skillmds 1.0.12 → 1.0.14

package/dist/cli.js

@@ -1,5 +1,5 @@
 // ../cli/src/index.ts
-import { Command as Command12 } from "commander";
+import { Command as Command13 } from "commander";
 import { readFileSync as readFileSync4 } from "fs";
 
 // ../cli/src/commands/lint.ts
@@ -13,7 +13,7 @@ import * as p from "@clack/prompts";
 // ../../packages/core/src/parse.ts
 import { parse as parseYaml } from "yaml";
 var MAX_SKILL_BYTES = 256 * 1024;
-var MAX_DESCRIPTION = 500;
+var MAX_DESCRIPTION = 1024;
 var MAX_NAME = 120;
 var slugify = (s) => String(s).toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "skill";
 function parseSkillMd(raw, type = "single") {
@@ -30,7 +30,7 @@ function parseSkillMd(raw, type = "single") {
   const description = String(fm.description ?? "").replace(/\s+/g, " ").trim();
   if (!name) return { error: "frontmatter 'name' is required" };
   if (!description) return { error: "frontmatter 'description' is required" };
-  if (description.length > MAX_DESCRIPTION) return { error: "description must be <= 500 chars" };
+  if (description.length > MAX_DESCRIPTION) return { error: `description must be <= ${MAX_DESCRIPTION} chars` };
   return {
     name: name.slice(0, MAX_NAME),
     description: description.slice(0, MAX_DESCRIPTION),
@@ -92,7 +92,7 @@ var RULES2 = [
   {
     id: "SK003",
     severity: "error",
-    description: "description must be present and \u2264 500 chars",
+    description: "description must be present and \u2264 1024 chars",
     check(s, _ctx) {
       const out = [];
       if (!s.description.trim()) out.push(diag(this, "frontmatter 'description' is required"));
@@ -284,9 +284,9 @@ function toGithub(results) {
 }
 
 // ../cli/src/source.ts
-import { existsSync, statSync, readFileSync, readdirSync, mkdtempSync } from "fs";
+import { existsSync, statSync, lstatSync, readFileSync, readdirSync, mkdtempSync, rmSync } from "fs";
 import { tmpdir } from "os";
-import { join, basename, dirname } from "path";
+import { join, basename, dirname, relative, sep } from "path";
 var IGNORE_DIRS = /* @__PURE__ */ new Set([
   // build/dependency dirs
   "node_modules",
@@ -357,6 +357,44 @@ async function resolveSource(arg) {
   if (files.length === 0) throw new Error(`No SKILL.md found in ${arg}`);
   return files.map(loadLocal);
 }
+var MAX_PACK_FILES = 200;
+var MAX_PACK_BYTES = 20 * 1024 * 1024;
+function collectFiles(root, dir, limits = {}) {
+  const maxFiles = limits.maxFiles ?? MAX_PACK_FILES;
+  const maxBytes = limits.maxBytes ?? MAX_PACK_BYTES;
+  const out = [];
+  let bytes = 0;
+  const walk = (d, depth) => {
+    if (depth > MAX_DEPTH) return;
+    for (const entry of readdirSync(d, { withFileTypes: true })) {
+      const fp = join(d, entry.name);
+      const st = lstatSync(fp);
+      if (st.isSymbolicLink()) continue;
+      if (st.isDirectory()) {
+        if (entry.name === ".git" || entry.name === "node_modules") continue;
+        walk(fp, depth + 1);
+      } else if (st.isFile()) {
+        if (out.length >= maxFiles) throw new Error(`pack too large: > ${maxFiles} files`);
+        bytes += st.size;
+        if (bytes > maxBytes) throw new Error(`pack too large: > ${Math.round(maxBytes / (1024 * 1024))}MB`);
+        out.push({ path: relative(root, fp).split(sep).join("/"), contents: readFileSync(fp) });
+      }
+    }
+  };
+  walk(dir, 0);
+  return out;
+}
+async function resolveTree(sourceUrl, ref) {
+  const { downloadTemplate } = await import("giget");
+  const input = normalizeGiget(sourceUrl) + (ref ? `#${ref}` : "");
+  const dir = mkdtempSync(join(tmpdir(), "skillmd-pack-"));
+  try {
+    const { dir: out } = await downloadTemplate(input, { dir, forceClean: true });
+    return collectFiles(out, out);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
 function normalizeGiget(arg) {
   const m = arg.match(/github\.com\/([^/]+)\/([^/]+)(?:\/tree\/[^/]+\/(.+))?/);
   if (m) return `github:${m[1]}/${m[2]}${m[3] ? "/" + m[3] : ""}`;
@@ -697,6 +735,9 @@ function initCommand() {
 import { Command as Command5 } from "commander";
 import pc5 from "picocolors";
 
+// ../cli/src/api.ts
+import { stringify as stringifyYaml } from "yaml";
+
 // ../cli/src/config.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -740,12 +781,17 @@ function createClient(flags = {}) {
   }
   return { api, base, hasToken: Boolean(token) };
 }
+function skillMdFor(skill) {
+  if (skill.raw_md) return skill.raw_md;
+  return reconstructSkillMd(skill);
+}
 function reconstructSkillMd(skill) {
   const name = skill.slug.split("/")[1] || skill.title;
-  const fm = ["---", `name: ${name}`, `description: ${String(skill.description).replace(/\n/g, " ")}`];
-  if (skill.license) fm.push(`license: ${skill.license}`);
-  fm.push("---", "");
-  return fm.join("\n") + (skill.body_md || "");
+  const fm = { name, description: String(skill.description).replace(/\n/g, " ") };
+  if (skill.license) fm.license = skill.license;
+  return `---
+${stringifyYaml(fm)}---
+${skill.body_md || ""}`;
 }
 
 // ../cli/src/commands/search.ts
@@ -775,13 +821,62 @@ function searchCommand() {
   });
 }
 
-// ../cli/src/commands/add.ts
+// ../cli/src/commands/info.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync4 } from "fs";
 import pc6 from "picocolors";
+async function runInfo(slug, flags) {
+  const [owner, name] = slug.split("/");
+  if (!owner || !name || slug.split("/").length !== 2) {
+    return { ok: false, exitCode: 1, output: pc6.red("Expected owner/name, e.g. anthropic/pdf") };
+  }
+  const { api } = createClient(flags);
+  let s;
+  try {
+    s = await api(`/api/skills/${owner}/${name}`);
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    if (/^SkillMD API 404 /.test(message)) {
+      return { ok: false, exitCode: 1, output: pc6.red(`Skill not found on the registry: ${slug}`) };
+    }
+    return { ok: false, exitCode: 1, output: pc6.red(`Could not reach the SkillMD registry: ${message}`) };
+  }
+  if (flags.json) return { ok: true, exitCode: 0, output: JSON.stringify(s, null, 2), skill: s };
+  const lines = [];
+  lines.push(
+    `${pc6.bold(s.slug)} ${pc6.dim(`[${s.type ?? "single"}]`)} ${s.verified ? pc6.green("\u2713 verified") : pc6.yellow("unverified")}`
+  );
+  lines.push(`  ${s.description}`);
+  lines.push(
+    pc6.dim(
+      `  category: ${s.category ?? "-"} \xB7 rating: ${s.avg_rating != null ? s.avg_rating.toFixed(1) : "-"} (${s.rating_count ?? 0}) \xB7 installs: ${s.install_count ?? 0}`
+    )
+  );
+  lines.push(
+    pc6.dim(`  security: ${(s.security_flags ?? []).join(", ") || "unscanned"} \xB7 license: ${s.provenance?.license ?? s.license ?? "unknown"}`)
+  );
+  const sourceRepo = s.provenance?.source_repo ?? s.source_repo;
+  const commitSha = s.provenance?.commit_sha ?? s.commit_sha;
+  if (sourceRepo) lines.push(pc6.dim(`  source: ${sourceRepo}${commitSha ? ` @ ${commitSha.slice(0, 8)}` : ""}`));
+  lines.push(pc6.dim(`  page: https://skillmd.com/skills/${s.slug}`));
+  lines.push(pc6.dim(`  install: ${s.install?.cli ?? `npx skillmds add ${s.slug}`}`));
+  return { ok: true, exitCode: 0, output: lines.join("\n"), skill: s };
+}
+function infoCommand() {
+  return new Command6("info").description("Show registry details for a skill: verification, security flags, provenance, rating").argument("<slug>", "owner/name, e.g. anthropic/pdf").action(async (slug, _opts, cmd) => {
+    const flags = { ...cmd.parent?.opts() };
+    const run = await runInfo(slug, flags);
+    if (run.output) (run.ok ? console.log : console.error)(run.output);
+    process.exitCode = run.exitCode;
+  });
+}
+
+// ../cli/src/commands/add.ts
+import { Command as Command7 } from "commander";
+import { existsSync as existsSync4 } from "fs";
+import pc7 from "picocolors";
 
 // ../cli/src/agents.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmSync2, symlinkSync, existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2, readFileSync as readFileSync3 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4, resolve as resolve2, dirname as dirname2 } from "path";
 var AGENTS = [
@@ -804,7 +899,7 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
   const dest = join4(targetDir, skillName);
   if (opts.mode === "symlink" && opts.canonicalDir) {
     mkdirSync3(dirname2(dest), { recursive: true });
-    rmSync(dest, { recursive: true, force: true });
+    rmSync2(dest, { recursive: true, force: true });
     symlinkSync(resolve2(opts.canonicalDir), dest, "dir");
     return dest;
   }
@@ -812,7 +907,7 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
   for (const f of files) {
     const fp = join4(dest, f.path);
     mkdirSync3(dirname2(fp), { recursive: true });
-    writeFileSync4(fp, f.contents, "utf8");
+    writeFileSync4(fp, f.contents);
   }
   return dest;
 }
@@ -835,6 +930,20 @@ function installedSkills(opts = {}) {
 function isLocalish(arg) {
   return arg === "." || arg.startsWith("./") || arg.startsWith("../") || arg.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(arg) || existsSync4(arg);
 }
+async function resolvePackFiles(skill, fetchTree = resolveTree) {
+  if (!skill.source_repo) return null;
+  const attempts = [{ ref: skill.commit_sha ?? void 0, pinMiss: false }];
+  if (skill.commit_sha) attempts.push({ ref: void 0, pinMiss: true });
+  for (const attempt of attempts) {
+    try {
+      const files = await fetchTree(skill.source_repo, attempt.ref);
+      const sk = files.find((f) => f.path === "SKILL.md");
+      if (sk) return { raw: sk.contents.toString("utf8"), files, pinMiss: attempt.pinMiss };
+    } catch {
+    }
+  }
+  return null;
+}
 var defaultDeps = {
   async resolve(arg, flags) {
     if (isLocalish(arg)) {
@@ -847,7 +956,19 @@ var defaultDeps = {
       try {
         const skill = await api(`/api/skills/${owner}/${name}`);
         const skillName = skill.slug.split("/")[1] || name;
-        return [{ name: skillName, raw: reconstructSkillMd(skill), slug: skillName, registrySlug: arg, verified: skill.verified }];
+        const base = {
+          name: skillName,
+          slug: skillName,
+          registrySlug: arg,
+          verified: skill.verified,
+          type: skill.type,
+          securityFlags: skill.security_flags
+        };
+        if (skill.type === "pack") {
+          const pack = await resolvePackFiles(skill);
+          if (pack) return [{ ...base, ...pack }];
+        }
+        return [{ ...base, raw: skillMdFor(skill) }];
       } catch {
       }
     }
@@ -863,6 +984,16 @@ var defaultDeps = {
       body: JSON.stringify({ via: "cli" })
     }).catch(() => {
     });
+  },
+  async confirmUnverified(c, score, secFlags) {
+    if (!process.stdin.isTTY) return false;
+    const { confirm: confirm2, isCancel: isCancel4 } = await import("@clack/prompts");
+    const ok = await confirm2({
+      message: `${c.name} is not yet verified by SkillMD (lint score ${score}${secFlags.length ? `; flags: ${secFlags.join(", ")}` : ""}). Install anyway?`,
+      initialValue: false
+    });
+    if (isCancel4(ok)) return false;
+    return ok === true;
   }
 };
 async function runAdd(arg, flags, deps = defaultDeps) {
@@ -876,27 +1007,39 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   const targets = flags.agent?.length ? flags.agent : detectAgents(scope).length ? detectAgents(scope) : ["claude-code"];
   for (const c of candidates) {
     const result = lint(c.raw, { slug: c.slug });
-    const deniedFlags = result.security.flags.filter((f) => deny.has(f));
+    const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
+    const deniedFlags = allFlags.filter((f) => deny.has(f));
     if (!flags.skipLint && !result.ok) {
       blocked.push({ name: c.name, reason: `lint errors: ${result.diagnostics.filter((d) => d.severity === "error").map((d) => d.id).join(", ")}` });
-      lines.push(pc6.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 failed lint (use --skip-lint to override)`));
       continue;
     }
     if (deniedFlags.length) {
       blocked.push({ name: c.name, reason: `denied security flags: ${deniedFlags.join(", ")}` });
-      lines.push(pc6.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
+      lines.push(pc7.red(`\u2717 ${c.name} blocked \u2014 ${deniedFlags.join(", ")}`));
       continue;
     }
     if (c.registrySlug && c.verified === false && !flags.allowUnverified) {
-      blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
-      lines.push(pc6.yellow(`\u2717 ${c.name} blocked \u2014 unverified (use --allow-unverified)`));
-      continue;
+      const ok = !flags.yes && deps.confirmUnverified ? await deps.confirmUnverified(c, result.score, allFlags) : false;
+      if (!ok) {
+        blocked.push({ name: c.name, reason: "unverified registry skill (use --allow-unverified)" });
+        lines.push(pc7.yellow(`\u2717 ${c.name} blocked \u2014 not yet verified by SkillMD${allFlags.length ? ` (flags: ${allFlags.join(", ")})` : ""}`));
+        lines.push(pc7.dim(`  review at https://skillmd.com/skills/${c.registrySlug}, then re-run with --allow-unverified`));
+        continue;
+      }
     }
+    const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
     for (const agentId of targets) {
       const dir = agentDir(agentId, scope);
-      const out = writeSkill(c.name, [{ path: "SKILL.md", contents: c.raw }], dir, { mode: "copy" });
+      const out = writeSkill(c.name, files, dir, { mode: "copy" });
       written.push({ name: c.name, dir: out });
-      lines.push(pc6.green(`\u2713 ${c.name} \u2192 ${out}`));
+      lines.push(pc7.green(`\u2713 ${c.name} \u2192 ${out}`) + pc7.dim(` (score ${result.score}${allFlags.length ? `; ${allFlags.join(", ")}` : ""})`));
+    }
+    if (c.pinMiss) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
+    }
+    if (c.type === "pack" && !c.files) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
     }
     if (c.registrySlug) deps.fireInstall(c.registrySlug, flags);
   }
@@ -904,7 +1047,7 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   return { written, blocked, exitCode, output: lines.join("\n") };
 }
 function addCommand() {
-  return new Command6("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").option("--allow-unverified", "allow installing unverified registry skills").option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills with these security flags").action(async (source, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runAdd(source, merged);
     console.log(run.output);
@@ -913,10 +1056,10 @@ function addCommand() {
 }
 
 // ../cli/src/commands/list.ts
-import { Command as Command7 } from "commander";
-import pc7 from "picocolors";
+import { Command as Command8 } from "commander";
+import pc8 from "picocolors";
 function listCommand() {
-  return new Command7("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
+  return new Command8("list").alias("ls").description("List installed skills across detected agents").option("-g, --global", "only global skills").option("--json", "machine-readable output").action((opts) => {
     const scope = { global: opts.global };
     const skills = installedSkills(scope);
     if (opts.json) {
@@ -929,44 +1072,44 @@ function listCommand() {
     }
     for (const s of skills) {
       const parsed = parseSkillMd(s.raw);
-      const desc = "error" in parsed ? pc7.red("(invalid SKILL.md)") : pc7.dim(parsed.description.slice(0, 80));
-      console.log(`${pc7.bold(s.name)} ${pc7.dim(`[${s.agent}/${s.scope}]`)}
+      const desc = "error" in parsed ? pc8.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc8.dim(parsed.description.slice(0, 80));
+      console.log(`${pc8.bold(s.name)} ${pc8.dim(`[${s.agent}/${s.scope}]`)}
     ${desc}`);
     }
   });
 }
 
 // ../cli/src/commands/remove.ts
-import { Command as Command8 } from "commander";
-import { rmSync as rmSync2 } from "fs";
-import pc8 from "picocolors";
+import { Command as Command9 } from "commander";
+import { rmSync as rmSync3 } from "fs";
+import pc9 from "picocolors";
 function runRemove(names, scope = {}) {
   const installed = installedSkills(scope);
   const targets = installed.filter((s) => names.includes(s.name));
   const removed = [];
   const lines = [];
   for (const t of targets) {
-    rmSync2(t.path, { recursive: true, force: true });
+    rmSync3(t.path, { recursive: true, force: true });
     removed.push(t.path);
-    lines.push(pc8.green(`\u2713 removed ${t.name} (${t.agent})`));
+    lines.push(pc9.green(`\u2713 removed ${t.name} (${t.agent})`));
   }
   for (const n of names) {
-    if (!targets.some((t) => t.name === n)) lines.push(pc8.yellow(`- ${n} not installed`));
+    if (!targets.some((t) => t.name === n)) lines.push(pc9.yellow(`- ${n} not installed`));
   }
   return { removed, output: lines.join("\n") };
 }
 function removeCommand() {
-  return new Command8("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
+  return new Command9("remove").alias("rm").description("Remove installed skills").argument("<names...>", "skill names to remove").option("-g, --global", "only global skills").action((names, opts) => {
     const run = runRemove(names, { global: opts.global });
     console.log(run.output);
   });
 }
 
 // ../cli/src/commands/update.ts
-import { Command as Command9 } from "commander";
+import { Command as Command10 } from "commander";
 import { writeFileSync as writeFileSync5 } from "fs";
 import { join as join5 } from "path";
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 async function runUpdate(names, flags, scope = {}) {
   const { api } = createClient(flags);
   const installed = installedSkills(scope).filter((s) => names.length === 0 || names.includes(s.name));
@@ -975,27 +1118,27 @@ async function runUpdate(names, flags, scope = {}) {
   for (const s of installed) {
     const slug = await findRegistrySlug(api, s);
     if (!slug) {
-      lines.push(pc9.dim(`- ${s.name} skipped (no registry match)`));
+      lines.push(pc10.dim(`- ${s.name} skipped (no registry match)`));
       continue;
     }
     try {
       const [owner, name] = slug.split("/");
       const skill = await api(`/api/skills/${owner}/${name}`);
-      const next = reconstructSkillMd(skill);
+      const next = skillMdFor(skill);
       if (next.trim() === s.raw.trim()) {
-        lines.push(pc9.dim(`- ${s.name} already up to date`));
+        lines.push(pc10.dim(`- ${s.name} already up to date`));
         continue;
       }
       const result = lint(next, { slug: s.name });
       if (!result.ok) {
-        lines.push(pc9.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
+        lines.push(pc10.red(`\u2717 ${s.name} update failed lint \u2014 skipped`));
         continue;
       }
       writeFileSync5(join5(s.path, "SKILL.md"), next, "utf8");
       updated.push(s.name);
-      lines.push(pc9.green(`\u2713 updated ${s.name}`));
+      lines.push(pc10.green(`\u2713 updated ${s.name}`));
     } catch {
-      lines.push(pc9.red(`\u2717 ${s.name} update error`));
+      lines.push(pc10.red(`\u2717 ${s.name} update error`));
     }
   }
   return { updated, output: lines.join("\n") || "Nothing to update." };
@@ -1006,7 +1149,7 @@ async function findRegistrySlug(api, s) {
   return hit?.slug ?? null;
 }
 function updateCommand() {
-  return new Command9("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
+  return new Command10("update").description("Update installed skills from the registry (re-lints before writing)").argument("[names...]", "specific skills to update (default: all)").option("-g, --global", "only global skills").action(async (names, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runUpdate(names, merged, { global: opts.global });
     console.log(run.output);
@@ -1014,8 +1157,8 @@ function updateCommand() {
 }
 
 // ../cli/src/commands/publish.ts
-import { Command as Command10 } from "commander";
-import pc10 from "picocolors";
+import { Command as Command11 } from "commander";
+import pc11 from "picocolors";
 var defaultDeps2 = {
   resolve: resolveSource,
   async submit(payload, flags) {
@@ -1038,23 +1181,23 @@ async function runPublish(target, flags, deps = defaultDeps2) {
   const report = toText([{ file: src.path, result }], { decorate });
   if (!result.ok) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc10.red("\u2717 Refusing to publish: fix the errors above.")}` };
+${pc11.red("\u2717 Refusing to publish: fix the errors above.")}` };
   }
   const hasWarn = result.diagnostics.some((d) => d.severity === "warn");
   if (hasWarn && !flags.force) {
     return { result, published: false, exitCode: 1, output: `${report}
-${pc10.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
+${pc11.yellow("\u2717 Warnings present. Re-run with --force to publish anyway.")}` };
   }
   if (flags.dryRun) {
     return { result, published: false, exitCode: 0, output: `${report}
-${pc10.green("\u2713 Dry run: would publish.")}` };
+${pc11.green("\u2713 Dry run: would publish.")}` };
   }
   const res = await deps.submit({ content: src.raw, type: flags.type ?? "single" }, flags);
   return { result, published: true, slug: res.slug, exitCode: 0, output: `${report}
-${pc10.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
+${pc11.green(`\u2713 Published ${res.slug ?? src.slug} (status: ${res.status ?? "pending"})`)}` };
 }
 function publishCommand() {
-  return new Command10("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
+  return new Command11("publish").alias("submit").description("Publish a skill to the registry (refuses to publish on lint errors)").argument("[target]", "local path to the skill", ".").option("--type <type>", "single | pack", "single").option("--force", "publish despite warnings (never bypasses errors)").option("--dry-run", "lint only; do not publish").action(async (target, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runPublish(target, merged);
     console.log(run.output);
@@ -1063,10 +1206,10 @@ function publishCommand() {
 }
 
 // ../cli/src/commands/login.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 import * as p3 from "@clack/prompts";
 function loginCommand() {
-  return new Command11("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
+  return new Command12("login").description("Store a SkillMD personal access token for publishing").option("--token <token>", "token to store (otherwise prompt)").option("--api <url>", "registry API base to store").action(async (opts) => {
     let token = opts.token;
     if (!token) {
       const answer = await p3.password({ message: "Paste your SkillMD token (from your account page)" });
@@ -1089,7 +1232,7 @@ function loginCommand() {
   });
 }
 function logoutCommand() {
-  return new Command11("logout").description("Remove the stored SkillMD token").action(() => {
+  return new Command12("logout").description("Remove the stored SkillMD token").action(() => {
     const cfg = readConfig();
     delete cfg.token;
     writeConfig(cfg);
@@ -1099,7 +1242,7 @@ function logoutCommand() {
 
 // ../cli/src/commands/interactive.ts
 import * as p4 from "@clack/prompts";
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 function bail(v) {
   if (p4.isCancel(v)) {
     p4.cancel("Cancelled.");
@@ -1108,105 +1251,107 @@ function bail(v) {
   return false;
 }
 async function runInteractive() {
-  p4.intro(pc11.bgCyan(pc11.black(" skillmd ")));
-  const action = await p4.select({
-    message: "What would you like to do?",
-    options: [
-      { value: "lint", label: "Lint a skill", hint: "validate a SKILL.md" },
-      { value: "scan", label: "Security scan", hint: "scripts, network, secrets" },
-      { value: "search", label: "Search the registry" },
-      { value: "init", label: "Create a new skill" },
-      { value: "list", label: "List installed skills" },
-      { value: "help", label: "Show all commands" }
-    ]
-  });
-  if (bail(action)) return;
-  switch (action) {
-    case "lint":
-    case "scan": {
-      const path = await p4.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
-      if (bail(path)) return;
-      const target = String(path || ".");
-      const s = p4.spinner();
-      s.start(action === "lint" ? "Linting" : "Scanning");
-      try {
-        const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
-        s.stop("Done");
-        console.log(run.output);
-        process.exitCode = run.exitCode;
-      } catch (err) {
-        s.stop(pc11.red(err instanceof Error ? err.message : String(err)));
-        process.exitCode = 1;
+  p4.intro(pc12.bgCyan(pc12.black(" skillmd ")));
+  for (; ; ) {
+    const action = await p4.select({
+      message: "What would you like to do?",
+      options: [
+        { value: "lint", label: "Lint a skill", hint: "validate a SKILL.md" },
+        { value: "scan", label: "Security scan", hint: "scripts, network, secrets" },
+        { value: "search", label: "Search the registry" },
+        { value: "init", label: "Create a new skill" },
+        { value: "list", label: "List installed skills" },
+        { value: "help", label: "Show all commands" },
+        { value: "quit", label: "Quit" }
+      ]
+    });
+    if (bail(action) || action === "quit") break;
+    switch (action) {
+      case "lint":
+      case "scan": {
+        const path = await p4.text({ message: "Path to a skill or folder", placeholder: ".", defaultValue: "." });
+        if (bail(path)) break;
+        const target = String(path || ".");
+        const s = p4.spinner();
+        s.start(action === "lint" ? "Linting" : "Scanning");
+        try {
+          const run = action === "lint" ? await runLint(target, { format: "text" }) : await runScan(target, { format: "text" });
+          s.stop("Done");
+          console.log(run.output);
+          process.exitCode = run.exitCode;
+        } catch (err) {
+          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          process.exitCode = 1;
+        }
+        break;
       }
-      break;
-    }
-    case "search": {
-      const query = await p4.text({ message: "Search the registry for" });
-      if (bail(query)) return;
-      const verified = await p4.confirm({ message: "Verified skills only?", initialValue: false });
-      if (bail(verified)) return;
-      const s = p4.spinner();
-      s.start("Searching");
-      try {
-        const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
-        s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
-        console.log(run.output);
-      } catch (err) {
-        s.stop(pc11.red(err instanceof Error ? err.message : String(err)));
-        process.exitCode = 1;
+      case "search": {
+        const query = await p4.text({ message: "Search the registry for" });
+        if (bail(query)) break;
+        const verified = await p4.confirm({ message: "Verified skills only?", initialValue: false });
+        if (bail(verified)) break;
+        const s = p4.spinner();
+        s.start("Searching");
+        try {
+          const run = await runSearch(String(query), { verified: Boolean(verified), limit: "20" });
+          s.stop(`${run.items.length} result${run.items.length === 1 ? "" : "s"}`);
+          console.log(run.output);
+        } catch (err) {
+          s.stop(pc12.red(err instanceof Error ? err.message : String(err)));
+          process.exitCode = 1;
+        }
+        break;
       }
-      break;
-    }
-    case "init": {
-      const name = await p4.text({ message: "Skill name", placeholder: "my-skill" });
-      if (bail(name)) return;
-      const description = await p4.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
-      if (bail(description)) return;
-      try {
-        const file = initSkill(String(name), { description: String(description || "") });
-        p4.log.success(`Created ${pc11.bold(file)}`);
-      } catch (err) {
-        p4.log.error(err instanceof Error ? err.message : String(err));
-        process.exitCode = 1;
+      case "init": {
+        const name = await p4.text({ message: "Skill name", placeholder: "my-skill" });
+        if (bail(name)) break;
+        const description = await p4.text({ message: "One-line description", placeholder: "What this skill helps an agent do" });
+        if (bail(description)) break;
+        try {
+          const file = initSkill(String(name), { description: String(description || "") });
+          p4.log.success(`Created ${pc12.bold(file)}`);
+        } catch (err) {
+          p4.log.error(err instanceof Error ? err.message : String(err));
+          process.exitCode = 1;
+        }
+        break;
       }
-      break;
-    }
-    case "list": {
-      const global = await p4.confirm({ message: "Include global skills?", initialValue: true });
-      if (bail(global)) return;
-      const skills = installedSkills({ global: Boolean(global) });
-      if (skills.length === 0) {
-        p4.log.info("No installed skills found.");
-      } else {
-        p4.log.message(
-          skills.map((sk) => {
-            const parsed = parseSkillMd(sk.raw);
-            const desc = "error" in parsed ? pc11.red("(invalid)") : pc11.dim(parsed.description.slice(0, 70));
-            return `${pc11.bold(sk.name)} ${pc11.dim(`[${sk.agent}]`)}
+      case "list": {
+        const skills = [...installedSkills({}), ...installedSkills({ global: true })];
+        if (skills.length === 0) {
+          p4.log.info("No installed skills found (checked this folder and your user directory).");
+        } else {
+          p4.log.message(
+            skills.map((sk) => {
+              const parsed = parseSkillMd(sk.raw);
+              const desc = "error" in parsed ? pc12.red(`(invalid SKILL.md \u2014 ${parsed.error})`) : pc12.dim(parsed.description.slice(0, 70));
+              return `${pc12.bold(sk.name)} ${pc12.dim(`[${sk.agent}/${sk.scope}]`)}
   ${desc}`;
-          }).join("\n")
+            }).join("\n")
+          );
+        }
+        break;
+      }
+      case "help": {
+        p4.note(
+          [
+            `${pc12.bold("lint")} [path]      validate SKILL.md + quality score`,
+            `${pc12.bold("scan")} [path]      security scan`,
+            `${pc12.bold("search")} <query>   search the registry`,
+            `${pc12.bold("add")} <source>     install a skill (lints first)`,
+            `${pc12.bold("info")} <slug>      registry details for a skill`,
+            `${pc12.bold("init")} [name]      scaffold a new skill`,
+            `${pc12.bold("list / remove / update")}   manage installed skills`,
+            `${pc12.bold("publish")} [path]   publish (fails on lint errors)`,
+            `${pc12.bold("rules / login")}`
+          ].join("\n"),
+          "Commands (run: skillmd <command>)"
         );
+        break;
       }
-      break;
-    }
-    case "help": {
-      p4.note(
-        [
-          `${pc11.bold("lint")} [path]      validate SKILL.md + quality score`,
-          `${pc11.bold("scan")} [path]      security scan`,
-          `${pc11.bold("search")} <query>   search the registry`,
-          `${pc11.bold("add")} <source>     install a skill (lints first)`,
-          `${pc11.bold("init")} [name]      scaffold a new skill`,
-          `${pc11.bold("list / remove / update")}   manage installed skills`,
-          `${pc11.bold("publish")} [path]   publish (fails on lint errors)`,
-          `${pc11.bold("rules / login")}`
-        ].join("\n"),
-        "Commands (run: skillmd <command>)"
-      );
-      break;
     }
   }
-  p4.outro(pc11.dim("skillmd.com"));
+  p4.outro(pc12.dim("skillmd.com"));
 }
 
 // ../cli/src/index.ts
@@ -1215,12 +1360,13 @@ try {
   version = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8")).version;
 } catch {
 }
-var program = new Command12("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
+var program = new Command13("skillmd").version(version).description("Lint, validate, and install Agent Skills from the SkillMD registry.").option("--json", "machine-readable output").option("--token <token>", "SkillMD personal access token").option("--api <url>", "override the registry API base URL");
 program.addCommand(lintCommand());
 program.addCommand(scanCommand());
 program.addCommand(rulesCommand());
 program.addCommand(initCommand());
 program.addCommand(searchCommand());
+program.addCommand(infoCommand());
 program.addCommand(addCommand());
 program.addCommand(listCommand());
 program.addCommand(removeCommand());