2) {
+      return null;
+    }
+    const repo = segments[segments.length - 1];
+    const owner = segments.slice(0, segments.length - 1).join("/");
+    if (!owner || !repo) {
+      return null;
+    }
+    return {
+      type: "gitlab",
+      url: `https://gitlab.com/${owner}/${repo}.git`,
+      owner,
+      repo,
+      ...subpathSpec ? { subpath: subpathSpec } : {}
+    };
+  }
+  parseBitbucketShorthandSource(source) {
+    const normalized = source.startsWith("bitbucket:") ? source.slice("bitbucket:".length) : source.startsWith("bitbucket.org/") ? source.slice("bitbucket.org/".length) : null;
+    if (!normalized) {
+      return null;
+    }
+    const segments = normalized.split("/").filter(Boolean);
+    if (segments.length < 2) {
+      return null;
+    }
+    const [owner, repo, ...rest] = segments;
+    if (!owner || !repo) {
+      return null;
+    }
+    return {
+      type: "bitbucket",
+      url: `https://bitbucket.org/${owner}/${repo}.git`,
+      owner,
+      repo,
+      ...rest.length > 0 ? { subpath: rest.join("/") } : {}
+    };
+  }
   async parseSkillMd(filePath) {
     const content = await readFileIfExists(filePath);
     if (!content)
@@ -19135,7 +19460,7 @@ class SkillsManager {
       const fullDir = resolve9(repoPath, searchDir);
       if (!await fileExists(fullDir))
         continue;
-      const directSkillMd = join6(fullDir, "SKILL.md");
+      const directSkillMd = join7(fullDir, "SKILL.md");
       if (await fileExists(directSkillMd)) {
         const parsed = await this.parseSkillMd(directSkillMd);
         if (parsed && !seen.has(parsed.name)) {
@@ -19143,7 +19468,7 @@ class SkillsManager {
           skills2.push({ ...parsed, path: resolve9(fullDir) });
         }
       }
-      const directSkillMdLower = join6(fullDir, "skill.md");
+      const directSkillMdLower = join7(fullDir, "skill.md");
       if (await fileExists(directSkillMdLower)) {
         const parsed = await this.parseSkillMd(directSkillMdLower);
         if (parsed && !seen.has(parsed.name)) {
@@ -19155,11 +19480,11 @@ class SkillsManager {
         continue;
       const entries = await listFiles(fullDir);
       for (const entry of entries) {
-        const entryPath = join6(fullDir, entry);
+        const entryPath = join7(fullDir, entry);
         if (!await isDirectory(entryPath))
           continue;
-        const skillMdPath = join6(entryPath, "SKILL.md");
-        const skillMdPathLower = join6(entryPath, "skill.md");
+        const skillMdPath = join7(entryPath, "SKILL.md");
+        const skillMdPathLower = join7(entryPath, "skill.md");
         const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
         if (!skillFile)
           continue;
@@ -19173,14 +19498,14 @@ class SkillsManager {
     return skills2;
   }
   async cloneRepo(url) {
-    const tempDir = await fs26.mkdtemp(join6(tmpdir(), "agentinit-skills-"));
-    await fs26.rm(tempDir, { recursive: true, force: true });
+    const tempDir = await fs27.mkdtemp(join7(tmpdir(), "agentinit-skills-"));
+    await fs27.rm(tempDir, { recursive: true, force: true });
     try {
       await execFileAsync("git", ["clone", "--depth", "1", url, tempDir], {
         timeout: 60000
       });
     } catch (error) {
-      await fs26.rm(tempDir, { recursive: true, force: true }).catch(() => {
+      await fs27.rm(tempDir, { recursive: true, force: true }).catch(() => {
       });
       throw new Error(`Failed to clone ${url}: ${error.message}`);
     }
@@ -19238,12 +19563,12 @@ class SkillsManager {
     if (!tempDir) {
       return;
     }
-    await fs26.rm(tempDir, { recursive: true, force: true }).catch(() => {
+    await fs27.rm(tempDir, { recursive: true, force: true }).catch(() => {
     });
   }
   async resolveDiscoveryRoot(repoPath, source, sourceLabel) {
     const resolvedRepoPath = resolve9(repoPath);
-    if (source.type !== "github" || !source.subpath) {
+    if (source.type !== "github" && source.type !== "gitlab" && source.type !== "bitbucket" || !source.subpath) {
       return resolvedRepoPath;
     }
     const discoveryRoot = resolve9(resolvedRepoPath, source.subpath);
@@ -19288,7 +19613,7 @@ class SkillsManager {
         };
       }
       let repoPath;
-      if (resolved.type === "github") {
+      if (resolved.type === "github" || resolved.type === "gitlab" || resolved.type === "bitbucket") {
         if (!resolved.url) {
           throw new Error(`Invalid source: ${source}`);
         }
@@ -19382,26 +19707,26 @@ class SkillsManager {
   async installSkill(skillPath, skillName, targetDir, copy = false) {
     const normalizedSkillName = this.normalizeSkillName(skillName);
     const destPath = this.resolveInstallPath(targetDir, normalizedSkillName);
-    await fs26.mkdir(resolve9(targetDir), { recursive: true });
+    await fs27.mkdir(resolve9(targetDir), { recursive: true });
     if (await fileExists(destPath)) {
-      await fs26.rm(destPath, { recursive: true, force: true });
+      await fs27.rm(destPath, { recursive: true, force: true });
     }
     if (copy) {
       await this.copyDir(skillPath, destPath);
     } else {
-      await fs26.symlink(skillPath, destPath, "dir");
+      await fs27.symlink(skillPath, destPath, "dir");
     }
     return destPath;
   }
   async installSkillFromContent(skillName, skillContent, targetDir) {
     const normalizedSkillName = this.normalizeSkillName(skillName);
     const destPath = this.resolveInstallPath(targetDir, normalizedSkillName);
-    await fs26.mkdir(resolve9(targetDir), { recursive: true });
+    await fs27.mkdir(resolve9(targetDir), { recursive: true });
     if (await fileExists(destPath)) {
-      await fs26.rm(destPath, { recursive: true, force: true });
+      await fs27.rm(destPath, { recursive: true, force: true });
     }
-    await fs26.mkdir(destPath, { recursive: true });
-    await fs26.writeFile(join6(destPath, "SKILL.md"), skillContent, "utf8");
+    await fs27.mkdir(destPath, { recursive: true });
+    await fs27.writeFile(join7(destPath, "SKILL.md"), skillContent, "utf8");
     return destPath;
   }
   getCanonicalSkillsDir(projectPath, global3 = false) {
@@ -19495,7 +19820,7 @@ class SkillsManager {
       throw new Error(`Missing canonical path for ${skillName}`);
     }
     await this.cleanAndCreateDirectory(canonicalPath);
-    await fs26.writeFile(join6(canonicalPath, "SKILL.md"), skillContent, "utf8");
+    await fs27.writeFile(join7(canonicalPath, "SKILL.md"), skillContent, "utf8");
     if (plan.path === canonicalPath) {
       return plan;
     }
@@ -19518,7 +19843,7 @@ class SkillsManager {
   async installSkillFromContentToCanonicalStore(skillName, skillContent, projectPath, options2 = {}) {
     const plan = this.getCanonicalInstallPlan(skillName, projectPath, options2);
     await this.cleanAndCreateDirectory(plan.path);
-    await fs26.writeFile(join6(plan.path, "SKILL.md"), skillContent, "utf8");
+    await fs27.writeFile(join7(plan.path, "SKILL.md"), skillContent, "utf8");
     return plan;
   }
   getCanonicalInstallPlan(skillName, projectPath, options2 = {}) {
@@ -19530,6 +19855,76 @@ class SkillsManager {
       mode: "symlink"
     };
   }
+  normalizeSkillPrefix(prefix) {
+    const normalized = prefix?.trim() ?? "";
+    if (normalized.includes("/") || normalized.includes("\\")) {
+      throw new Error(`Invalid skill prefix: ${prefix}`);
+    }
+    return normalized;
+  }
+  withSkillPrefix(skillName, prefix) {
+    const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+    return normalizedPrefix ? `${normalizedPrefix}${skillName}` : skillName;
+  }
+  async rewriteSkillFileName(filePath, skillName) {
+    const content = await fs27.readFile(filePath, "utf8");
+    const parsed = import_gray_matter2.default(content);
+    const nextContent = import_gray_matter2.default.stringify(parsed.content, {
+      ...parsed.data,
+      name: skillName
+    });
+    await fs27.writeFile(filePath, nextContent, "utf8");
+  }
+  async applyPrefixToSkills(skills2, prefix) {
+    const normalizedPrefix = this.normalizeSkillPrefix(prefix);
+    if (!normalizedPrefix) {
+      return { skills: skills2, cleanup: async () => {
+      } };
+    }
+    const tempDirs = [];
+    try {
+      const prefixedSkills = await Promise.all(skills2.map(async (skill) => {
+        const name = this.withSkillPrefix(skill.name, normalizedPrefix);
+        if (skill.generatedContent) {
+          return {
+            ...skill,
+            name,
+            generatedContent: import_gray_matter2.default.stringify(import_gray_matter2.default(skill.generatedContent).content, {
+              ...import_gray_matter2.default(skill.generatedContent).data,
+              name
+            })
+          };
+        }
+        const tempRoot = await fs27.mkdtemp(join7(tmpdir(), "agentinit-prefixed-skill-"));
+        const tempSkillPath = join7(tempRoot, basename3(skill.path));
+        tempDirs.push(tempRoot);
+        await this.copyDir(skill.path, tempSkillPath);
+        const skillMdPath = join7(tempSkillPath, "SKILL.md");
+        const skillMdPathLower = join7(tempSkillPath, "skill.md");
+        const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
+        if (!skillFile) {
+          throw new Error(`Skill "${skill.name}" is missing SKILL.md`);
+        }
+        await this.rewriteSkillFileName(skillFile, name);
+        return {
+          ...skill,
+          name,
+          path: tempSkillPath
+        };
+      }));
+      return {
+        skills: prefixedSkills,
+        cleanup: async () => {
+          await Promise.all(tempDirs.map((dir) => fs27.rm(dir, { recursive: true, force: true }).catch(() => {
+          })));
+        }
+      };
+    } catch (error) {
+      await Promise.all(tempDirs.map((dir) => fs27.rm(dir, { recursive: true, force: true }).catch(() => {
+      })));
+      throw error;
+    }
+  }
   normalizeSkillName(skillName) {
     const normalized = skillName.trim();
     if (!normalized) {
@@ -19543,7 +19938,7 @@ class SkillsManager {
   resolveInstallPath(targetDir, skillName) {
     const resolvedTargetDir = resolve9(targetDir);
     const destPath = resolve9(resolvedTargetDir, skillName);
-    const relativePath = relative3(resolvedTargetDir, destPath);
+    const relativePath = relative4(resolvedTargetDir, destPath);
     if (relativePath === "" || relativePath.startsWith("..") || relativePath.includes("/../") || relativePath.includes("\\..\\")) {
       throw new Error(`Refusing to install skill outside target directory: ${skillName}`);
     }
@@ -19562,16 +19957,16 @@ class SkillsManager {
       return null;
     const hash = createHash2("sha256");
     const walk = async (currentPath, relativePath) => {
-      const stat = await fs26.stat(currentPath);
+      const stat = await fs27.stat(currentPath);
       if (!stat.isDirectory()) {
-        const content = await fs26.readFile(currentPath);
+        const content = await fs27.readFile(currentPath);
         this.updateSnapshotWithFile(hash, relativePath, content);
         return;
       }
       hash.update(`dir:${relativePath || "."}\n`);
-      const entries = (await fs26.readdir(currentPath)).sort((left, right) => left.localeCompare(right));
+      const entries = (await fs27.readdir(currentPath)).sort((left, right) => left.localeCompare(right));
       for (const entry of entries) {
-        await walk(join6(currentPath, entry), relativePath ? join6(relativePath, entry) : entry);
+        await walk(join7(currentPath, entry), relativePath ? join7(relativePath, entry) : entry);
       }
     };
     await walk(rootPath, "");
@@ -19616,22 +20011,25 @@ class SkillsManager {
     return existingAtCanonical === incoming ? "new" : "changed";
   }
   async cleanAndCreateDirectory(path) {
-    await fs26.rm(path, { recursive: true, force: true }).catch(() => {
+    await fs27.rm(path, { recursive: true, force: true }).catch(() => {
     });
-    await fs26.mkdir(path, { recursive: true });
+    await fs27.mkdir(path, { recursive: true });
   }
   isWithinPath(basePath, targetPath) {
-    const relativePath = relative3(resolve9(basePath), resolve9(targetPath));
+    const relativePath = relative4(resolve9(basePath), resolve9(targetPath));
     return relativePath === "" || !relativePath.startsWith("..") && !relativePath.includes("/../") && !relativePath.includes("\\..\\");
   }
   async copyDir(src, dest) {
-    await fs26.cp(src, dest, { recursive: true, dereference: true });
+    await fs27.cp(src, dest, { recursive: true, dereference: true });
   }
   async addFromSource(source, projectPath, options2 = {}) {
+    const normalizedPrefix = this.normalizeSkillPrefix(options2.prefix);
     const context = this.takePreparedSourceContext(source, projectPath, options2.from) || await this.loadDiscoveredSkillsContext(source, projectPath, {
       ...options2.from !== undefined ? { from: options2.from } : {},
       ...options2.pluginName !== undefined ? { pluginName: options2.pluginName } : {}
     });
+    let prefixedCleanup = async () => {
+    };
     try {
       let skills2 = context.skills;
       if (skills2.length === 0) {
@@ -19639,7 +20037,34 @@ class SkillsManager {
       }
       if (options2.skills && options2.skills.length > 0) {
         const names = new Set(options2.skills.map((skill) => skill.toLowerCase()));
-        skills2 = skills2.filter((skill) => names.has(skill.name.toLowerCase()));
+        skills2 = skills2.filter((skill) => names.has(skill.name.toLowerCase()) || names.has(this.withSkillPrefix(skill.name, normalizedPrefix).toLowerCase()));
+      }
+      const prefixed = await this.applyPrefixToSkills(skills2, normalizedPrefix);
+      skills2 = prefixed.skills;
+      prefixedCleanup = prefixed.cleanup;
+      const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: [...context.warnings] };
+      if (options2.scan !== false) {
+        const scannedWarnings = new Set;
+        const scannableSkills = [];
+        for (const skill of skills2) {
+          const scan = await this.skillScanner.scanSkill(skill);
+          if (scan.findings.length === 0) {
+            scannableSkills.push(skill);
+            continue;
+          }
+          if (scan.blocked && !options2.allowRisky) {
+            result.skipped.push({
+              skill,
+              reason: this.skillScanner.formatBlockingReason(scan)
+            });
+            continue;
+          }
+          const summary = this.skillScanner.formatShortSummary(scan);
+          scannedWarnings.add(scan.blocked ? `Proceeding with "${skill.name}" despite high-risk findings: ${summary}` : `Security warnings for "${skill.name}": ${summary}`);
+          scannableSkills.push(skill);
+        }
+        skills2 = scannableSkills;
+        result.warnings.push(...scannedWarnings);
       }
       const installToSharedStore = options2.agents?.includes(SHARED_SKILLS_TARGET_ID) ?? false;
       const agents = await this.getTargetAgents(projectPath, options2);
@@ -19648,11 +20073,13 @@ class SkillsManager {
           installed: [],
           updated: [],
           unchanged: [],
-          skipped: skills2.map((skill) => ({ skill, reason: "No target agents found" })),
-          warnings: context.warnings
+          skipped: [
+            ...result.skipped,
+            ...skills2.map((skill) => ({ skill, reason: "No target agents found" }))
+          ],
+          warnings: result.warnings
         };
       }
-      const result = { installed: [], updated: [], unchanged: [], skipped: [], warnings: context.warnings };
       const installableAgents = [];
       const comparisonCache = new Map;
       const pendingUpdates = [];
@@ -19762,6 +20189,7 @@ class SkillsManager {
           type: resolvedSource.type,
           ...resolvedSource.marketplace ? { marketplace: resolvedSource.marketplace } : {},
           ...resolvedSource.pluginName ? { pluginName: resolvedSource.pluginName } : {},
+          ...normalizedPrefix ? { prefix: normalizedPrefix } : {},
           ...resolvedSource.url ? { url: resolvedSource.url } : {},
           ...resolvedSource.path ? { path: resolve9(projectPath, expandTilde(resolvedSource.path)) } : {},
           ...resolvedSource.owner ? { owner: resolvedSource.owner } : {},
@@ -19793,6 +20221,7 @@ class SkillsManager {
       }
       return result;
     } finally {
+      await prefixedCleanup();
       await context.cleanup();
     }
   }
@@ -19815,11 +20244,11 @@ class SkillsManager {
           continue;
         const entries = await listFiles(dir);
         for (const entry of entries) {
-          const entryPath = join6(dir, entry);
+          const entryPath = join7(dir, entry);
           if (!await isDirectory(entryPath))
             continue;
-          const skillMdPath = join6(entryPath, "SKILL.md");
-          const skillMdPathLower = join6(entryPath, "skill.md");
+          const skillMdPath = join7(entryPath, "SKILL.md");
+          const skillMdPathLower = join7(entryPath, "skill.md");
           const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
           if (!skillFile)
             continue;
@@ -19829,7 +20258,7 @@ class SkillsManager {
           let isSymlink = false;
           let canonicalPath;
           try {
-            const stat = await fs26.lstat(entryPath);
+            const stat = await fs27.lstat(entryPath);
             isSymlink = stat.isSymbolicLink();
             const canonicalBase = this.getCanonicalSkillsDir(projectPath, scope === "global");
             const [resolvedEntryPath, resolvedCanonicalBase] = await Promise.all([
@@ -19866,14 +20295,14 @@ class SkillsManager {
           continue;
         const entries = await listFiles(canonicalDir);
         for (const entry of entries) {
-          const entryPath = join6(canonicalDir, entry);
+          const entryPath = join7(canonicalDir, entry);
           if (!await isDirectory(entryPath))
             continue;
           const resolvedEntryPath = resolve9(entryPath);
           if (referencedCanonicalPaths.has(resolvedEntryPath))
             continue;
-          const skillMdPath = join6(entryPath, "SKILL.md");
-          const skillMdPathLower = join6(entryPath, "skill.md");
+          const skillMdPath = join7(entryPath, "SKILL.md");
+          const skillMdPathLower = join7(entryPath, "skill.md");
           const skillFile = await fileExists(skillMdPath) ? skillMdPath : await fileExists(skillMdPathLower) ? skillMdPathLower : null;
           if (!skillFile)
             continue;
@@ -19940,7 +20369,7 @@ class SkillsManager {
       }
       if (!removedPaths.has(entry.path)) {
         try {
-          await fs26.rm(entry.path, { recursive: true, force: true });
+          await fs27.rm(entry.path, { recursive: true, force: true });
           removedPaths.add(entry.path);
         } catch {
           skipped.push({
@@ -19953,7 +20382,7 @@ class SkillsManager {
       if (entry.canonicalPath && entry.canonicalPath !== entry.path && !removedCanonicalPaths.has(entry.canonicalPath)) {
         const stillReferenced = remainingEntries.some((other) => other.name.toLowerCase() === entry.name.toLowerCase() && other.canonicalPath === entry.canonicalPath);
         if (!stillReferenced) {
-          await fs26.rm(entry.canonicalPath, { recursive: true, force: true }).catch(() => {
+          await fs27.rm(entry.canonicalPath, { recursive: true, force: true }).catch(() => {
           });
           removedCanonicalPaths.add(entry.canonicalPath);
         }
@@ -19999,6 +20428,7 @@ var init_skillsManager = __esm(() => {
   init_paths();
   init_agentManager();
   init_marketplaceRegistry();
+  init_skillSecurityScanner();
   init_skills();
   init_installLock();
   execFileAsync = promisify(execFile);
@@ -20884,51 +21314,51 @@ var require_uri_all = __commonJS((exports, module) => {
       }
       return uriTokens.join("");
     }
-    function resolveComponents(base2, relative6) {
+    function resolveComponents(base2, relative7) {
       var options2 = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : {};
       var skipNormalization = arguments[3];
       var target = {};
       if (!skipNormalization) {
         base2 = parse4(serialize(base2, options2), options2);
-        relative6 = parse4(serialize(relative6, options2), options2);
+        relative7 = parse4(serialize(relative7, options2), options2);
       }
       options2 = options2 || {};
-      if (!options2.tolerant && relative6.scheme) {
-        target.scheme = relative6.scheme;
-        target.userinfo = relative6.userinfo;
-        target.host = relative6.host;
-        target.port = relative6.port;
-        target.path = removeDotSegments(relative6.path || "");
-        target.query = relative6.query;
+      if (!options2.tolerant && relative7.scheme) {
+        target.scheme = relative7.scheme;
+        target.userinfo = relative7.userinfo;
+        target.host = relative7.host;
+        target.port = relative7.port;
+        target.path = removeDotSegments(relative7.path || "");
+        target.query = relative7.query;
       } else {
-        if (relative6.userinfo !== undefined || relative6.host !== undefined || relative6.port !== undefined) {
-          target.userinfo = relative6.userinfo;
-          target.host = relative6.host;
-          target.port = relative6.port;
-          target.path = removeDotSegments(relative6.path || "");
-          target.query = relative6.query;
+        if (relative7.userinfo !== undefined || relative7.host !== undefined || relative7.port !== undefined) {
+          target.userinfo = relative7.userinfo;
+          target.host = relative7.host;
+          target.port = relative7.port;
+          target.path = removeDotSegments(relative7.path || "");
+          target.query = relative7.query;
         } else {
-          if (!relative6.path) {
+          if (!relative7.path) {
             target.path = base2.path;
-            if (relative6.query !== undefined) {
-              target.query = relative6.query;
+            if (relative7.query !== undefined) {
+              target.query = relative7.query;
             } else {
               target.query = base2.query;
             }
           } else {
-            if (relative6.path.charAt(0) === "/") {
-              target.path = removeDotSegments(relative6.path);
+            if (relative7.path.charAt(0) === "/") {
+              target.path = removeDotSegments(relative7.path);
             } else {
               if ((base2.userinfo !== undefined || base2.host !== undefined || base2.port !== undefined) && !base2.path) {
-                target.path = "/" + relative6.path;
+                target.path = "/" + relative7.path;
               } else if (!base2.path) {
-                target.path = relative6.path;
+                target.path = relative7.path;
               } else {
-                target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative6.path;
+                target.path = base2.path.slice(0, base2.path.lastIndexOf("/") + 1) + relative7.path;
               }
               target.path = removeDotSegments(target.path);
             }
-            target.query = relative6.query;
+            target.query = relative7.query;
           }
           target.userinfo = base2.userinfo;
           target.host = base2.host;
@@ -20936,7 +21366,7 @@ var require_uri_all = __commonJS((exports, module) => {
         }
         target.scheme = base2.scheme;
       }
-      target.fragment = relative6.fragment;
+      target.fragment = relative7.fragment;
       return target;
     }
     function resolve13(baseURI, relativeURI, options2) {
@@ -26215,27 +26645,27 @@ var require_windows = __commonJS((exports, module) => {
     return checkPathExt(path, options2);
   };
   var isexe = function(path, options2, cb) {
-    fs33.stat(path, function(er, stat) {
+    fs34.stat(path, function(er, stat) {
       cb(er, er ? false : checkStat(stat, path, options2));
     });
   };
   var sync = function(path, options2) {
-    return checkStat(fs33.statSync(path), path, options2);
+    return checkStat(fs34.statSync(path), path, options2);
   };
   module.exports = isexe;
   isexe.sync = sync;
-  var fs33 = __require("fs");
+  var fs34 = __require("fs");
 });
 
 // node_modules/isexe/mode.js
 var require_mode = __commonJS((exports, module) => {
   var isexe = function(path, options2, cb) {
-    fs33.stat(path, function(er, stat) {
+    fs34.stat(path, function(er, stat) {
       cb(er, er ? false : checkStat(stat, options2));
     });
   };
   var sync = function(path, options2) {
-    return checkStat(fs33.statSync(path), options2);
+    return checkStat(fs34.statSync(path), options2);
   };
   var checkStat = function(stat, options2) {
     return stat.isFile() && checkMode(stat, options2);
@@ -26255,7 +26685,7 @@ var require_mode = __commonJS((exports, module) => {
   };
   module.exports = isexe;
   isexe.sync = sync;
-  var fs33 = __require("fs");
+  var fs34 = __require("fs");
 });
 
 // node_modules/isexe/index.js
@@ -26300,7 +26730,7 @@ var require_isexe = __commonJS((exports, module) => {
       }
     }
   };
-  var fs33 = __require("fs");
+  var fs34 = __require("fs");
   var core2;
   if (process.platform === "win32" || global.TESTING_WINDOWS) {
     core2 = require_windows();
@@ -26507,14 +26937,14 @@ var require_readShebang = __commonJS((exports, module) => {
     const buffer = Buffer.alloc(size);
     let fd;
     try {
-      fd = fs33.openSync(command, "r");
-      fs33.readSync(fd, buffer, 0, size, 0);
-      fs33.closeSync(fd);
+      fd = fs34.openSync(command, "r");
+      fs34.readSync(fd, buffer, 0, size, 0);
+      fs34.closeSync(fd);
     } catch (e) {
     }
     return shebangCommand(buffer.toString());
   };
-  var fs33 = __require("fs");
+  var fs34 = __require("fs");
   var shebangCommand = require_shebang_command();
   module.exports = readShebang;
 });
@@ -28698,11 +29128,11 @@ async function detectCommand(options2) {
 
 // dist/commands/sync.js
 init_logger();
-import {relative as relative5} from "path";
+import {relative as relative6} from "path";
 
 // dist/core/propagator.js
 var import_gray_matter3 = __toESM(require_gray_matter(), 1);
-import {promises as fs28} from "fs";
+import {promises as fs29} from "fs";
 import {resolve as resolve10} from "path";
 
 // node_modules/js-yaml/dist/js-yaml.mjs
@@ -31470,7 +31900,7 @@ class Propagator {
       resolvedTargets: []
     };
     const exists = await fileExists(generatedFile.path);
-    const existingStats = exists ? await fs28.lstat(generatedFile.path).catch(() => null) : null;
+    const existingStats = exists ? await fs29.lstat(generatedFile.path).catch(() => null) : null;
     const existingContent = exists && !existingStats?.isSymbolicLink() ? await readFileIfExists(generatedFile.path) : null;
     const existingTarget = existingStats?.isSymbolicLink() ? await readSymlinkTarget(generatedFile.path) : null;
     if (options2.managedState && !options2.dryRun) {
@@ -31501,7 +31931,7 @@ class Propagator {
     if (!options2.dryRun) {
       if (generatedFile.kind === "file") {
         if (existingStats?.isSymbolicLink()) {
-          await fs28.rm(generatedFile.path, { force: true }).catch(() => {
+          await fs29.rm(generatedFile.path, { force: true }).catch(() => {
           });
         }
         await writeFile(generatedFile.path, generatedFile.content || "");
@@ -31678,14 +32108,14 @@ ${content}
 
 // dist/core/managedState.js
 init_fs();
-import {promises as fs30} from "fs";
-import {dirname as dirname5, join as join7, relative as relative4, resolve as resolve11} from "path";
+import {promises as fs31} from "fs";
+import {dirname as dirname5, join as join8, relative as relative5, resolve as resolve11} from "path";
 var toPosixPath = function(value) {
   return value.replace(/\\/g, "/");
 };
 async function pathType(targetPath) {
   try {
-    const stat = await fs30.lstat(targetPath);
+    const stat = await fs31.lstat(targetPath);
     if (stat.isSymbolicLink()) {
       return "symlink";
     }
@@ -31695,20 +32125,20 @@ async function pathType(targetPath) {
   }
 }
 async function copyDirectory(src, dest) {
-  await fs30.mkdir(dest, { recursive: true });
-  const entries = await fs30.readdir(src, { withFileTypes: true });
+  await fs31.mkdir(dest, { recursive: true });
+  const entries = await fs31.readdir(src, { withFileTypes: true });
   for (const entry of entries) {
-    const srcPath = join7(src, entry.name);
-    const destPath = join7(dest, entry.name);
+    const srcPath = join8(src, entry.name);
+    const destPath = join8(dest, entry.name);
     if (entry.isDirectory()) {
       await copyDirectory(srcPath, destPath);
     } else if (entry.isSymbolicLink()) {
-      const target = await fs30.readlink(srcPath);
-      await fs30.mkdir(dirname5(destPath), { recursive: true });
-      await fs30.symlink(target, destPath);
+      const target = await fs31.readlink(srcPath);
+      await fs31.mkdir(dirname5(destPath), { recursive: true });
+      await fs31.symlink(target, destPath);
     } else {
-      await fs30.mkdir(dirname5(destPath), { recursive: true });
-      await fs30.copyFile(srcPath, destPath);
+      await fs31.mkdir(dirname5(destPath), { recursive: true });
+      await fs31.copyFile(srcPath, destPath);
     }
   }
 }
@@ -31717,14 +32147,14 @@ async function copyPath(src, dest) {
   if (!type2) {
     return;
   }
-  await fs30.mkdir(dirname5(dest), { recursive: true });
+  await fs31.mkdir(dirname5(dest), { recursive: true });
   if (type2 === "symlink") {
-    const target = await fs30.readlink(src);
-    await fs30.symlink(target, dest);
+    const target = await fs31.readlink(src);
+    await fs31.symlink(target, dest);
   } else if (type2 === "directory") {
     await copyDirectory(src, dest);
   } else {
-    await fs30.copyFile(src, dest);
+    await fs31.copyFile(src, dest);
   }
 }
 var MANAGED_STATE_FILE = "managed-state.json";
@@ -31738,11 +32168,11 @@ class ManagedStateStore {
     this.state = state;
   }
   static async open(projectPath) {
-    const agentInitDir = join7(projectPath, ".agentinit");
-    const statePath = join7(agentInitDir, MANAGED_STATE_FILE);
+    const agentInitDir = join8(projectPath, ".agentinit");
+    const statePath = join8(agentInitDir, MANAGED_STATE_FILE);
     const emptyState = { version: 1, entries: [] };
     try {
-      const raw = await fs30.readFile(statePath, "utf8");
+      const raw = await fs31.readFile(statePath, "utf8");
       const parsed = JSON.parse(raw);
       if (!parsed || parsed.version !== 1 || !Array.isArray(parsed.entries)) {
         return new ManagedStateStore(projectPath, emptyState);
@@ -31753,17 +32183,17 @@ class ManagedStateStore {
     }
   }
   get agentInitDir() {
-    return join7(this.projectPath, ".agentinit");
+    return join8(this.projectPath, ".agentinit");
   }
   get stateFilePath() {
-    return join7(this.agentInitDir, MANAGED_STATE_FILE);
+    return join8(this.agentInitDir, MANAGED_STATE_FILE);
   }
   get backupsDir() {
-    return join7(this.agentInitDir, BACKUPS_DIR);
+    return join8(this.agentInitDir, BACKUPS_DIR);
   }
   normalizeRelativePath(targetPath, preserveTrailingSlash = false) {
     const hasTrailingSlash = preserveTrailingSlash && /[\\/]$/.test(targetPath);
-    const relativePath = relative4(this.projectPath, resolve11(targetPath));
+    const relativePath = relative5(this.projectPath, resolve11(targetPath));
     const normalizedPath = toPosixPath(relativePath);
     if (hasTrailingSlash && normalizedPath) {
       return normalizedPath.endsWith("/") ? normalizedPath : `${normalizedPath}/`;
@@ -31781,14 +32211,14 @@ class ManagedStateStore {
     }
     if (type2 === "symlink") {
       try {
-        const backupLinkTarget = await fs30.readlink(targetPath);
+        const backupLinkTarget = await fs31.readlink(targetPath);
         return { backupLinkTarget };
       } catch {
         return {};
       }
     }
     const relativeTargetPath = this.normalizeRelativePath(targetPath);
-    const backupPath = join7(this.backupsDir, relativeTargetPath);
+    const backupPath = join8(this.backupsDir, relativeTargetPath);
     if (!await fileExists(backupPath)) {
       await copyPath(targetPath, backupPath);
     }
@@ -31835,8 +32265,8 @@ class ManagedStateStore {
     return [...paths6];
   }
   async save() {
-    await fs30.mkdir(this.agentInitDir, { recursive: true });
-    await fs30.writeFile(this.stateFilePath, JSON.stringify(this.state, null, 2), "utf8");
+    await fs31.mkdir(this.agentInitDir, { recursive: true });
+    await fs31.writeFile(this.stateFilePath, JSON.stringify(this.state, null, 2), "utf8");
   }
   async revertAll(options2 = {}) {
     const summary = {
@@ -31851,29 +32281,29 @@ class ManagedStateStore {
       const backupLinkTarget = entry.backupLinkTarget;
       if (entry.existedBefore && backupLinkTarget !== undefined) {
         if (!options2.dryRun) {
-          await fs30.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
-          await fs30.mkdir(dirname5(absolutePath), { recursive: true });
-          await fs30.symlink(backupLinkTarget, absolutePath);
+          await fs31.mkdir(dirname5(absolutePath), { recursive: true });
+          await fs31.symlink(backupLinkTarget, absolutePath);
         }
         summary.restored++;
       } else if (entry.existedBefore && backupPath && await fileExists(backupPath)) {
         if (!options2.dryRun) {
-          await fs30.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
           await copyPath(backupPath, absolutePath);
         }
         summary.restored++;
       } else {
         if (!options2.dryRun) {
-          await fs30.rm(absolutePath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(absolutePath, { recursive: true, force: true }).catch(() => {
           });
         }
         summary.removed++;
       }
       if (!options2.keepBackups && backupPath && await fileExists(backupPath)) {
         if (!options2.dryRun) {
-          await fs30.rm(backupPath, { recursive: true, force: true }).catch(() => {
+          await fs31.rm(backupPath, { recursive: true, force: true }).catch(() => {
           });
         }
         summary.backupsRemoved++;
@@ -31881,16 +32311,16 @@ class ManagedStateStore {
     }
     if (!options2.dryRun) {
       this.state.entries.length = 0;
-      await fs30.rm(this.stateFilePath, { force: true }).catch(() => {
+      await fs31.rm(this.stateFilePath, { force: true }).catch(() => {
       });
       if (!options2.keepBackups) {
-        await fs30.rm(this.backupsDir, { recursive: true, force: true }).catch(() => {
+        await fs31.rm(this.backupsDir, { recursive: true, force: true }).catch(() => {
         });
       }
       try {
-        const remainingEntries = await fs30.readdir(this.agentInitDir);
+        const remainingEntries = await fs31.readdir(this.agentInitDir);
         if (remainingEntries.length === 0) {
-          await fs30.rm(this.agentInitDir, { recursive: true, force: true });
+          await fs31.rm(this.agentInitDir, { recursive: true, force: true });
         }
       } catch {
       }
@@ -31940,7 +32370,7 @@ async function syncCommand(options2) {
         for (const change of result.changes) {
           const action = change.action === "created" ? "\u2795" : change.action === "updated" ? "\uD83D\uDCDD" : "\uD83D\uDCBE";
           const names = change.agents.map((id) => agentManager5.getAgentById(id)?.name || id).join(", ");
-          logger.info(`  ${action} ${relative5(cwd, change.file) || change.file}`);
+          logger.info(`  ${action} ${relative6(cwd, change.file) || change.file}`);
           logger.info(`     Agents: ${names}`);
         }
         if (options2.backup && result.changes.some((c) => c.action === "backed_up")) {
@@ -31971,7 +32401,7 @@ async function syncCommand(options2) {
 // dist/commands/apply.js
 init_colors();
 init_logger();
-import {relative as relative6} from "path";
+import {relative as relative7} from "path";
 
 // dist/types/index.js
 var MCPServerType;
@@ -32237,12 +32667,12 @@ class MCPParser {
 // dist/constants/mcp.js
 import {readFileSync as readFileSync2} from "fs";
 import {fileURLToPath} from "url";
-import {dirname as dirname6, join as join8} from "path";
+import {dirname as dirname6, join as join9} from "path";
 var getPackageVersion = function() {
   try {
     const __filename2 = fileURLToPath(import.meta.url);
     const __dirname2 = dirname6(__filename2);
-    const packageJsonPath = join8(__dirname2, "../../package.json");
+    const packageJsonPath = join9(__dirname2, "../../package.json");
     const packageJson = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
     return packageJson.version || "1.0.0";
   } catch {
@@ -40515,11 +40945,11 @@ class MCPVerifier {
 }
 
 // dist/core/gitignoreManager.js
-import {promises as fs33} from "fs";
-import {dirname as dirname8, join as join9} from "path";
+import {promises as fs34} from "fs";
+import {dirname as dirname8, join as join10} from "path";
 var normalizeIgnorePath = function(projectPath, value) {
-  const relative6 = value.startsWith(projectPath) ? value.slice(projectPath.length + 1) : value;
-  const normalized = relative6.replace(/\\/g, "/").replace(/^\/+/, "");
+  const relative7 = value.startsWith(projectPath) ? value.slice(projectPath.length + 1) : value;
+  const normalized = relative7.replace(/\\/g, "/").replace(/^\/+/, "");
   if (!normalized) {
     return normalized;
   }
@@ -40563,12 +40993,12 @@ var updateManagedBlock = function(existingContent, entries) {
   return content;
 };
 async function updateManagedIgnoreFile(projectPath, paths6, options2 = {}) {
-  const ignoreFile = options2.local ? join9(".git", "info", "exclude") : ".gitignore";
-  const ignoreFilePath = join9(projectPath, ignoreFile);
+  const ignoreFile = options2.local ? join10(".git", "info", "exclude") : ".gitignore";
+  const ignoreFilePath = join10(projectPath, ignoreFile);
   if (options2.local) {
-    const gitDir = join9(projectPath, ".git");
+    const gitDir = join10(projectPath, ".git");
     try {
-      const stat = await fs33.stat(gitDir);
+      const stat = await fs34.stat(gitDir);
       if (!stat.isDirectory()) {
         throw new Error;
       }
@@ -40579,21 +41009,21 @@ async function updateManagedIgnoreFile(projectPath, paths6, options2 = {}) {
   const normalizedPaths = [...new Set(paths6.map((path) => normalizeIgnorePath(projectPath, path)).filter(Boolean))].sort();
   let existingContent = "";
   try {
-    existingContent = await fs33.readFile(ignoreFilePath, "utf8");
+    existingContent = await fs34.readFile(ignoreFilePath, "utf8");
   } catch {
     existingContent = "";
   }
   const updatedContent = updateManagedBlock(existingContent, normalizedPaths);
-  await fs33.mkdir(dirname8(ignoreFilePath), { recursive: true });
-  await fs33.writeFile(ignoreFilePath, updatedContent, "utf8");
+  await fs34.mkdir(dirname8(ignoreFilePath), { recursive: true });
+  await fs34.writeFile(ignoreFilePath, updatedContent, "utf8");
   return ignoreFilePath;
 }
 async function removeManagedIgnoreBlock(projectPath, options2 = {}) {
-  const ignoreFile = options2.local ? join9(".git", "info", "exclude") : ".gitignore";
-  const ignoreFilePath = join9(projectPath, ignoreFile);
+  const ignoreFile = options2.local ? join10(".git", "info", "exclude") : ".gitignore";
+  const ignoreFilePath = join10(projectPath, ignoreFile);
   let content;
   try {
-    content = await fs33.readFile(ignoreFilePath, "utf8");
+    content = await fs34.readFile(ignoreFilePath, "utf8");
   } catch {
     return false;
   }
@@ -40609,13 +41039,13 @@ async function removeManagedIgnoreBlock(projectPath, options2 = {}) {
   const afterBlock = content.slice(endIndex + END_MARKER.length).replace(/^\n+/, "");
   let nextContent = `${beforeBlock}${afterBlock}`.replace(/\n{3,}/g, "\n\n").replace(/^\n+/, "");
   if (nextContent.trim() === "") {
-    await fs33.rm(ignoreFilePath, { force: true }).catch(() => {
+    await fs34.rm(ignoreFilePath, { force: true }).catch(() => {
     });
   } else {
     if (!nextContent.endsWith("\n")) {
       nextContent += "\n";
     }
-    await fs33.writeFile(ignoreFilePath, nextContent, "utf8");
+    await fs34.writeFile(ignoreFilePath, nextContent, "utf8");
   }
   return true;
 }
@@ -40626,12 +41056,12 @@ var END_MARKER = "# END AgentInit Generated Files";
 init_agentManager();
 init_skillsManager();
 init_fs();
-import {dirname as dirname9, join as join10} from "path";
+import {dirname as dirname9, join as join11} from "path";
 async function discoverProjectSkills(projectPath, skillsManager4) {
   const sources = [];
   const skills2 = new Map;
   for (const sourceDir of PROJECT_SKILL_SOURCE_DIRS) {
-    const absoluteSourceDir = join10(projectPath, sourceDir);
+    const absoluteSourceDir = join11(projectPath, sourceDir);
     if (!await fileExists(absoluteSourceDir)) {
       continue;
     }
@@ -40815,7 +41245,7 @@ async function applyProjectCommand(options2) {
           if (change.action === "backed_up")
             return;
           const names = change.agents.map((id) => agentManager7.getAgentById(id)?.name || id).join(", ");
-          logger.info(`  ${relative6(cwd, change.file) || change.file}`);
+          logger.info(`  ${relative7(cwd, change.file) || change.file}`);
           logger.info(`    Agents: ${names}`);
         });
       }
@@ -40833,7 +41263,7 @@ async function applyProjectCommand(options2) {
           installsByPath.set(item.path, existing);
         }
         for (const [path, details] of installsByPath) {
-          logger.info(`  ${relative6(cwd, path) || path}`);
+          logger.info(`  ${relative7(cwd, path) || path}`);
           logger.info(`    Agents: ${[...details.agents].join(", ")}`);
           logger.info(`    Skills: ${[...details.skills].join(", ")}`);
         }
@@ -41720,44 +42150,87 @@ var import_prompts3 = __toESM(require_prompts3(), 1);
 init_colors();
 init_logger();
 import {homedir as homedir7} from "os";
-import {relative as relative7, resolve as resolve13} from "path";
+import {relative as relative8, resolve as resolve13} from "path";
 
 // dist/utils/promptUtils.js
 var import_prompts2 = __toESM(require_prompts3(), 1);
-import {createRequire as createRequire2} from "module";
 init_logger();
-function enableUppercaseToggleAllForMultiselectPrompt() {
-  if (uppercaseToggleAllPatched) {
+function enableUppercaseToggleAllForMultiselectPrompt(prompt) {
+  if (prompt.__agentinitUppercaseToggleAllPatched || typeof prompt._ !== "function") {
     return;
   }
-  uppercaseToggleAllPatched = true;
-  try {
-    const MultiselectPrompt = require2("prompts/lib/elements/multiselect");
-    const prototype = MultiselectPrompt?.prototype;
-    if (!prototype || typeof prototype._ !== "function" || prototype.__agentinitUppercaseToggleAllPatched) {
+  const originalHandler = prompt._;
+  prompt._ = function agentinitMultiselectHandler(input, key) {
+    if (this.__agentinitHotkeyBusy) {
       return;
     }
-    const originalHandler = prototype._;
-    prototype._ = function agentinitMultiselectHandler(input, key) {
-      return originalHandler.call(this, input === "A" ? "a" : input, key);
-    };
-    Object.defineProperty(prototype, "__agentinitUppercaseToggleAllPatched", {
-      value: true,
-      configurable: false,
-      enumerable: false,
-      writable: false
-    });
-  } catch {
-  }
+    const normalizedInput = input === "A" ? "a" : input;
+    const hotkeyHandler = this.__agentinitHotkeys?.[normalizedInput] || this.__agentinitHotkeys?.[input];
+    if (hotkeyHandler) {
+      this.__agentinitHotkeyBusy = true;
+      Promise.resolve(hotkeyHandler(this, normalizedInput, key)).finally(() => {
+        this.__agentinitHotkeyBusy = false;
+        this.render?.();
+      });
+      return;
+    }
+    return originalHandler.call(this, normalizedInput, key);
+  };
+  Object.defineProperty(prompt, "__agentinitUppercaseToggleAllPatched", {
+    value: true,
+    configurable: false,
+    enumerable: false,
+    writable: false
+  });
 }
 async function promptMultiselect(options2) {
-  enableUppercaseToggleAllForMultiselectPrompt();
-  return import_prompts2.default({
+  const userOnRender = options2.onRenderPrompt;
+  const hint = options2.hint;
+  let requestedAction;
+  let promptInstance;
+  const closeWithCurrentSelection = (prompt) => {
+    if (typeof prompt.close !== "function") {
+      return false;
+    }
+    prompt.done = true;
+    prompt.aborted = false;
+    prompt.fire?.();
+    prompt.render?.();
+    prompt.out?.write("\n");
+    prompt.close();
+    return true;
+  };
+  const hotkeys = options2.hotkeys ? Object.fromEntries(Object.entries(options2.hotkeys).map(([key, handler]) => [
+    key,
+    (prompt, input, pressedKey) => handler({
+      prompt,
+      requestAction: (action) => {
+        requestedAction = action;
+      },
+      closeWithCurrentSelection: () => closeWithCurrentSelection(prompt)
+    }, input, pressedKey)
+  ])) : undefined;
+  const response = await import_prompts2.default({
     ...options2,
     type: "multiselect",
     instructions: options2.instructions ?? false,
-    hint: options2.hint ?? MULTISELECT_TOGGLE_ALL_HINT
+    hint: typeof hint === "function" ? hint() : hint ?? MULTISELECT_TOGGLE_ALL_HINT,
+    onRender() {
+      enableUppercaseToggleAllForMultiselectPrompt(this);
+      promptInstance = this;
+      if (hotkeys) {
+        this.__agentinitHotkeys = hotkeys;
+      } else {
+        delete this.__agentinitHotkeys;
+      }
+      this.hint = typeof hint === "function" ? hint() : hint ?? MULTISELECT_TOGGLE_ALL_HINT;
+      userOnRender?.(this);
+    }
   });
+  if (requestedAction) {
+    response.__agentinitAction = requestedAction;
+  }
+  return response;
 }
 async function selectBundlePlugins(entries, actionLabel, options2 = {}) {
   if (options2.selectAll) {
@@ -41781,9 +42254,7 @@ async function selectBundlePlugins(entries, actionLabel, options2 = {}) {
   }
   return response.plugins;
 }
-var require2 = createRequire2(import.meta.url);
 var MULTISELECT_TOGGLE_ALL_HINT = "Press Space to select, A to select or deselect all, then Enter to confirm.";
-var uppercaseToggleAllPatched = false;
 
 // dist/commands/skills.js
 init_skillsManager();
@@ -41792,11 +42263,84 @@ init_marketplaceRegistry();
 init_agentManager();
 init_installLock();
 init_fs();
+
+// dist/utils/lockSource.js
+function lockSourceToSpecifier(source) {
+  if (source.type === "marketplace" && source.marketplace && source.pluginName) {
+    return {
+      source: source.pluginName,
+      from: source.marketplace,
+      ...source.prefix ? { prefix: source.prefix } : {}
+    };
+  }
+  if (source.type === "github") {
+    if (source.owner && source.repo) {
+      return {
+        source: source.subpath ? `${source.owner}/${source.repo}/${source.subpath}` : `${source.owner}/${source.repo}`,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "gitlab") {
+    if (source.owner && source.repo) {
+      const prefix = `gitlab:${source.owner}/${source.repo}`;
+      return {
+        source: source.subpath ? `${prefix}//${source.subpath}` : prefix,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "bitbucket") {
+    if (source.owner && source.repo) {
+      const prefix = `bitbucket:${source.owner}/${source.repo}`;
+      return {
+        source: source.subpath ? `${prefix}/${source.subpath}` : prefix,
+        ...source.prefix ? { prefix: source.prefix } : {}
+      };
+    }
+    if (source.url) {
+      return { source: source.url, ...source.prefix ? { prefix: source.prefix } : {} };
+    }
+  }
+  if (source.type === "local" && source.path) {
+    return { source: source.path, ...source.prefix ? { prefix: source.prefix } : {} };
+  }
+  return null;
+}
+function formatLockSource(source) {
+  const specifier = lockSourceToSpecifier(source);
+  if (!specifier) {
+    return source.type;
+  }
+  const formatted = specifier.from ? `${specifier.from}/${specifier.source}` : specifier.source;
+  return specifier.prefix ? `${formatted} [prefix: ${specifier.prefix}]` : formatted;
+}
+
+// dist/commands/skills.js
 init_skills();
+var normalizeSkillPrefix = function(prefix) {
+  return prefix?.trim() ?? "";
+};
+var matchesSelectedSkillName = function(skillName, selectedNames, prefix) {
+  if (selectedNames.has(skillName.toLowerCase())) {
+    return true;
+  }
+  const normalizedPrefix = normalizeSkillPrefix(prefix);
+  if (!normalizedPrefix) {
+    return false;
+  }
+  return selectedNames.has(`${normalizedPrefix}${skillName}`.toLowerCase());
+};
 function registerSkillsCommand(program2) {
   const marketplaceHelp = getMarketplaceIds().join(", ");
   const skills3 = program2.command("skills").description("Manage agent skills");
-  skills3.command("add <source>").description("Add skills from a marketplace, GitHub repo, or local path").option("--from <marketplace>", `Marketplace source override (available: ${marketplaceHelp})`).option("-g, --global", "Install skills globally").option("-a, --agent <agents...>", "Target specific agent(s)").option("-s, --skill <names...>", "Install only specific skills by name").option("-l, --list", "List available skills from the source without installing").option("--all", "Select all bundled plugins when the source contains multiple plugins").option("--copy", "Copy skill files instead of symlinking").option("-y, --yes", "Skip prompts, auto-detect project-configured agents, and apply available skill updates").action(async (source, options2) => {
+  skills3.command("add <source>").description("Add skills from a marketplace, hosted Git repo, or local path").option("--from <marketplace>", `Marketplace source override (available: ${marketplaceHelp})`).option("-g, --global", "Install skills globally").option("-a, --agent <agents...>", "Target specific agent(s)").option("-s, --skill <names...>", "Install only specific skills by name").option("-l, --list", "List available skills from the source without installing").option("--all", "Select all bundled plugins when the source contains multiple plugins").option("--copy", "Copy skill files instead of symlinking").option("--prefix <prefix>", "Prefix installed skill names").option("--no-scan", "Skip security scanning before installation").option("--allow-risky", "Install even if scanning finds high-risk patterns").option("-y, --yes", "Skip prompts, auto-detect project-configured agents, and apply available skill updates").action(async (source, options2) => {
     logger.titleBox("AgentInit  Skills");
     const agentManager9 = new AgentManager;
     const skillsManager5 = new SkillsManager(agentManager9);
@@ -41875,11 +42419,12 @@ function registerSkillsCommand(program2) {
     let targetAgents = options2.agent;
     let targetGlobal = options2.global;
     let selectedSkillNames = options2.skill;
+    let installPrefix = options2.prefix;
     if (!options2.yes && (!selectedSkillNames || selectedSkillNames.length === 0) && preparedSkills.length > 1) {
       if (selectedPluginNames && selectedPluginNames.length > 1) {
         logger.info("Multiple bundled plugins selected; installing all skills from each selected plugin. Use --skill to filter by skill name.");
       } else {
-        const skillSelection = await resolveInteractiveSkillSelection(preparedSkills);
+        const skillSelection = await resolveInteractiveSkillSelection(preparedSkills, installPrefix);
         if (skillSelection.aborted) {
           await skillsManager5.discardPreparedSource(source, process.cwd(), {
             from: options2.from
@@ -41887,11 +42432,12 @@ function registerSkillsCommand(program2) {
           return;
         }
         selectedSkillNames = skillSelection.skills;
+        installPrefix = skillSelection.prefix;
       }
     }
     if (!targetAgents && !options2.yes) {
       const selectedSkillNameSet = selectedSkillNames && selectedSkillNames.length > 0 ? new Set(selectedSkillNames.map((name) => name.toLowerCase())) : undefined;
-      const filteredPreviewSkills = selectedSkillNameSet ? preparedSkills.filter((skill) => selectedSkillNameSet.has(skill.name.toLowerCase())) : preparedSkills;
+      const filteredPreviewSkills = selectedSkillNameSet ? preparedSkills.filter((skill) => matchesSelectedSkillName(skill.name, selectedSkillNameSet, installPrefix)) : preparedSkills;
       const selection = await resolveInteractiveSkillTargets(skillsManager5, agentManager9, source, process.cwd(), {
         from: options2.from,
         global: options2.global,
@@ -41924,7 +42470,10 @@ function registerSkillsCommand(program2) {
       ...targetGlobal !== undefined ? { global: targetGlobal } : {},
       ...targetAgents !== undefined ? { agents: targetAgents } : {},
       ...selectedSkillNames !== undefined ? { skills: selectedSkillNames } : {},
+      ...installPrefix !== undefined ? { prefix: installPrefix } : {},
       ...options2.copy !== undefined ? { copy: options2.copy } : {},
+      ...options2.scan !== undefined ? { scan: options2.scan } : {},
+      ...options2.allowRisky !== undefined ? { allowRisky: options2.allowRisky } : {},
       ...pluginName !== undefined ? { pluginName } : {},
       ...options2.yes !== undefined ? { yes: options2.yes } : {},
       ...confirmUpdate !== undefined ? { confirmUpdate } : {}
@@ -41983,7 +42532,7 @@ function registerSkillsCommand(program2) {
       const mode = skill.mode === "symlink" ? " (canonical)" : "";
       const scope = skill.scope === "global" ? " [global]" : "";
       logger.info(`\n  ${green(skill.name)} - ${skill.description}${scope}${mode}`);
-      logger.info(`    Path: ${relative7(process.cwd(), skill.path) || skill.path}`);
+      logger.info(`    Path: ${relative8(process.cwd(), skill.path) || skill.path}`);
       logger.info(`    Agents: ${[...skill.agents].join(", ")}`);
     }
   });
@@ -42081,6 +42630,7 @@ Dry run \u2014 no changes made.`));
           const skillsManager5 = new SkillsManager(agentManager9);
           const result = await skillsManager5.addFromSource(sourceString.source, entry.projectPath, {
             ...sourceString.from ? { from: sourceString.from } : {},
+            ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
             agents: entry.agents,
             global: entry.scope === "global",
             skills: [name],
@@ -42147,6 +42697,7 @@ Dry run \u2014 no changes made.`));
           try {
             const result = await skillsManager5.addFromSource(sourceString.source, cwd, {
               ...sourceString.from ? { from: sourceString.from } : {},
+              ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
               agents: entry.agents,
               global: entry.scope === "global",
               skills: [name],
@@ -42197,6 +42748,7 @@ Dry run \u2014 no changes made.`));
           try {
             const result = await skillsManager5.addFromSource(sourceString.source, cwd, {
               ...sourceString.from ? { from: sourceString.from } : {},
+              ...sourceString.prefix ? { prefix: sourceString.prefix } : {},
               agents: entry.agents,
               global: entry.scope === "global",
               skills: [entry.name],
@@ -42218,24 +42770,7 @@ Dry run \u2014 no changes made.`));
   });
 }
 var lockSourceToString = function(source) {
-  if (source.type === "marketplace" && source.marketplace && source.pluginName) {
-    return { source: source.pluginName, from: source.marketplace };
-  }
-  if (source.type === "github") {
-    if (source.owner && source.repo) {
-      if (source.subpath) {
-        return { source: `${source.owner}/${source.repo}/${source.subpath}` };
-      }
-      return { source: `${source.owner}/${source.repo}` };
-    }
-    if (source.url) {
-      return { source: source.url };
-    }
-  }
-  if (source.type === "local" && source.path) {
-    return { source: source.path };
-  }
-  return null;
+  return lockSourceToSpecifier(source);
 };
 async function resolveInteractiveSkillTargets(skillsManager5, agentManager9, source, projectPath, options2) {
   let installGlobal = !!options2.global;
@@ -42309,23 +42844,57 @@ async function resolveInteractiveSkillTargets(skillsManager5, agentManager9, sou
   }
   return selection;
 }
-async function resolveInteractiveSkillSelection(skills3) {
-  const response = await promptMultiselect({
-    name: "skills",
-    message: `Select skills to install (${skills3.length} found):`,
-    min: 1,
-    choices: skills3.map((skill) => ({
-      title: skill.name,
-      value: skill.name,
-      description: skill.description,
-      selected: true
-    }))
-  });
-  if (!response.skills || response.skills.length === 0) {
-    logger.info("No skills selected. Aborting.");
-    return { aborted: true };
+var formatSkillSelectionHint = function(prefix) {
+  return `Press Space to select, A to select or deselect all, p to edit prefix, then Enter to confirm. Prefix: "${prefix}"`;
+};
+async function resolveInteractiveSkillSelection(skills3, initialPrefix) {
+  let prefix = initialPrefix ?? "";
+  let selectedSkills = new Set(skills3.map((skill) => skill.name));
+  const promptForPrefix = async () => {
+    const response = await import_prompts3.default({
+      type: "text",
+      name: "prefix",
+      message: "Prefix to prepend to installed skill names:",
+      initial: prefix
+    });
+    if (typeof response.prefix === "string") {
+      prefix = response.prefix;
+    }
+  };
+  const requestPrefixEdit = (controls) => {
+    controls.requestAction("edit-prefix");
+    controls.closeWithCurrentSelection();
+  };
+  while (true) {
+    const response = await promptMultiselect({
+      name: "skills",
+      message: `Select skills to install (${skills3.length} found):`,
+      min: 1,
+      hint: () => formatSkillSelectionHint(prefix),
+      hotkeys: {
+        p: requestPrefixEdit,
+        P: requestPrefixEdit
+      },
+      choices: skills3.map((skill) => ({
+        title: skill.name,
+        value: skill.name,
+        description: skill.description,
+        selected: selectedSkills.has(skill.name)
+      }))
+    });
+    if (response.skills && response.skills.length > 0) {
+      selectedSkills = new Set(response.skills);
+    }
+    if (response.__agentinitAction === "edit-prefix") {
+      await promptForPrefix();
+      continue;
+    }
+    if (!response.skills || response.skills.length === 0) {
+      logger.info("No skills selected. Aborting.");
+      return { aborted: true };
+    }
+    return { skills: response.skills, prefix };
   }
-  return { skills: response.skills };
 }
 async function getDetectedSkillGroups(agentManager9, projectPath, global3) {
   const detectedAgents = (await agentManager9.detectAgents(projectPath)).map((entry) => entry.agent);
@@ -42421,7 +42990,7 @@ var formatSkillsDir = function(projectPath, dir) {
   const normalizedProjectPath = projectPath.replace(/\\/g, "/");
   const normalizedHome = homedir7().replace(/\\/g, "/");
   if (normalizedDir.startsWith(`${normalizedProjectPath}/`)) {
-    return `${relative7(projectPath, dir).replace(/\\/g, "/").replace(/\/?$/, "/")}`;
+    return `${relative8(projectPath, dir).replace(/\\/g, "/").replace(/\/?$/, "/")}`;
   }
   if (normalizedDir.startsWith(`${normalizedHome}/`)) {
     return normalizedDir.replace(normalizedHome, "~");
@@ -42633,7 +43202,7 @@ var displayInstallResult = function(result, spinner, agentManager9, skillsManage
       byPath.set(path, existing);
     }
     for (const [path, details] of byPath) {
-      logger.info(`  ${relative7(process.cwd(), path) || path}`);
+      logger.info(`  ${relative8(process.cwd(), path) || path}`);
       logger.info(`    Agents: ${[...details.agents].join(", ")}`);
       logger.info(`    Skills: ${green(String(details.skills.size))} installed (${[...details.skills].join(", ")})`);
     }
@@ -42649,7 +43218,7 @@ var displayInstallResult = function(result, spinner, agentManager9, skillsManage
       byPathUpdated.set(path, existing);
     }
     for (const [path, details] of byPathUpdated) {
-      logger.info(`  ${relative7(process.cwd(), path) || path}`);
+      logger.info(`  ${relative8(process.cwd(), path) || path}`);
       logger.info(`    Agents: ${[...details.agents].join(", ")}`);
       logger.info(`    Skills: ${yellow(String(details.skills.size))} updated (${[...details.skills].join(", ")})`);
     }
@@ -42875,7 +43444,7 @@ var registerAddCommand = function(mcp) {
         });
         try {
           const lock = new InstallLock;
-          const lockSource = { type: "local" };
+          const lockSource2 = { type: "local" };
           for (const plan of plans) {
             for (const server of plan.servers) {
               await lock.recordMcp({
@@ -42884,7 +43453,7 @@ var registerAddCommand = function(mcp) {
                 projectPath: cwd,
                 agents: [plan.agent.id],
                 scope: plan.isGlobal ? "global" : "project",
-                source: lockSource,
+                source: lockSource2,
                 configPath: plan.configPath,
                 serverType: server.type,
                 ...server.command ? { command: server.command } : {},
@@ -43572,7 +44141,7 @@ function registerRulesCommand(program2) {
 // dist/commands/plugins.js
 var import_prompts4 = __toESM(require_prompts3(), 1);
 import {homedir as homedir8} from "os";
-import {dirname as dirname10, relative as relative8, resolve as resolve14} from "path";
+import {dirname as dirname10, relative as relative9, resolve as resolve14} from "path";
 init_logger();
 init_pluginManager();
 init_agentManager();
@@ -43925,7 +44494,7 @@ function registerPluginsCommand(program2) {
 }
 var formatPathForDisplay = function(pathValue, projectPath) {
   if (pathValue.startsWith(`${projectPath}/`)) {
-    return relative8(projectPath, pathValue) || ".";
+    return relative9(projectPath, pathValue) || ".";
   }
   const homePrefix = `${process.env.HOME || ""}/`;
   if (homePrefix !== "/" && pathValue.startsWith(homePrefix)) {
@@ -44327,20 +44896,7 @@ var formatKind = function(kind) {
   }
 };
 var formatSource = function(entry) {
-  const src = entry.source;
-  if (src.type === "marketplace" && src.marketplace) {
-    return `${src.marketplace}/${src.pluginName || ""}`;
-  }
-  if (src.type === "github") {
-    if (src.owner && src.repo) {
-      return src.subpath ? `${src.owner}/${src.repo}/${src.subpath}` : `${src.owner}/${src.repo}`;
-    }
-    return src.url || "github";
-  }
-  if (src.type === "local" && src.path) {
-    return src.path;
-  }
-  return src.type;
+  return formatLockSource(entry.source);
 };
 function registerLockCommand(program2) {
   const lock = program2.command("lock").description("View and manage the global install lockfile");