skillmds 1.0.18 → 1.0.20

package/CHANGELOG.md

@@ -1,104 +1,113 @@
-# Changelog
-
-All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
-
-## 1.0.18
-
-- **Cleaner tool output for agents.** `skillmd_search`, `skillmd_trending`, and `skillmd_recommend` no longer echo site-oriented fields (`avg_rating`, `rating_count`, `install_count`, `save_count`, `verified`, `type`, `owner_avatar`, `category_slug`, and the internal `confident` ranker flag). Results now carry just what an agent needs to pick a skill: slug, title, description, category, agents, repo stars, and the install snippet.
-- **Quality score no longer punishes ordinary skills.** The security flags (`reads_secrets`, `network_calls`, `executes_scripts`) are pattern matches against prose and code samples, not proof of anything unsafe — they now cost 2/1/5 points respectively (was 25/8/15), so a skill that merely documents an env var or a URL keeps its high score. Verified skills are floored at 85 (unless the content fails to parse). `skillmd_lint` passes a skill's verified status through to the score.
-
-## 1.0.16
-
-- **Installs are no longer gated on verification.** Any skill installs directly — verified or not — with no flag, no prompt, and no second step, from both the CLI (`skillmd add`) and the MCP `skillmd_install` tool. Security flags (network_calls, executes_scripts, reads_secrets, docs_only) are still shown on the result as information, but never block. `--deny <flag>` remains available as an opt-in for anyone who wants to exclude a flag; `--allow-unverified` is now a no-op kept for backward compatibility.
-
-## 1.0.15
-
-- Search is now **browsable in the interactive menu**: arrow through results, press Enter on one to see a card, and install it to your project or user directory — all without leaving the CLI (`← Back` at each level; Esc goes up one step, never quits).
-- Search results are clean two-line entries showing the source repo's **star count** (e.g. `★ 223.7k`) instead of the placeholder rating, with the description truncated to fit your terminal.
-- Fixes for narrow terminals: result rows are width-budgeted so they don't wrap and garble the menu; the result card prints once instead of repainting on every action.
-
-## 1.0.14
-
-- Interactive menu (`skillmds` in a terminal) no longer exits after one action — it returns to the menu until you pick **Quit**; cancelling a sub-prompt goes back to the menu instead of quitting.
-- "List installed skills" now shows project **and** global skills together, tagged `[agent/scope]`, replacing the misleading "Include global skills?" prompt (which actually toggled global-only vs project-only). Invalid skills show the parse reason.
-- The in-menu command reference now includes `info`.
-
-## 1.0.13
-
-Safe & easy installs release.
-
-- **Packs install their full file tree.** `skillmd add owner/pack` now downloads the pack's source directory (pinned to the registry's commit; falls back to the default branch with a warning if the pin is gone upstream), so `assets/` and `references/` files referenced by SKILL.md actually exist. Hardened: symlinks are skipped, 200-file/20MB caps, temp dirs cleaned up.
-- **Unverified skills prompt instead of hard-blocking.** Interactive installs show the lint score and security flags and ask before installing; non-interactive installs (and `-y`) still require the explicit `--allow-unverified`. Blocked output links the skill's page for review.
-- **New `skillmd info <slug>`** shows verification status, security flags, rating, provenance (source repo @ commit), and the install snippet. Unknown subcommands now print a proper error instead of silently starting the MCP server.
-- **MCP `skillmd_install` gained the CLI's safety gates**: refuses unverified skills unless `allow_unverified: true` (only after explicit human approval), validates before writing, reports security flags, and guards against malformed skill names.
-- **Installs are exact.** The registry now stores the published SKILL.md verbatim (`raw_md`) and installs deliver it byte-for-byte; reconstructed frontmatter (legacy rows) is YAML-quoted so descriptions with `:`/`#`/quotes can't corrupt the file.
-- Description limit aligned with Claude Code's real spec (1024 chars, was 500) — valid skills are no longer flagged "(invalid SKILL.md)" by `skillmd list`, and `list` now says *why* a file is invalid.
-
-## 1.0.12
-
-- Registry-native `skillmd` CLI shipped inside `skillmds`: `search`, `add`, `list`, `remove`, `update`, `publish`, `login`/`logout`, plus lint/scan/rules/init. (Release notes added retroactively.)
-
-## 1.0.11
-
-- Security flags render with full readable labels, each with its own marker: `⚑ Executes Scripts  ⚑ Calls Network  ⚑ Reads Secrets`.
-
-## 1.0.10
-
-- Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).
-- Lint output ends with a **Failed** section listing each failure's rule, message, and full path, so problems don't scroll off in a large run.
-- New `--errors-only` flag to show only failing skills.
-- Fixed emoji spacing/overlap; rule ids are grouped by severity per skill.
-- The closer states how many skills failed instead of a vague "Problems found".
-
-## 1.0.9
-
-- Compact lint output: one line per skill (status dot, score, name, rule-id chips) with a single summary line, instead of a tall multi-row block per skill. Linting a single skill still shows full diagnostic messages.
-
-## 1.0.8
-
-- `skillmds` with no command in a terminal now opens the interactive CLI menu; it only starts the MCP server when launched over piped stdio (how MCP clients run it). Previously a bare `npx skillmds` in a terminal appeared to hang on the silent MCP server.
-
-## 1.0.7
-
-- Nicer CLI output: colored PASS/FAIL, quality-score bars, `ERROR`/`WARN`/`INFO` badges, and a summary with average score.
-- Running `skillmd` (or `skillmds`) with no command on a terminal now opens a guided interactive menu (lint, scan, search, init, list). Piped/CI still prints help.
-- Progress spinner while scanning.
-
-## 1.0.6
-
-- Bundle the banner image in the package and serve it via jsDelivr so it renders on the npm page (the previous absolute URL was unreachable).
-
-## 1.0.5
-
-- The `skillmds` binary now dispatches: `skillmds <command>` (lint, scan, add, …) runs the CLI, while `skillmds` with no command starts the MCP server. This makes `npx skillmds lint .` work without the `-p` flag.
-
-## 1.0.4
-
-- `skillmd lint`/`scan` print a progress line to stderr and warn when scanning a home directory, so a directory scan never looks like a frozen blank screen.
-- Directory scans skip large build/OS directories (`AppData`, `node_modules`, `target`, …) and cap recursion depth, so `lint .` in a big tree terminates quickly.
-- Clearer message when no `SKILL.md` is found.
-- Bare `skillmd` (no command) prints help.
-
-## 1.0.3
-
-- CLI (`skillmd`) and MCP server (`skillmds`) now report their version from `package.json` instead of a hardcoded string.
-- READMEs rewritten; added this changelog.
-
-## 1.0.2
-
-- `skillmd lint`: skip directories that cannot be read (e.g. `EPERM` on protected system folders) instead of aborting the scan.
-
-## 1.0.1
-
-- Fix `skillmd_lint` in the MCP server: keep `yaml` external in the bundled engine so it loads at runtime (bundling a CommonJS module into ESM raised `Dynamic require of "process"`).
-
-## 1.0.0
-
-- Add the `skillmd` CLI, shipped alongside the MCP server in this package. Commands: `lint`/`check`, `scan`, `rules`, `init`, `search`, `add`, `list`, `remove`, `update`, `publish`/`submit`, `login`, `logout`.
-- Validation engine shared with the SkillMD registry: `SKILL.md` parser, lint rules `SK001`–`SK040`, security scan, quality score, and `text`/`json`/`sarif`/`github` output.
-- Add the `skillmd_lint` MCP tool.
-- MCP server and CLI authenticate with `Authorization: Bearer` tokens.
-
-## 0.1.1
-
-- Initial MCP server: `skillmd_search`, `skillmd_get`, `skillmd_install`, `skillmd_trending`, `skillmd_recommend`, `skillmd_list_saved`.
+# Changelog
+
+All notable changes to `skillmds` are documented here. Versions follow [semver](https://semver.org).
+
+## 1.0.20
+
+- **`skillmd add` now installs to every agent on your machine.** Detection is machine-level (an agent's config dir under your home, e.g. `~/.cursor`), so agents no longer need a pre-existing `skills/` folder to be targeted. The agent registry grows from 5 to **60+**: Gemini CLI, Antigravity, Kiro, Warp, GitHub Copilot, Cline, Roo Code, Goose, Trae, Qwen Code, Amp, OpenClaw, Kilo Code, Hermes (Nous Research), Continue, Devin, OpenHands, Replit, Mistral Vibe, Zed, Kimi Code, Droid (Factory), Crush, Augment, Junie, and more — with per-agent dirs matching each agent's own convention (`~/.codeium/windsurf/skills` for Windsurf, `~/.gemini/antigravity/skills` for Antigravity, etc.). Agents sharing the cross-agent `.agents/skills` convention are written once and labelled with every agent they serve. `-a/--agent` still overrides.
+- Running from your home directory now behaves like `--global` (project scope rooted at `$HOME` *is* the global scope), so agents whose global skills live outside `~/<agent>/skills` get the right directory.
+
+## 1.0.19
+
+- **Clear diagnostics when the registry is blocked.** In sandboxed or proxied environments that deny network egress to `api.skillmd.com`, `skillmd add owner/name` used to fall back to GitHub and surface a misleading "repo not found" error. The CLI now tells 404 ("not in the registry" — GitHub fallback proceeds as before) apart from unreachable (DNS failure, proxy 403, 5xx): if the GitHub fallback also fails, the error names the blocked registry and says what fixes it (allowlist `api.skillmd.com`, or install via the SkillMD MCP server); if the fallback succeeds, a warning notes the copy came from GitHub, not the registry.
+
+## 1.0.18
+
+- **Cleaner tool output for agents.** `skillmd_search`, `skillmd_trending`, and `skillmd_recommend` no longer echo site-oriented fields (`avg_rating`, `rating_count`, `install_count`, `save_count`, `verified`, `type`, `owner_avatar`, `category_slug`, and the internal `confident` ranker flag). Results now carry just what an agent needs to pick a skill: slug, title, description, category, agents, repo stars, and the install snippet.
+- **Quality score no longer punishes ordinary skills.** The security flags (`reads_secrets`, `network_calls`, `executes_scripts`) are pattern matches against prose and code samples, not proof of anything unsafe — they now cost 2/1/5 points respectively (was 25/8/15), so a skill that merely documents an env var or a URL keeps its high score. Verified skills are floored at 85 (unless the content fails to parse). `skillmd_lint` passes a skill's verified status through to the score.
+
+## 1.0.16
+
+- **Installs are no longer gated on verification.** Any skill installs directly — verified or not — with no flag, no prompt, and no second step, from both the CLI (`skillmd add`) and the MCP `skillmd_install` tool. Security flags (network_calls, executes_scripts, reads_secrets, docs_only) are still shown on the result as information, but never block. `--deny <flag>` remains available as an opt-in for anyone who wants to exclude a flag; `--allow-unverified` is now a no-op kept for backward compatibility.
+
+## 1.0.15
+
+- Search is now **browsable in the interactive menu**: arrow through results, press Enter on one to see a card, and install it to your project or user directory — all without leaving the CLI (`← Back` at each level; Esc goes up one step, never quits).
+- Search results are clean two-line entries showing the source repo's **star count** (e.g. `★ 223.7k`) instead of the placeholder rating, with the description truncated to fit your terminal.
+- Fixes for narrow terminals: result rows are width-budgeted so they don't wrap and garble the menu; the result card prints once instead of repainting on every action.
+
+## 1.0.14
+
+- Interactive menu (`skillmds` in a terminal) no longer exits after one action — it returns to the menu until you pick **Quit**; cancelling a sub-prompt goes back to the menu instead of quitting.
+- "List installed skills" now shows project **and** global skills together, tagged `[agent/scope]`, replacing the misleading "Include global skills?" prompt (which actually toggled global-only vs project-only). Invalid skills show the parse reason.
+- The in-menu command reference now includes `info`.
+
+## 1.0.13
+
+Safe & easy installs release.
+
+- **Packs install their full file tree.** `skillmd add owner/pack` now downloads the pack's source directory (pinned to the registry's commit; falls back to the default branch with a warning if the pin is gone upstream), so `assets/` and `references/` files referenced by SKILL.md actually exist. Hardened: symlinks are skipped, 200-file/20MB caps, temp dirs cleaned up.
+- **Unverified skills prompt instead of hard-blocking.** Interactive installs show the lint score and security flags and ask before installing; non-interactive installs (and `-y`) still require the explicit `--allow-unverified`. Blocked output links the skill's page for review.
+- **New `skillmd info <slug>`** shows verification status, security flags, rating, provenance (source repo @ commit), and the install snippet. Unknown subcommands now print a proper error instead of silently starting the MCP server.
+- **MCP `skillmd_install` gained the CLI's safety gates**: refuses unverified skills unless `allow_unverified: true` (only after explicit human approval), validates before writing, reports security flags, and guards against malformed skill names.
+- **Installs are exact.** The registry now stores the published SKILL.md verbatim (`raw_md`) and installs deliver it byte-for-byte; reconstructed frontmatter (legacy rows) is YAML-quoted so descriptions with `:`/`#`/quotes can't corrupt the file.
+- Description limit aligned with Claude Code's real spec (1024 chars, was 500) — valid skills are no longer flagged "(invalid SKILL.md)" by `skillmd list`, and `list` now says *why* a file is invalid.
+
+## 1.0.12
+
+- Registry-native `skillmd` CLI shipped inside `skillmds`: `search`, `add`, `list`, `remove`, `update`, `publish`, `login`/`logout`, plus lint/scan/rules/init. (Release notes added retroactively.)
+
+## 1.0.11
+
+- Security flags render with full readable labels, each with its own marker: `⚑ Executes Scripts  ⚑ Calls Network  ⚑ Reads Secrets`.
+
+## 1.0.10
+
+- Quality score is now a composite of spec correctness, completeness, and **security risk** — skills that read secrets, execute scripts, or make network calls score lower (a risky/stub skill is no longer a green 100).
+- Lint output ends with a **Failed** section listing each failure's rule, message, and full path, so problems don't scroll off in a large run.
+- New `--errors-only` flag to show only failing skills.
+- Fixed emoji spacing/overlap; rule ids are grouped by severity per skill.
+- The closer states how many skills failed instead of a vague "Problems found".
+
+## 1.0.9
+
+- Compact lint output: one line per skill (status dot, score, name, rule-id chips) with a single summary line, instead of a tall multi-row block per skill. Linting a single skill still shows full diagnostic messages.
+
+## 1.0.8
+
+- `skillmds` with no command in a terminal now opens the interactive CLI menu; it only starts the MCP server when launched over piped stdio (how MCP clients run it). Previously a bare `npx skillmds` in a terminal appeared to hang on the silent MCP server.
+
+## 1.0.7
+
+- Nicer CLI output: colored PASS/FAIL, quality-score bars, `ERROR`/`WARN`/`INFO` badges, and a summary with average score.
+- Running `skillmd` (or `skillmds`) with no command on a terminal now opens a guided interactive menu (lint, scan, search, init, list). Piped/CI still prints help.
+- Progress spinner while scanning.
+
+## 1.0.6
+
+- Bundle the banner image in the package and serve it via jsDelivr so it renders on the npm page (the previous absolute URL was unreachable).
+
+## 1.0.5
+
+- The `skillmds` binary now dispatches: `skillmds <command>` (lint, scan, add, …) runs the CLI, while `skillmds` with no command starts the MCP server. This makes `npx skillmds lint .` work without the `-p` flag.
+
+## 1.0.4
+
+- `skillmd lint`/`scan` print a progress line to stderr and warn when scanning a home directory, so a directory scan never looks like a frozen blank screen.
+- Directory scans skip large build/OS directories (`AppData`, `node_modules`, `target`, …) and cap recursion depth, so `lint .` in a big tree terminates quickly.
+- Clearer message when no `SKILL.md` is found.
+- Bare `skillmd` (no command) prints help.
+
+## 1.0.3
+
+- CLI (`skillmd`) and MCP server (`skillmds`) now report their version from `package.json` instead of a hardcoded string.
+- READMEs rewritten; added this changelog.
+
+## 1.0.2
+
+- `skillmd lint`: skip directories that cannot be read (e.g. `EPERM` on protected system folders) instead of aborting the scan.
+
+## 1.0.1
+
+- Fix `skillmd_lint` in the MCP server: keep `yaml` external in the bundled engine so it loads at runtime (bundling a CommonJS module into ESM raised `Dynamic require of "process"`).
+
+## 1.0.0
+
+- Add the `skillmd` CLI, shipped alongside the MCP server in this package. Commands: `lint`/`check`, `scan`, `rules`, `init`, `search`, `add`, `list`, `remove`, `update`, `publish`/`submit`, `login`, `logout`.
+- Validation engine shared with the SkillMD registry: `SKILL.md` parser, lint rules `SK001`–`SK040`, security scan, quality score, and `text`/`json`/`sarif`/`github` output.
+- Add the `skillmd_lint` MCP tool.
+- MCP server and CLI authenticate with `Authorization: Bearer` tokens.
+
+## 0.1.1
+
+- Initial MCP server: `skillmd_search`, `skillmd_get`, `skillmd_install`, `skillmd_trending`, `skillmd_recommend`, `skillmd_list_saved`.

package/bin/skillmd-mcp.mjs

@@ -13,6 +13,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { mkdir, writeFile } from "node:fs/promises";
 import { readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { join, resolve, dirname, sep } from "node:path";
 import { stringify as stringifyYaml } from "yaml";
@@ -36,6 +37,19 @@ try {
 const API = process.env.SKILLMD_API || "https://api.skillmd.com";
 const TOKEN = process.env.SKILLMD_TOKEN || "";
 
+// Companion files not in R2 carry a registry-supplied source_url. Ingest only
+// pins these to GitHub raw hosts, so anything else is a hostile/compromised
+// registry response — refuse to fetch it (client-side SSRF guard).
+const ALLOWED_SOURCE_HOSTS = new Set(["raw.githubusercontent.com", "gist.githubusercontent.com"]);
+function isAllowedSourceUrl(u) {
+  try {
+    const parsed = new URL(u);
+    return parsed.protocol === "https:" && ALLOWED_SOURCE_HOSTS.has(parsed.hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
+
 async function api(path, init = {}) {
   const headers = { accept: "application/json", ...(init.headers || {}) };
   if (TOKEN) headers.authorization = `Bearer ${TOKEN}`;
@@ -241,20 +255,37 @@ async function handleCall(name, args) {
         // bundle avoids adding an unzip dependency to this standalone binary.
         try {
           const bundle = await api(`/api/skills/${owner}/${slugName}/bundle?format=json`);
+          // Resolve + integrity-check every file BEFORE writing any, so a
+          // tampered pack refuses cleanly instead of leaving a partial install.
+          const resolved = [];
           for (const f of bundle.files ?? []) {
             if (f.path.includes("..") || f.path.startsWith("/")) continue;
             let buf;
-            if (f.content_base64 != null) buf = Buffer.from(f.content_base64, "base64");
-            else if (f.source_url) {
+            if (f.content_base64 != null) {
+              buf = Buffer.from(f.content_base64, "base64");
+              // R2 files are content-addressed; verify the bytes match the
+              // registry's sha256. Files without one (the reconstructed inline
+              // SKILL.md) carry no hash and are skipped.
+              if (f.sha256) {
+                const got = createHash("sha256").update(buf).digest("hex");
+                if (got !== f.sha256) {
+                  const err = new Error(`integrity check failed for "${f.path}"`);
+                  err.integrity = true;
+                  throw err;
+                }
+              }
+            } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
               const r = await fetch(f.source_url).catch(() => null);
               if (!r || !r.ok) continue;
               buf = Buffer.from(await r.arrayBuffer());
             } else continue;
-            await writeSafe(f.path, f.path === "SKILL.md" ? raw : buf);
+            resolved.push({ path: f.path, contents: f.path === "SKILL.md" ? raw : buf });
           }
-          written = (bundle.files ?? []).length || 1;
-          if (!(bundle.files ?? []).some((f) => f.path === "SKILL.md")) await writeSafe("SKILL.md", raw);
-        } catch {
+          for (const f of resolved) await writeSafe(f.path, f.contents);
+          written = resolved.length || 1;
+          if (!resolved.some((f) => f.path === "SKILL.md")) await writeSafe("SKILL.md", raw);
+        } catch (e) {
+          if (e && e.integrity) return text(`Refused: ${args.slug} failed integrity verification — ${e.message}. Not installed.`);
           await writeSafe("SKILL.md", raw);
           note = ` NOTE: pack assets could not be fetched — only SKILL.md was written. For the full pack run: npx skillmds add ${args.slug}`;
         }

package/dist/cli.js

@@ -41,7 +41,26 @@ function parseSkillMd(raw, type = "single") {
 }
 
 // ../../packages/core/src/security.ts
+var UNTRUSTED_INSTALL_RE = new RegExp(
+  [
+    /(?:npx|npm|yarn|pnpm|bun)\b[^\n]*--registry[= ]/.source,
+    // custom npm registry
+    /npm\s+config\s+set\s+registry/.source,
+    /pip3?\s+install\b[^\n]*(?:--index-url|--extra-index-url|-i\s+https?:)/.source,
+    // custom pip index
+    /(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|fi)?sh\b/.source,
+    // curl … | sh
+    /(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n|]*\|\s*iex\b/.source,
+    // PowerShell pipe-to-exec
+    /bash\s+<\(\s*(?:curl|wget)/.source,
+    // bash <(curl …)
+    /(?:pip3?|npm|npx)\s+(?:install|--yes|-y)?\s*[^\n]*https?:\/\/(?!registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org)[^\s'"`]+\.(?:whl|tar\.gz|tgz|zip)\b/.source
+    // install from raw archive URL
+  ].join("|"),
+  "i"
+);
 var RULES = [
+  ["untrusted_install", UNTRUSTED_INSTALL_RE],
   ["executes_scripts", /```(?:sh|bash|python|py|js|ts|ruby|rb)\b|\b(subprocess|os\.system|child_process|exec\()/i],
   ["network_calls", /\b(fetch|requests\.|urllib|axios|curl|wget|https?:\/\/|websocket)\b/i],
   ["reads_secrets", /\b(api[_-]?key|secret|token|password|os\.environ|process\.env|getenv)\b/i]
@@ -165,7 +184,10 @@ var RISK = {
   docs_only: 0,
   reads_secrets: 2,
   network_calls: 1,
-  executes_scripts: 5
+  executes_scripts: 5,
+  // fetch-and-execute from a non-standard source — the supply-chain pattern the
+  // AI verdict floors to "warning"; the heaviest penalty here for the same reason
+  untrusted_install: 15
 };
 var VERIFIED_FLOOR = 85;
 function qualityScore(diagnostics, security, opts = {}) {
@@ -739,6 +761,7 @@ import { Command as Command5 } from "commander";
 import pc5 from "picocolors";
 
 // ../cli/src/api.ts
+import { createHash } from "crypto";
 import { stringify as stringifyYaml } from "yaml";
 
 // ../cli/src/config.ts
@@ -769,16 +792,46 @@ function resolveApi(flags = {}) {
 }
 
 // ../cli/src/api.ts
+var IntegrityError = class extends Error {
+  integrity = true;
+  constructor(message) {
+    super(message);
+    this.name = "IntegrityError";
+  }
+};
+var RegistryError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "RegistryError";
+  }
+  status;
+};
+var ALLOWED_SOURCE_HOSTS = /* @__PURE__ */ new Set(["raw.githubusercontent.com", "gist.githubusercontent.com"]);
+function isAllowedSourceUrl(u) {
+  try {
+    const parsed = new URL(u);
+    return parsed.protocol === "https:" && ALLOWED_SOURCE_HOSTS.has(parsed.hostname.toLowerCase());
+  } catch {
+    return false;
+  }
+}
 function createClient(flags = {}) {
   const base = resolveApi(flags);
   const token = resolveToken(flags);
   async function api(path, init = {}) {
     const headers = { accept: "application/json", ...init.headers };
     if (token) headers.authorization = `Bearer ${token}`;
-    const res = await fetch(base + path, { ...init, headers });
+    let res;
+    try {
+      res = await fetch(base + path, { ...init, headers });
+    } catch (e) {
+      const cause = e instanceof Error ? e.cause?.message ?? e.message : String(e);
+      throw new RegistryError(`could not reach ${base}: ${cause}`);
+    }
     if (!res.ok) {
       const detail = await res.text().catch(() => "");
-      throw new Error(`SkillMD API ${res.status} on ${path}: ${detail}`);
+      throw new RegistryError(`SkillMD API ${res.status} on ${path}: ${detail}`, res.status);
     }
     return await res.json();
   }
@@ -794,8 +847,15 @@ async function fetchBundle(base, slug, token) {
   const out = [];
   for (const f of data.files) {
     if (f.content_base64 != null) {
-      out.push({ path: f.path, contents: Buffer.from(f.content_base64, "base64") });
-    } else if (f.source_url) {
+      const contents = Buffer.from(f.content_base64, "base64");
+      if (f.sha256) {
+        const got = createHash("sha256").update(contents).digest("hex");
+        if (got !== f.sha256) {
+          throw new IntegrityError(`integrity check failed for "${f.path}" (expected ${f.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026)`);
+        }
+      }
+      out.push({ path: f.path, contents });
+    } else if (f.source_url && isAllowedSourceUrl(f.source_url)) {
       const r = await fetch(f.source_url).catch(() => null);
       if (r && r.ok) out.push({ path: f.path, contents: Buffer.from(await r.arrayBuffer()) });
     }
@@ -917,6 +977,8 @@ function infoCommand() {
 // ../cli/src/commands/add.ts
 import { Command as Command7, Option } from "commander";
 import { existsSync as existsSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { resolve as resolve3 } from "path";
 import pc7 from "picocolors";
 
 // ../cli/src/agents.ts
@@ -924,20 +986,84 @@ import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, rmSync as rmS
 import { homedir as homedir3 } from "os";
 import { join as join4, resolve as resolve2, dirname as dirname2, sep as sep2 } from "path";
 var AGENTS = [
-  { id: "claude-code", segments: [".claude", "skills"] },
-  { id: "cursor", segments: [".cursor", "skills"] },
-  { id: "codex", segments: [".codex", "skills"] },
-  { id: "windsurf", segments: [".windsurf", "skills"] },
-  { id: "opencode", segments: [".opencode", "skills"] }
+  { id: "claude-code", project: [".claude", "skills"], global: [".claude", "skills"], detect: [[".claude"]] },
+  { id: "cursor", project: [".cursor", "skills"], global: [".cursor", "skills"], detect: [[".cursor"]] },
+  { id: "codex", project: [".codex", "skills"], global: [".codex", "skills"], detect: [[".codex"]] },
+  { id: "windsurf", project: [".windsurf", "skills"], global: [".codeium", "windsurf", "skills"], detect: [[".codeium", "windsurf"], [".windsurf"]] },
+  { id: "opencode", project: [".opencode", "skills"], global: [".config", "opencode", "skills"], detect: [[".config", "opencode"], [".opencode"]] },
+  { id: "gemini-cli", project: [".agents", "skills"], global: [".gemini", "skills"], detect: [[".gemini"]] },
+  { id: "antigravity", project: [".agents", "skills"], global: [".gemini", "antigravity", "skills"], detect: [[".gemini", "antigravity"], [".antigravity"]] },
+  { id: "kiro", project: [".kiro", "skills"], global: [".kiro", "skills"], detect: [[".kiro"]] },
+  { id: "warp", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".warp"]] },
+  { id: "github-copilot", project: [".agents", "skills"], global: [".copilot", "skills"], detect: [[".copilot"]] },
+  { id: "cline", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".cline"]] },
+  { id: "roo", project: [".roo", "skills"], global: [".roo", "skills"], detect: [[".roo"]] },
+  { id: "goose", project: [".goose", "skills"], global: [".config", "goose", "skills"], detect: [[".config", "goose"]] },
+  { id: "trae", project: [".trae", "skills"], global: [".trae", "skills"], detect: [[".trae"]] },
+  { id: "qwen-code", project: [".qwen", "skills"], global: [".qwen", "skills"], detect: [[".qwen"]] },
+  { id: "amp", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".config", "amp"]] },
+  // — extended registry —
+  { id: "openclaw", project: ["skills"], global: [".openclaw", "skills"], detect: [[".openclaw"], [".clawdbot"], [".moltbot"]] },
+  { id: "kilo", project: [".kilocode", "skills"], global: [".kilocode", "skills"], detect: [[".kilocode"]] },
+  { id: "hermes-agent", project: [".hermes", "skills"], global: [".hermes", "skills"], detect: [[".hermes"]] },
+  { id: "continue", project: [".continue", "skills"], global: [".continue", "skills"], detect: [[".continue"]] },
+  { id: "devin", project: [".devin", "skills"], global: [".config", "devin", "skills"], detect: [[".config", "devin"]] },
+  { id: "openhands", project: [".openhands", "skills"], global: [".openhands", "skills"], detect: [[".openhands"]] },
+  { id: "replit", project: [".agents", "skills"], global: [".config", "agents", "skills"], detect: [[".replit"]] },
+  { id: "mistral-vibe", project: [".vibe", "skills"], global: [".vibe", "skills"], detect: [[".vibe"]] },
+  { id: "zed", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".config", "zed"]] },
+  { id: "adal", project: [".adal", "skills"], global: [".adal", "skills"], detect: [[".adal"]] },
+  { id: "aider-desk", project: [".aider-desk", "skills"], global: [".aider-desk", "skills"], detect: [[".aider-desk"]] },
+  { id: "antigravity-cli", project: [".agents", "skills"], global: [".gemini", "antigravity-cli", "skills"], detect: [[".gemini", "antigravity-cli"]] },
+  { id: "augment", project: [".augment", "skills"], global: [".augment", "skills"], detect: [[".augment"]] },
+  { id: "autohand-code", project: [".autohand", "skills"], global: [".autohand", "skills"], detect: [[".autohand"]] },
+  { id: "bob", project: [".bob", "skills"], global: [".bob", "skills"], detect: [[".bob"]] },
+  { id: "codearts-agent", project: [".codeartsdoer", "skills"], global: [".codeartsdoer", "skills"], detect: [[".codeartsdoer"]] },
+  { id: "codebuddy", project: [".codebuddy", "skills"], global: [".codebuddy", "skills"], detect: [[".codebuddy"]] },
+  { id: "codemaker", project: [".codemaker", "skills"], global: [".codemaker", "skills"], detect: [[".codemaker"]] },
+  { id: "codestudio", project: [".codestudio", "skills"], global: [".codestudio", "skills"], detect: [[".codestudio"]] },
+  { id: "command-code", project: [".commandcode", "skills"], global: [".commandcode", "skills"], detect: [[".commandcode"]] },
+  { id: "cortex", project: [".cortex", "skills"], global: [".snowflake", "cortex", "skills"], detect: [[".snowflake", "cortex"]] },
+  { id: "crush", project: [".crush", "skills"], global: [".config", "crush", "skills"], detect: [[".config", "crush"]] },
+  { id: "deepagents", project: [".agents", "skills"], global: [".deepagents", "agent", "skills"], detect: [[".deepagents"]] },
+  { id: "dexto", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".dexto"]] },
+  { id: "droid", project: [".factory", "skills"], global: [".factory", "skills"], detect: [[".factory"]] },
+  { id: "firebender", project: [".agents", "skills"], global: [".firebender", "skills"], detect: [[".firebender"]] },
+  { id: "forgecode", project: [".forge", "skills"], global: [".forge", "skills"], detect: [[".forge"]] },
+  { id: "iflow-cli", project: [".iflow", "skills"], global: [".iflow", "skills"], detect: [[".iflow"]] },
+  { id: "inference-sh", project: [".inferencesh", "skills"], global: [".inferencesh", "skills"], detect: [[".inferencesh"]] },
+  { id: "jazz", project: [".jazz", "skills"], global: [".jazz", "skills"], detect: [[".jazz"]] },
+  { id: "junie", project: [".junie", "skills"], global: [".junie", "skills"], detect: [[".junie"]] },
+  { id: "kimi-code-cli", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".kimi-code"], [".kimi"]] },
+  { id: "kode", project: [".kode", "skills"], global: [".kode", "skills"], detect: [[".kode"]] },
+  { id: "lingma", project: [".lingma", "skills"], global: [".lingma", "skills"], detect: [[".lingma"]] },
+  { id: "loaf", project: [".agents", "skills"], global: [".agents", "skills"], detect: [[".loaf"]] },
+  { id: "mcpjam", project: [".mcpjam", "skills"], global: [".mcpjam", "skills"], detect: [[".mcpjam"]] },
+  { id: "moxby", project: [".moxby", "skills"], global: [".moxby", "skills"], detect: [[".moxby"]] },
+  { id: "mux", project: [".mux", "skills"], global: [".mux", "skills"], detect: [[".mux"]] },
+  { id: "neovate", project: [".neovate", "skills"], global: [".neovate", "skills"], detect: [[".neovate"]] },
+  { id: "ona", project: [".ona", "skills"], global: [".ona", "skills"], detect: [[".ona"]] },
+  { id: "pi", project: [".pi", "skills"], global: [".pi", "agent", "skills"], detect: [[".pi", "agent"]] },
+  { id: "pochi", project: [".pochi", "skills"], global: [".pochi", "skills"], detect: [[".pochi"]] },
+  { id: "qoder", project: [".qoder", "skills"], global: [".qoder", "skills"], detect: [[".qoder"]] },
+  { id: "qoder-cn", project: [".qoder", "skills"], global: [".qoder-cn", "skills"], detect: [[".qoder-cn"]] },
+  { id: "reasonix", project: [".reasonix", "skills"], global: [".reasonix", "skills"], detect: [[".reasonix"]] },
+  { id: "rovodev", project: [".rovodev", "skills"], global: [".rovodev", "skills"], detect: [[".rovodev"]] },
+  { id: "tabnine-cli", project: [".tabnine", "agent", "skills"], global: [".tabnine", "agent", "skills"], detect: [[".tabnine"]] },
+  { id: "terramind", project: [".terramind", "skills"], global: [".terramind", "skills"], detect: [[".terramind"]] },
+  { id: "tinycloud", project: [".tinycloud", "skills"], global: [".tinycloud", "skills"], detect: [[".tinycloud"]] },
+  { id: "trae-cn", project: [".trae", "skills"], global: [".trae-cn", "skills"], detect: [[".trae-cn"]] },
+  { id: "zcode", project: [".zcode", "skills"], global: [".zcode", "skills"], detect: [[".zcode"]] },
+  { id: "zencoder", project: [".zencoder", "skills"], global: [".zencoder", "skills"], detect: [[".zencoder"]] }
 ];
 function agentDir(agentId, opts = {}) {
   const agent = AGENTS.find((a) => a.id === agentId);
   if (!agent) throw new Error(`Unknown agent: ${agentId}. Known: ${AGENTS.map((a) => a.id).join(", ")}`);
-  const root = opts.global ? homedir3() : opts.cwd ?? process.cwd();
-  return join4(root, ...agent.segments);
+  return opts.global ? join4(opts.home ?? homedir3(), ...agent.global) : join4(opts.cwd ?? process.cwd(), ...agent.project);
 }
 function detectAgents(opts = {}) {
-  return AGENTS.filter((a) => existsSync3(agentDir(a.id, opts))).map((a) => a.id);
+  const home = opts.home ?? homedir3();
+  return AGENTS.filter((a) => a.detect.some((d) => existsSync3(join4(home, ...d)))).map((a) => a.id);
 }
 function writeSkill(skillName, files, targetDir, opts = {}) {
   if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(skillName) || skillName.includes("..")) {
@@ -965,8 +1091,11 @@ function writeSkill(skillName, files, targetDir, opts = {}) {
 function installedSkills(opts = {}) {
   const scope = opts.global ? "global" : "project";
   const out = [];
+  const seen = /* @__PURE__ */ new Set();
   for (const agent of AGENTS) {
     const dir = agentDir(agent.id, opts);
+    if (seen.has(dir)) continue;
+    seen.add(dir);
     if (!existsSync3(dir)) continue;
     for (const entry of readdirSync2(dir)) {
       const skillMd = join4(dir, entry, "SKILL.md");
@@ -995,12 +1124,31 @@ async function resolvePackFiles(skill, fetchTree = resolveTree) {
   }
   return null;
 }
+function registryFallbackNote(host) {
+  return `installed from GitHub because the SkillMD registry (${host}) was unreachable \u2014 this copy is not the registry-reviewed version`;
+}
+function registryUnreachableError(arg, host, e) {
+  const why = e.status ? `HTTP ${e.status}` : "network error";
+  return new Error(
+    `could not reach the SkillMD registry at ${host} (${why}), and "${arg}" was not found on GitHub either.
+If this environment restricts network access (sandbox, proxy, CI), ask an administrator to allow ${host} \u2014 or install through the SkillMD MCP server, which many sandboxed agents can already reach.
+Registry error: ${e.message}`
+  );
+}
 var defaultDeps = {
   async resolve(arg, flags) {
     if (isLocalish(arg)) {
-      const rs2 = await resolveSource(arg);
-      return rs2.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+      const rs = await resolveSource(arg);
+      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
     }
+    let registryDown = null;
+    const registryHost = (() => {
+      try {
+        return new URL(createClient(flags).base).host;
+      } catch {
+        return "api.skillmd.com";
+      }
+    })();
     if (/^[^/\s:]+\/[^/\s:]+$/.test(arg)) {
       const { api, base: apiBase, token } = createClient(flags);
       const [owner, name] = arg.split("/");
@@ -1025,11 +1173,19 @@ var defaultDeps = {
           if (pack) return [{ ...meta, ...pack }];
         }
         return [{ ...meta, raw: skillMdFor(skill) }];
-      } catch {
+      } catch (e) {
+        if (e instanceof IntegrityError) throw e;
+        if (e instanceof RegistryError && e.status !== 404) registryDown = e;
       }
     }
-    const rs = await resolveSource(arg);
-    return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug }));
+    try {
+      const rs = await resolveSource(arg);
+      const note2 = registryDown ? registryFallbackNote(registryHost) : void 0;
+      return rs.map((r) => ({ name: r.slug, raw: r.raw, slug: r.slug, note: note2 }));
+    } catch (e) {
+      if (registryDown) throw registryUnreachableError(arg, registryHost, registryDown);
+      throw e;
+    }
   },
   fireInstall(registrySlug, flags) {
     const { api } = createClient(flags);
@@ -1043,14 +1199,35 @@ var defaultDeps = {
   }
 };
 async function runAdd(arg, flags, deps = defaultDeps) {
-  let candidates = await deps.resolve(arg, flags);
+  let candidates;
+  try {
+    candidates = await deps.resolve(arg, flags);
+  } catch (e) {
+    if (e instanceof IntegrityError) {
+      return {
+        written: [],
+        blocked: [{ name: arg, reason: e.message }],
+        exitCode: 1,
+        output: pc7.red(`\u2717 ${arg} blocked \u2014 ${e.message}`)
+      };
+    }
+    throw e;
+  }
   if (flags.skill?.length) candidates = candidates.filter((c) => flags.skill.includes(c.name) || flags.skill.includes("*"));
   const deny = new Set(flags.deny ?? []);
   const written = [];
   const blocked = [];
   const lines = [];
-  const scope = { global: flags.global, cwd: flags.cwd };
-  const targets = flags.agent?.length ? flags.agent : detectAgents(scope).length ? detectAgents(scope) : ["claude-code"];
+  const home = flags.home ?? homedir4();
+  const isGlobal = flags.global || resolve3(flags.cwd ?? process.cwd()) === resolve3(home);
+  const scope = { global: isGlobal, cwd: flags.cwd, home: flags.home };
+  const detected = detectAgents(scope);
+  const targets = flags.agent?.length ? flags.agent : detected.length ? detected : ["claude-code"];
+  const dirAgents = /* @__PURE__ */ new Map();
+  for (const agentId of targets) {
+    const dir = agentDir(agentId, scope);
+    dirAgents.set(dir, [...dirAgents.get(dir) ?? [], agentId]);
+  }
   for (const c of candidates) {
     const result = lint(c.raw, { slug: c.slug });
     const allFlags = [.../* @__PURE__ */ new Set([...result.security.flags, ...c.securityFlags ?? []])];
@@ -1066,15 +1243,17 @@ async function runAdd(arg, flags, deps = defaultDeps) {
       continue;
     }
     const files = c.files ?? [{ path: "SKILL.md", contents: c.raw }];
-    for (const agentId of targets) {
-      const dir = agentDir(agentId, scope);
+    for (const [dir, agentIds] of dirAgents) {
       const out = writeSkill(c.name, files, dir, { mode: "copy" });
       written.push({ name: c.name, dir: out });
-      lines.push(pc7.green(`\u2713 ${c.name} \u2192 ${out}`) + pc7.dim(` (score ${result.score}${allFlags.length ? `; ${allFlags.join(", ")}` : ""})`));
+      lines.push(pc7.green(`\u2713 ${c.name} \u2192 ${out}`) + pc7.dim(` (${agentIds.join(", ")}; score ${result.score}${allFlags.length ? `; ${allFlags.join(", ")}` : ""})`));
     }
     if (c.pinMiss) {
       lines.push(pc7.yellow(`\u26A0 ${c.name}: pinned commit unavailable upstream \u2014 fetched the source repo's default branch instead`));
     }
+    if (c.note) {
+      lines.push(pc7.yellow(`\u26A0 ${c.name}: ${c.note}`));
+    }
     if (c.type === "pack" && !c.files) {
       lines.push(pc7.yellow(`\u26A0 ${c.name} is a pack but its asset files could not be fetched \u2014 only SKILL.md was installed. It may reference missing files.`));
     }
@@ -1084,7 +1263,7 @@ async function runAdd(arg, flags, deps = defaultDeps) {
   return { written, blocked, exitCode, output: lines.join("\n") };
 }
 function addCommand() {
-  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
+  return new Command7("add").description("Install a skill from the registry, a GitHub repo, or a local path (lints before writing)").argument("<source>", "registry slug (owner/name), GitHub source, or local path").option("-g, --global", "install to the user directory instead of the project").option("-a, --agent <agents...>", "target specific agents (default: every agent detected on this machine)").option("-s, --skill <names...>", "install only specific skills by name ('*' for all)").option("--copy", "copy files (default)", true).option("-y, --yes", "skip confirmation prompts").addOption(new Option("--allow-unverified").hideHelp()).option("--skip-lint", "install even if the skill fails lint").option("--deny <flags...>", "refuse skills carrying any of these security flags (opt-in)").action(async (source, opts, cmd) => {
     const merged = { ...cmd.parent?.opts(), ...opts };
     const run = await runAdd(source, merged);
     console.log(run.output);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillmds",
-  "version": "1.0.18",
+  "version": "1.0.20",
   "description": "SkillMD for agents: the `skillmds` MCP server + the `skillmd` CLI (lint, scan, search, install, publish Agent Skills) from skillmd.com.",
   "type": "module",
   "bin": {

package/vendor/index.js

@@ -47,7 +47,26 @@ function categorize(text) {
 }
 
 // ../../packages/core/src/security.ts
+var UNTRUSTED_INSTALL_RE = new RegExp(
+  [
+    /(?:npx|npm|yarn|pnpm|bun)\b[^\n]*--registry[= ]/.source,
+    // custom npm registry
+    /npm\s+config\s+set\s+registry/.source,
+    /pip3?\s+install\b[^\n]*(?:--index-url|--extra-index-url|-i\s+https?:)/.source,
+    // custom pip index
+    /(?:curl|wget)\b[^\n|]*\|\s*(?:sudo\s+)?(?:ba|z|fi)?sh\b/.source,
+    // curl … | sh
+    /(?:iwr|irm|invoke-webrequest|invoke-restmethod)\b[^\n|]*\|\s*iex\b/.source,
+    // PowerShell pipe-to-exec
+    /bash\s+<\(\s*(?:curl|wget)/.source,
+    // bash <(curl …)
+    /(?:pip3?|npm|npx)\s+(?:install|--yes|-y)?\s*[^\n]*https?:\/\/(?!registry\.npmjs\.org|pypi\.org|files\.pythonhosted\.org)[^\s'"`]+\.(?:whl|tar\.gz|tgz|zip)\b/.source
+    // install from raw archive URL
+  ].join("|"),
+  "i"
+);
 var RULES = [
+  ["untrusted_install", UNTRUSTED_INSTALL_RE],
   ["executes_scripts", /```(?:sh|bash|python|py|js|ts|ruby|rb)\b|\b(subprocess|os\.system|child_process|exec\()/i],
   ["network_calls", /\b(fetch|requests\.|urllib|axios|curl|wget|https?:\/\/|websocket)\b/i],
   ["reads_secrets", /\b(api[_-]?key|secret|token|password|os\.environ|process\.env|getenv)\b/i]
@@ -171,7 +190,10 @@ var RISK = {
   docs_only: 0,
   reads_secrets: 2,
   network_calls: 1,
-  executes_scripts: 5
+  executes_scripts: 5,
+  // fetch-and-execute from a non-standard source — the supply-chain pattern the
+  // AI verdict floors to "warning"; the heaviest penalty here for the same reason
+  untrusted_install: 15
 };
 var VERIFIED_FLOOR = 85;
 function qualityScore(diagnostics, security, opts = {}) {
@@ -296,6 +318,7 @@ export {
   MAX_NAME,
   MAX_SKILL_BYTES,
   RULES2 as RULES,
+  UNTRUSTED_INSTALL_RE,
   categorize,
   lint,
   parseSkillMd,