skillfish 1.0.0

package/LICENSE

@@ -0,0 +1,17 @@
+GNU AFFERO GENERAL PUBLIC LICENSE
+Version 3, 19 November 2007
+
+Copyright (c) 2024-2026 Graeme Knox
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.

package/README.md

@@ -0,0 +1,192 @@
+# skillfish
+
+Install AI agent skills from GitHub with a single command.
+
+```bash
+npx skillfish owner/repo
+```
+
+## Overview
+
+One command installs skills to **all detected agents**:
+
+| Agent | Skills Directory |
+|-------|------------------|
+| Claude Code | `~/.claude/skills/` |
+| Cursor | `~/.cursor/skills/` |
+| Windsurf | `~/.codeium/windsurf/skills/` |
+| Codex | `~/.codex/skills/` |
+| GitHub Copilot | `~/.github/skills/` |
+| Gemini CLI | `~/.gemini/skills/` |
+| OpenCode | `~/.opencode/skills/` |
+| Goose | `~/.goose/skills/` |
+| Amp | `~/.agents/skills/` |
+| Roo Code | `~/.roo/skills/` |
+| Kiro CLI | `~/.kiro/skills/` |
+| Kilo Code | `~/.kilocode/skills/` |
+| Trae | `~/.trae/skills/` |
+| Cline | `~/.cline/skills/` |
+| Antigravity | `~/.gemini/antigravity/skills/` |
+| Droid | `~/.factory/skills/` |
+| Clawdbot | `~/.clawdbot/skills/` |
+
+## Usage
+
+### Install Skills
+
+```bash
+# Install a skill (auto-discovers SKILL.md location)
+npx skillfish add owner/repo
+
+# Full path from GitHub (plugin/skill syntax)
+npx skillfish add owner/repo/plugin/skill
+
+# Specify explicit path
+npx skillfish add owner/repo --path path/to/skill
+
+# Install all skills from a repo (non-interactive)
+npx skillfish add owner/repo --all
+
+# Overwrite existing skills
+npx skillfish add owner/repo --force
+
+# Skip confirmation prompt
+npx skillfish add owner/repo --yes
+```
+
+### List Skills
+
+```bash
+# Interactive agent and location picker
+npx skillfish list
+
+# List global skills only
+npx skillfish list --global
+
+# List project skills only
+npx skillfish list --project
+
+# List skills for a specific agent
+npx skillfish list --agent "Claude Code"
+```
+
+### Remove Skills
+
+```bash
+# Interactive skill picker
+npx skillfish remove
+
+# Remove a skill by name
+npx skillfish remove my-skill
+
+# Remove all installed skills
+npx skillfish remove --all
+
+# Remove from current project only
+npx skillfish remove my-skill --project
+
+# Remove from home directory only
+npx skillfish remove my-skill --global
+
+# Remove from specific agent
+npx skillfish remove my-skill --agent "Claude Code"
+
+# Skip confirmation prompt
+npx skillfish remove my-skill --yes
+```
+
+## Interactive Selection
+
+When a repo contains multiple skills, you'll get an interactive multi-select menu with skill names and descriptions from frontmatter:
+
+```
+◆  Select skills to install
+│  ◻ Frontend Design - Create distinctive, production-grade frontend interfaces
+│  ◻ Agent Browser - Browser automation using Vercel's agent-browser CLI
+│  ◻ Git Worktree - Manage Git worktrees for isolated parallel development
+│  ...
+└
+```
+
+Use `--all` to install all skills non-interactively (useful for automation).
+
+## Examples
+
+```bash
+# Install from a skill repo with SKILL.md at root
+npx skillfish add user/my-skill
+
+# Install using full path from GitHub
+npx skillfish add EveryInc/compound-engineering-plugin/compound-engineering/frontend-design
+
+# Install from a plugin repo with explicit path
+npx skillfish add org/plugin-repo --path plugins/my-plugin/skills/skill-name
+
+# Install all skills non-interactively
+npx skillfish add org/plugin-repo --all --yes
+
+# Force reinstall
+npx skillfish add user/skill --force
+
+# JSON output for automation
+npx skillfish add owner/repo --json
+```
+
+## Discovery
+
+The CLI searches these locations for `SKILL.md`:
+1. Repository root
+2. `.claude/skills/{repo}/`
+3. `skills/{repo}/`
+4. `plugins/{repo}/skills/{repo}/`
+
+Use `--path` to skip discovery and specify the exact location.
+
+## Telemetry
+
+This CLI collects anonymous, aggregate install counts to understand skill popularity. No personally identifiable information is collected.
+
+**What is collected:**
+- Skill identifier (e.g., `owner/repo/skill-name`)
+- Incremented install count
+
+**What is NOT collected:**
+- IP addresses
+- User identifiers
+- System information
+- Usage patterns
+
+To opt out, set `DO_NOT_TRACK=1` in your environment:
+
+```bash
+DO_NOT_TRACK=1 npx skillfish owner/repo
+```
+
+Telemetry is also automatically disabled in CI environments (`CI=true`).
+
+## Exit Codes
+
+Exit codes help agents and scripts understand command results without parsing error messages.
+
+| Code | Name | Meaning |
+|------|------|---------|
+| 0 | Success | Command completed successfully |
+| 1 | General Error | Unspecified error |
+| 2 | Invalid Args | Invalid arguments or options provided |
+| 3 | Network Error | Network failure (timeout, rate limit) |
+| 4 | Not Found | Requested resource not found (skill, agent, repo) |
+
+JSON output includes `exit_code` for programmatic access:
+
+```bash
+skillfish add owner/repo --json
+# Output includes: "exit_code": 0 (or error code)
+```
+
+## Contributing
+
+Contributions welcome. See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
+
+## License
+
+AGPL-3.0

package/dist/commands/add.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `skillfish add` command - Install a skill from a GitHub repository.
+ */
+import { Command } from 'commander';
+export declare const addCommand: Command;

package/dist/commands/add.js

@@ -0,0 +1,477 @@
+/**
+ * `skillfish add` command - Install a skill from a GitHub repository.
+ */
+import { Command } from 'commander';
+import { homedir } from 'os';
+import { dirname, basename } from 'path';
+import * as p from '@clack/prompts';
+import pc from 'picocolors';
+import { trackInstall } from '../telemetry.js';
+import { isValidPath, parseFrontmatter, deriveSkillName, toTitleCase, truncate, batchMap, createJsonOutput, isInputTTY, isTTY, } from '../utils.js';
+import { getDetectedAgents, AGENT_CONFIGS } from '../lib/agents.js';
+import { findAllSkillMdFiles, fetchSkillMdContent, SKILL_FILENAME, RateLimitError, RepoNotFoundError, NetworkError, GitHubApiError, } from '../lib/github.js';
+import { installSkill } from '../lib/installer.js';
+import { EXIT_CODES, isValidName } from '../lib/constants.js';
+// === Command Definition ===
+export const addCommand = new Command('add')
+    .description('Install a skill from a GitHub repository')
+    .argument('<repo>', 'GitHub repository (owner/repo or owner/repo/plugin/skill)')
+    .option('--force', 'Overwrite existing skills without prompting')
+    .option('-y, --yes', 'Skip all confirmation prompts')
+    .option('--all', 'Install all skills found in the repository')
+    .option('--project', 'Install to current project (./.claude)')
+    .option('--global', 'Install to home directory (~/.claude)')
+    .option('--path <path>', 'Path to a specific skill in the repository')
+    .helpOption('-h, --help', 'Display help for command')
+    .addHelpText('after', `
+Examples:
+  $ skillfish add owner/repo                  Install from a repository
+  $ skillfish add owner/repo --all            Install all skills in repo
+  $ skillfish add owner/repo/plugin/skill     Install a specific skill
+  $ skillfish add owner/repo --path path/to   Install skill at specific path
+  $ skillfish add owner/repo --project        Install to current project only`)
+    .action(async (repoArg, options, command) => {
+    const jsonMode = command.parent?.opts().json ?? false;
+    const jsonOutput = createJsonOutput();
+    const version = command.parent?.opts().version ?? '0.0.0';
+    // Helper to add error and optionally output JSON
+    function addError(message) {
+        jsonOutput.errors.push(message);
+        jsonOutput.success = false;
+    }
+    function outputJsonAndExit(exitCode) {
+        jsonOutput.exit_code = exitCode;
+        console.log(JSON.stringify(jsonOutput, null, 2));
+        process.exit(exitCode);
+    }
+    /**
+     * Unified error handler that handles both JSON and TTY modes.
+     * In JSON mode: adds error to output and exits with JSON.
+     * In TTY mode: logs error to console and exits.
+     * @param useClackLog - Use p.log.error() instead of console.error()
+     */
+    function exitWithError(message, exitCode, useClackLog = false) {
+        if (jsonMode) {
+            addError(message);
+            outputJsonAndExit(exitCode);
+        }
+        if (useClackLog) {
+            p.log.error(message);
+        }
+        else {
+            console.error(message);
+        }
+        process.exit(exitCode);
+    }
+    // Show banner and intro (TTY only, not in JSON mode)
+    if (isTTY() && !jsonMode) {
+        console.log();
+        console.log(pc.cyan('     ≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋'));
+        console.log(`       ${pc.cyan('><>')}  ${pc.bold('SKILL FISH')}  ${pc.cyan('><>')}`);
+        console.log(pc.cyan('     ≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋≋'));
+        console.log();
+        p.intro(`${pc.bgCyan(pc.black(' skillfish '))} ${pc.dim(`v${version}`)}`);
+    }
+    const force = options.force ?? false;
+    const trustSource = options.yes ?? false;
+    const installAll = options.all ?? false;
+    const projectFlag = options.project ?? false;
+    const globalFlag = options.global ?? false;
+    let explicitPath = options.path ?? null;
+    // Validate --path if provided
+    if (explicitPath !== null) {
+        if (!isValidPath(explicitPath)) {
+            exitWithError('Invalid --path value. Path must be relative and contain only safe characters.', EXIT_CODES.INVALID_ARGS);
+        }
+    }
+    // Parse repo format - supports both owner/repo and owner/repo/plugin/skill
+    const parts = repoArg.split('/');
+    let owner;
+    let repo;
+    if (parts.length === 2) {
+        [owner, repo] = parts;
+    }
+    else if (parts.length === 4) {
+        const [o, r, plugin, skill] = parts;
+        owner = o;
+        repo = r;
+        // Security: validate plugin and skill names
+        if (!isValidName(plugin) || !isValidName(skill)) {
+            exitWithError('Invalid plugin or skill name. Use only alphanumeric characters, dots, hyphens, and underscores.', EXIT_CODES.INVALID_ARGS);
+        }
+        explicitPath = explicitPath || `plugins/${plugin}/skills/${skill}`;
+        if (!jsonMode) {
+            console.log(`Installing skill from: ${plugin}/${skill}`);
+        }
+    }
+    else {
+        exitWithError('Invalid format. Use: owner/repo or owner/repo/plugin/skill', EXIT_CODES.INVALID_ARGS);
+    }
+    // Validate owner/repo (security: prevent injection)
+    if (!owner || !repo || !isValidName(owner) || !isValidName(repo)) {
+        exitWithError('Invalid repository format. Use: owner/repo', EXIT_CODES.INVALID_ARGS);
+    }
+    // 1. Discover or select skills
+    const skillPaths = explicitPath
+        ? [explicitPath]
+        : await discoverSkillPaths(owner, repo, installAll, jsonMode, jsonOutput);
+    if (!skillPaths || skillPaths.length === 0) {
+        if (jsonMode) {
+            outputJsonAndExit(EXIT_CODES.NOT_FOUND);
+        }
+        process.exit(EXIT_CODES.NOT_FOUND);
+    }
+    // 2. Determine install location (global vs project)
+    const baseDir = await selectInstallLocation(projectFlag, globalFlag, jsonMode);
+    // 3. Select agents to install to
+    const detected = getDetectedAgents();
+    if (detected.length === 0) {
+        const errorMsg = 'No agents detected. Install Claude Code, Cursor, or another supported agent first.';
+        if (jsonMode) {
+            addError(errorMsg);
+            outputJsonAndExit(EXIT_CODES.GENERAL_ERROR);
+        }
+        p.log.error(errorMsg);
+        p.outro(pc.dim('https://skill.fish/agents'));
+        process.exit(EXIT_CODES.GENERAL_ERROR);
+    }
+    let targetAgents;
+    if (!isInputTTY() || jsonMode) {
+        // Non-TTY or JSON mode: use all detected agents
+        if (!jsonMode) {
+            console.log(`Installing to ${detected.length} agent(s): ${detected.map((a) => a.name).join(', ')}`);
+        }
+        targetAgents = detected;
+    }
+    else {
+        // Interactive: let user choose from detected agents
+        const isLocal = baseDir !== homedir();
+        targetAgents = await selectAgents(detected, isLocal, jsonMode);
+    }
+    // Install each selected skill
+    let totalInstalled = 0;
+    let totalSkipped = 0;
+    // SECURITY: Ask for confirmation before installation (unless --yes is used)
+    // Single confirmation for all selected skills
+    if (!trustSource && !jsonMode && isInputTTY()) {
+        const skillNames = skillPaths.map((sp) => deriveSkillName(sp, repo));
+        const shouldInstall = await confirmInstallBatch(owner, repo, skillNames);
+        if (!shouldInstall) {
+            for (const skillName of skillNames) {
+                p.log.warn(`Skipped ${pc.bold(skillName)} (not confirmed)`);
+                jsonOutput.skipped.push({ skill: skillName, agent: 'all', reason: 'User declined' });
+            }
+            p.outro(pc.dim('Cancelled'));
+            process.exit(EXIT_CODES.SUCCESS);
+        }
+    }
+    for (const skillPath of skillPaths) {
+        const skillName = deriveSkillName(skillPath, repo);
+        // Show install progress
+        let spinner = null;
+        if (!jsonMode) {
+            p.log.step(`Installing ${pc.bold(skillName)}`);
+            spinner = p.spinner();
+            spinner.start(`Downloading ${skillName}...`);
+        }
+        const result = await installSkill(owner, repo, skillPath, skillName, targetAgents, {
+            force,
+            baseDir,
+        });
+        if (spinner) {
+            if (result.failed) {
+                spinner.stop(pc.red(`${SKILL_FILENAME} not found`));
+            }
+            else {
+                spinner.stop(pc.green('Installed'));
+            }
+        }
+        // Handle result
+        if (result.failed) {
+            if (jsonMode) {
+                addError(`Install failed: ${result.failureReason}`);
+            }
+            else {
+                console.error(pc.red(`Error: ${result.failureReason}`));
+            }
+            continue;
+        }
+        // Log installed/skipped for this skill
+        const isLocal = baseDir !== homedir();
+        const pathPrefix = isLocal ? '.' : '~';
+        for (const installed of result.installed) {
+            if (!jsonMode) {
+                const displayPath = `${pathPrefix}/${AGENT_CONFIGS.find((c) => c.name === installed.agent)?.dir ?? 'skills'}/${skillName}`;
+                console.log(`  ${pc.green('✓')} ${installed.agent} ${pc.dim(`→ ${displayPath}`)}`);
+            }
+            jsonOutput.installed.push(installed);
+        }
+        for (const skipped of result.skipped) {
+            if (!jsonMode) {
+                console.log(`  ${pc.yellow('●')} ${skipped.agent} ${pc.dim('(already installed)')}`);
+            }
+            jsonOutput.skipped.push(skipped);
+        }
+        // Add warnings as errors in JSON output
+        for (const warning of result.warnings) {
+            jsonOutput.errors.push(warning);
+            if (!jsonMode) {
+                console.log(`  ${pc.yellow('!')} ${warning}`);
+            }
+        }
+        totalInstalled += result.installed.length;
+        totalSkipped += result.skipped.length;
+        // Track successful installs (fire-and-forget telemetry)
+        if (result.installed.length > 0) {
+            // Construct github value to match skills.github column format: owner/repo/path/to/skill
+            const skillDir = skillPath.replace(/\/?SKILL\.md$/i, '').replace(/^\.?\/?/, '');
+            const github = skillDir ? `${owner}/${repo}/${skillDir}` : `${owner}/${repo}`;
+            trackInstall(github);
+        }
+    }
+    // Summary
+    if (jsonMode) {
+        outputJsonAndExit(EXIT_CODES.SUCCESS);
+    }
+    console.log();
+    if (totalInstalled > 0) {
+        p.outro(pc.green(`Done! Installed ${totalInstalled} skill${totalInstalled === 1 ? '' : 's'}`));
+    }
+    else if (totalSkipped > 0) {
+        p.outro(pc.yellow(`Skipped ${totalSkipped} existing skill${totalSkipped === 1 ? '' : 's'} - use --force to overwrite`));
+    }
+    else {
+        p.outro(pc.yellow('No skills installed'));
+    }
+    process.exit(EXIT_CODES.SUCCESS);
+});
+// === Helper Functions ===
+async function selectInstallLocation(projectFlag, globalFlag, jsonMode) {
+    // If flag specified, use it
+    if (projectFlag) {
+        if (!jsonMode) {
+            p.log.info(`Location: ${pc.cyan('Project')} ${pc.dim('(./')}${pc.dim(AGENT_CONFIGS[0].dir)}${pc.dim(')')}`);
+        }
+        return process.cwd();
+    }
+    if (globalFlag) {
+        if (!jsonMode) {
+            p.log.info(`Location: ${pc.cyan('Global')} ${pc.dim('(~/')}${pc.dim(AGENT_CONFIGS[0].dir)}${pc.dim(')')}`);
+        }
+        return homedir();
+    }
+    // Non-TTY or JSON mode defaults to global
+    if (!isInputTTY() || jsonMode) {
+        return homedir();
+    }
+    // Interactive selection
+    const location = await p.select({
+        message: 'Install location',
+        options: [
+            {
+                value: 'global',
+                label: 'Global',
+                hint: 'Available in all projects',
+            },
+            {
+                value: 'project',
+                label: 'Project',
+                hint: 'For this project only',
+            },
+        ],
+    });
+    if (p.isCancel(location)) {
+        p.cancel('Cancelled');
+        process.exit(EXIT_CODES.SUCCESS);
+    }
+    return location === 'project' ? process.cwd() : homedir();
+}
+async function selectAgents(agents, isLocal, jsonMode) {
+    const pathPrefix = isLocal ? '.' : '~';
+    // Show detected agents
+    if (!jsonMode) {
+        p.log.info(`Detected ${pc.cyan(agents.length.toString())} agent${agents.length === 1 ? '' : 's'}: ${agents.map((a) => a.name).join(', ')}`);
+    }
+    const installAll = await p.confirm({
+        message: 'Install to all detected agents?',
+        initialValue: true,
+    });
+    if (p.isCancel(installAll)) {
+        p.cancel('Cancelled');
+        process.exit(EXIT_CODES.SUCCESS);
+    }
+    if (installAll) {
+        return agents;
+    }
+    // User wants to choose specific agents
+    const options = agents.map((a) => ({
+        value: a.name,
+        label: a.name,
+        hint: `${pathPrefix}/${a.dir}`,
+    }));
+    const selected = await p.multiselect({
+        message: 'Select agents',
+        options,
+        required: true,
+    });
+    if (p.isCancel(selected)) {
+        p.cancel('Cancelled');
+        process.exit(EXIT_CODES.SUCCESS);
+    }
+    return agents.filter((a) => selected.includes(a.name));
+}
+async function discoverSkillPaths(owner, repo, installAll, jsonMode, jsonOutput) {
+    let skillPaths;
+    try {
+        skillPaths = await findAllSkillMdFiles(owner, repo);
+    }
+    catch (err) {
+        let errorMsg;
+        let exitCode = EXIT_CODES.GENERAL_ERROR;
+        if (err instanceof RateLimitError) {
+            errorMsg = err.message;
+            exitCode = EXIT_CODES.NETWORK_ERROR;
+        }
+        else if (err instanceof RepoNotFoundError) {
+            errorMsg = err.message;
+            exitCode = EXIT_CODES.NOT_FOUND;
+        }
+        else if (err instanceof NetworkError) {
+            errorMsg = err.message;
+            exitCode = EXIT_CODES.NETWORK_ERROR;
+        }
+        else if (err instanceof GitHubApiError) {
+            errorMsg = err.message;
+        }
+        else {
+            errorMsg = err instanceof Error ? err.message : String(err);
+        }
+        if (jsonMode) {
+            jsonOutput.errors.push(errorMsg);
+            jsonOutput.success = false;
+            console.log(JSON.stringify(jsonOutput, null, 2));
+        }
+        else {
+            p.log.error(errorMsg);
+        }
+        process.exit(exitCode);
+    }
+    if (skillPaths.length === 0) {
+        const errorMsg = `No ${SKILL_FILENAME} found in repository`;
+        if (jsonMode) {
+            jsonOutput.errors.push(errorMsg);
+            jsonOutput.success = false;
+        }
+        else {
+            p.log.error(errorMsg);
+        }
+        return null;
+    }
+    // Fetch frontmatter metadata for all skills in parallel
+    let spinner = null;
+    if (!jsonMode) {
+        spinner = p.spinner();
+        spinner.start('Fetching skill metadata...');
+    }
+    // Fetch metadata with bounded concurrency (max 10 parallel requests)
+    const skills = await batchMap(skillPaths, async (sp) => {
+        const skillDir = sp === SKILL_FILENAME ? '.' : dirname(sp);
+        const folderName = sp === SKILL_FILENAME ? repo : basename(skillDir);
+        // Fetch raw content to parse frontmatter
+        const content = await fetchSkillMdContent(owner, repo, sp);
+        const frontmatter = content ? parseFrontmatter(content) : {};
+        return {
+            path: sp,
+            dir: skillDir === '.' ? SKILL_FILENAME : skillDir,
+            name: frontmatter.name || folderName,
+            description: frontmatter.description || '',
+        };
+    }, 10);
+    if (spinner) {
+        spinner.stop(`Found ${pc.cyan(skills.length.toString())} skill${skills.length === 1 ? '' : 's'}`);
+    }
+    // Store found skills in JSON output
+    jsonOutput.skills_found = skills.map((s) => s.name);
+    if (skills.length === 1) {
+        const skill = skills[0];
+        const displayName = toTitleCase(skill.name);
+        const desc = skill.description ? truncate(skill.description, 60) : '';
+        if (!jsonMode) {
+            p.log.info(`${pc.bold(displayName)}${desc ? pc.dim(` - ${desc}`) : ''}`);
+        }
+        return [skill.dir];
+    }
+    // Build options for selection with frontmatter metadata
+    // Title in label, description in hint (shows on focus)
+    const optionsList = skills.map((skill) => ({
+        value: skill.dir,
+        label: pc.bold(toTitleCase(skill.name)),
+        hint: skill.description || undefined,
+    }));
+    // Non-TTY or JSON mode: require --all or --path for multiple skills
+    if (!isInputTTY() || jsonMode) {
+        // If --all flag is set, install all skills
+        if (installAll) {
+            if (!jsonMode) {
+                console.log(`Installing all ${skills.length} skills`);
+            }
+            return skills.map((s) => s.dir);
+        }
+        // Otherwise, list skills and exit with guidance
+        if (jsonMode) {
+            jsonOutput.errors.push('Multiple skills found. Use --path or --all to specify which one(s).');
+            jsonOutput.success = false;
+        }
+        else {
+            console.log(`\nFound ${skills.length} skills in this repository:`);
+            for (const skill of skills) {
+                const displayName = toTitleCase(skill.name);
+                const desc = skill.description ? pc.dim(` - ${truncate(skill.description, 80)}`) : '';
+                console.log(`  - ${displayName}${desc}`);
+            }
+            console.error('\nMultiple skills found. Use --path or --all to specify which one(s) (non-interactive mode).');
+        }
+        return null;
+    }
+    // Interactive multi-select
+    const selected = await p.multiselect({
+        message: 'Select skills to install',
+        options: optionsList,
+        required: true,
+    });
+    if (p.isCancel(selected)) {
+        p.cancel('Cancelled');
+        process.exit(EXIT_CODES.SUCCESS);
+    }
+    return selected;
+}
+/**
+ * SECURITY: Show warning and ask for user confirmation before installing.
+ * This mitigates supply chain attacks by making users acknowledge the source.
+ * Handles batch confirmation for multiple skills at once.
+ */
+async function confirmInstallBatch(owner, repo, skillNames) {
+    console.log();
+    p.log.warn(pc.yellow('Skills can instruct AI agents to perform actions on your behalf.'));
+    console.log(pc.dim(`  Source: github.com/${owner}/${repo}`));
+    console.log(pc.dim('  Use --yes to skip this prompt for trusted sources.'));
+    if (skillNames.length > 1) {
+        console.log();
+        console.log(pc.dim('  Skills to install:'));
+        for (const name of skillNames) {
+            console.log(pc.dim(`    • ${name}`));
+        }
+    }
+    console.log();
+    const skillLabel = skillNames.length === 1
+        ? pc.bold(skillNames[0])
+        : `${pc.bold(skillNames.length.toString())} skills`;
+    const proceed = await p.confirm({
+        message: `Install ${skillLabel} from ${pc.cyan(`${owner}/${repo}`)}?`,
+        initialValue: true,
+    });
+    if (p.isCancel(proceed)) {
+        return false;
+    }
+    return proceed;
+}

package/dist/commands/list.d.ts

@@ -0,0 +1,5 @@
+/**
+ * `skillfish list` command - List installed skills.
+ */
+import { Command } from 'commander';
+export declare const listCommand: Command;