skills 1.4.2 → 1.4.4

package/dist/cli.mjs

@@ -21,6 +21,13 @@ import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpat
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 function getOwnerRepo(parsed) {
 	if (parsed.type === "local") return null;
+	const sshMatch = parsed.url.match(/^git@[^:]+:(.+)$/);
+	if (sshMatch) {
+		let path = sshMatch[1];
+		path = path.replace(/\.git$/, "");
+		if (path.includes("/")) return path;
+		return null;
+	}
 	if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null;
 	try {
 		let path = new URL(parsed.url).pathname.slice(1);
@@ -46,22 +53,22 @@ async function isRepoPrivate(owner, repo) {
 		return null;
 	}
 }
+function sanitizeSubpath(subpath) {
+	const segments = subpath.replace(/\\/g, "/").split("/");
+	for (const segment of segments) if (segment === "..") throw new Error(`Unsafe subpath: "${subpath}" contains path traversal segments. Subpaths must not contain ".." components.`);
+	return subpath;
+}
 function isLocalPath(input) {
 	return isAbsolute(input) || input.startsWith("./") || input.startsWith("../") || input === "." || input === ".." || /^[a-zA-Z]:[/\\]/.test(input);
 }
-function isDirectSkillUrl(input) {
-	if (!input.startsWith("http://") && !input.startsWith("https://")) return false;
-	if (!input.toLowerCase().endsWith("/skill.md")) return false;
-	if (input.includes("github.com/") && !input.includes("raw.githubusercontent.com")) {
-		if (!input.includes("/blob/") && !input.includes("/raw/")) return false;
-	}
-	if (input.includes("gitlab.com/") && !input.includes("/-/raw/")) return false;
-	return true;
-}
 const SOURCE_ALIASES = { "coinbase/agentWallet": "coinbase/agentic-wallet-skills" };
 function parseSource(input) {
 	const alias = SOURCE_ALIASES[input];
 	if (alias) input = alias;
+	const githubPrefixMatch = input.match(/^github:(.+)$/);
+	if (githubPrefixMatch) return parseSource(githubPrefixMatch[1]);
+	const gitlabPrefixMatch = input.match(/^gitlab:(.+)$/);
+	if (gitlabPrefixMatch) return parseSource(`https://gitlab.com/${gitlabPrefixMatch[1]}`);
 	if (isLocalPath(input)) {
 		const resolvedPath = resolve(input);
 		return {
@@ -70,10 +77,6 @@ function parseSource(input) {
 			localPath: resolvedPath
 		};
 	}
-	if (isDirectSkillUrl(input)) return {
-		type: "direct-url",
-		url: input
-	};
 	const githubTreeWithPathMatch = input.match(/github\.com\/([^/]+)\/([^/]+)\/tree\/([^/]+)\/(.+)/);
 	if (githubTreeWithPathMatch) {
 		const [, owner, repo, ref, subpath] = githubTreeWithPathMatch;
@@ -81,7 +84,7 @@ function parseSource(input) {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
 			ref,
-			subpath
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
 	const githubTreeMatch = input.match(/github\.com\/([^/]+)\/([^/]+)\/tree\/([^/]+)$/);
@@ -108,7 +111,7 @@ function parseSource(input) {
 			type: "gitlab",
 			url: `${protocol}://${hostname}/${repoPath.replace(/\.git$/, "")}.git`,
 			ref,
-			subpath
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
 	const gitlabTreeMatch = input.match(/^(https?):\/\/([^/]+)\/(.+?)\/-\/tree\/([^/]+)$/);
@@ -143,7 +146,7 @@ function parseSource(input) {
 		return {
 			type: "github",
 			url: `https://github.com/${owner}/${repo}.git`,
-			subpath
+			subpath: subpath ? sanitizeSubpath(subpath) : subpath
 		};
 	}
 	if (isWellKnownUrl(input)) return {
@@ -162,10 +165,8 @@ function isWellKnownUrl(input) {
 		if ([
 			"github.com",
 			"gitlab.com",
-			"huggingface.co",
 			"raw.githubusercontent.com"
 		].includes(parsed.hostname)) return false;
-		if (input.toLowerCase().endsWith("/skill.md")) return false;
 		if (input.endsWith(".git")) return false;
 		return true;
 	} catch {
@@ -501,9 +502,15 @@ async function findSkillDirs(dir, depth = 0, maxDepth = 5) {
 		return [];
 	}
 }
+function isSubpathSafe(basePath, subpath) {
+	const normalizedBase = normalize(resolve(basePath));
+	const normalizedTarget = normalize(resolve(join(basePath, subpath)));
+	return normalizedTarget.startsWith(normalizedBase + sep) || normalizedTarget === normalizedBase;
+}
 async function discoverSkills(basePath, subpath, options) {
 	const skills = [];
 	const seenNames = /* @__PURE__ */ new Set();
+	if (subpath && !isSubpathSafe(basePath, subpath)) throw new Error(`Invalid subpath: "${subpath}" resolves outside the repository directory. Subpath must not contain ".." segments that escape the base path.`);
 	const searchPath = subpath ? join(basePath, subpath) : basePath;
 	const pluginGroupings = await getPluginGroupings(searchPath);
 	const enhanceSkill = (skill) => {
@@ -1179,78 +1186,6 @@ function getCanonicalPath(skillName, options = {}) {
 	if (!isPathSafe(canonicalBase, canonicalPath)) throw new Error("Invalid skill name: potential path traversal detected");
 	return canonicalPath;
 }
-async function installRemoteSkillForAgent(skill, agentType, options = {}) {
-	const agent = agents[agentType];
-	const isGlobal = options.global ?? false;
-	const cwd = options.cwd || process.cwd();
-	const installMode = options.mode ?? "symlink";
-	if (isGlobal && agent.globalSkillsDir === void 0) return {
-		success: false,
-		path: "",
-		mode: installMode,
-		error: `${agent.displayName} does not support global skill installation`
-	};
-	const skillName = sanitizeName(skill.installName);
-	const canonicalBase = getCanonicalSkillsDir(isGlobal, cwd);
-	const canonicalDir = join(canonicalBase, skillName);
-	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd);
-	const agentDir = join(agentBase, skillName);
-	if (!isPathSafe(canonicalBase, canonicalDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	if (!isPathSafe(agentBase, agentDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	try {
-		if (installMode === "copy") {
-			await cleanAndCreateDirectory(agentDir);
-			await writeFile(join(agentDir, "SKILL.md"), skill.content, "utf-8");
-			return {
-				success: true,
-				path: agentDir,
-				mode: "copy"
-			};
-		}
-		await cleanAndCreateDirectory(canonicalDir);
-		await writeFile(join(canonicalDir, "SKILL.md"), skill.content, "utf-8");
-		if (isGlobal && isUniversalAgent(agentType)) return {
-			success: true,
-			path: canonicalDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-		if (!await createSymlink(canonicalDir, agentDir)) {
-			await cleanAndCreateDirectory(agentDir);
-			await writeFile(join(agentDir, "SKILL.md"), skill.content, "utf-8");
-			return {
-				success: true,
-				path: agentDir,
-				canonicalPath: canonicalDir,
-				mode: "symlink",
-				symlinkFailed: true
-			};
-		}
-		return {
-			success: true,
-			path: agentDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-	} catch (error) {
-		return {
-			success: false,
-			path: agentDir,
-			mode: installMode,
-			error: error instanceof Error ? error.message : "Unknown error"
-		};
-	}
-}
 async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
 	const agent = agents[agentType];
 	const isGlobal = options.global ?? false;
@@ -1495,108 +1430,7 @@ var ProviderRegistryImpl = class {
 		return [...this.providers];
 	}
 };
-const registry = new ProviderRegistryImpl();
-function registerProvider(provider) {
-	registry.register(provider);
-}
-function findProvider(url) {
-	return registry.findProvider(url);
-}
-var MintlifyProvider = class {
-	id = "mintlify";
-	displayName = "Mintlify";
-	match(url) {
-		if (!url.startsWith("http://") && !url.startsWith("https://")) return { matches: false };
-		if (!url.toLowerCase().endsWith("/skill.md")) return { matches: false };
-		if (url.includes("github.com") || url.includes("gitlab.com")) return { matches: false };
-		if (url.includes("huggingface.co")) return { matches: false };
-		return { matches: true };
-	}
-	async fetchSkill(url) {
-		try {
-			const response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
-			if (!response.ok) return null;
-			const content = await response.text();
-			const { data } = (0, import_gray_matter.default)(content);
-			const mintlifySite = data.metadata?.["mintlify-proj"];
-			if (!mintlifySite) return null;
-			if (!data.name || !data.description) return null;
-			return {
-				name: data.name,
-				description: data.description,
-				content,
-				installName: mintlifySite,
-				sourceUrl: url,
-				metadata: data.metadata
-			};
-		} catch {
-			return null;
-		}
-	}
-	toRawUrl(url) {
-		return url;
-	}
-	getSourceIdentifier(url) {
-		return "mintlify/com";
-	}
-};
-const mintlifyProvider = new MintlifyProvider();
-var HuggingFaceProvider = class {
-	id = "huggingface";
-	displayName = "HuggingFace";
-	HOST = "huggingface.co";
-	match(url) {
-		if (!url.startsWith("http://") && !url.startsWith("https://")) return { matches: false };
-		try {
-			if (new URL(url).hostname !== this.HOST) return { matches: false };
-		} catch {
-			return { matches: false };
-		}
-		if (!url.toLowerCase().endsWith("/skill.md")) return { matches: false };
-		if (!url.includes("/spaces/")) return { matches: false };
-		return { matches: true };
-	}
-	async fetchSkill(url) {
-		try {
-			const rawUrl = this.toRawUrl(url);
-			const response = await fetch(rawUrl, { signal: AbortSignal.timeout(3e4) });
-			if (!response.ok) return null;
-			const content = await response.text();
-			const { data } = (0, import_gray_matter.default)(content);
-			if (!data.name || !data.description) return null;
-			const parsed = this.parseUrl(url);
-			if (!parsed) return null;
-			const installName = data.metadata?.["install-name"] || parsed.repo;
-			return {
-				name: data.name,
-				description: data.description,
-				content,
-				installName,
-				sourceUrl: url,
-				metadata: data.metadata
-			};
-		} catch {
-			return null;
-		}
-	}
-	toRawUrl(url) {
-		return url.replace("/blob/", "/raw/");
-	}
-	getSourceIdentifier(url) {
-		const parsed = this.parseUrl(url);
-		if (!parsed) return "huggingface/unknown";
-		return `huggingface/${parsed.owner}/${parsed.repo}`;
-	}
-	parseUrl(url) {
-		const match = url.match(/\/spaces\/([^/]+)\/([^/]+)/);
-		if (!match || !match[1] || !match[2]) return null;
-		return {
-			owner: match[1],
-			repo: match[2]
-		};
-	}
-};
-const huggingFaceProvider = new HuggingFaceProvider();
+new ProviderRegistryImpl();
 var WellKnownProvider = class {
 	id = "well-known";
 	displayName = "Well-Known Skills";
@@ -1753,15 +1587,9 @@ var WellKnownProvider = class {
 	}
 	getSourceIdentifier(url) {
 		try {
-			const parsed = new URL(url);
-			const hostParts = parsed.hostname.split(".");
-			if (hostParts.length >= 2) {
-				const tld = hostParts[hostParts.length - 1];
-				return `${hostParts[hostParts.length - 2]}/${tld}`;
-			}
-			return parsed.hostname.replace(".", "/");
+			return new URL(url).hostname.replace(/^www\./, "");
 		} catch {
-			return "unknown/unknown";
+			return "unknown";
 		}
 	}
 	async hasSkillsIndex(url) {
@@ -1769,28 +1597,6 @@ var WellKnownProvider = class {
 	}
 };
 const wellKnownProvider = new WellKnownProvider();
-registerProvider(mintlifyProvider);
-registerProvider(huggingFaceProvider);
-async function fetchMintlifySkill(url) {
-	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(3e4) });
-		if (!response.ok) return null;
-		const content = await response.text();
-		const { data } = (0, import_gray_matter.default)(content);
-		const mintlifySite = data.metadata?.["mintlify-proj"];
-		if (!mintlifySite) return null;
-		if (!data.name || !data.description) return null;
-		return {
-			name: data.name,
-			description: data.description,
-			content,
-			mintlifySite,
-			sourceUrl: url
-		};
-	} catch {
-		return null;
-	}
-}
 const AGENTS_DIR$1 = ".agents";
 const LOCK_FILE$1 = ".skill-lock.json";
 const CURRENT_VERSION$1 = 3;
@@ -1967,7 +1773,7 @@ function createEmptyLocalLock() {
 		skills: {}
 	};
 }
-var version$1 = "1.4.2";
+var version$1 = "1.4.4";
 const isCancelled$1 = (value) => typeof value === "symbol";
 async function isSourcePrivate(source) {
 	const ownerRepo = parseOwnerRepo(source);
@@ -2133,232 +1939,6 @@ async function selectAgentsInteractive(options) {
 	return selected;
 }
 setVersion(version$1);
-async function handleRemoteSkill(source, url, options, spinner) {
-	const provider = findProvider(url);
-	if (!provider) {
-		await handleDirectUrlSkillLegacy(source, url, options, spinner);
-		return;
-	}
-	spinner.start(`Fetching skill.md from ${provider.displayName}...`);
-	const providerSkill = await provider.fetchSkill(url);
-	if (!providerSkill) {
-		spinner.stop(import_picocolors.default.red("Invalid skill"));
-		Se(import_picocolors.default.red("Could not fetch skill.md or missing required frontmatter (name, description)."));
-		process.exit(1);
-	}
-	const remoteSkill = {
-		name: providerSkill.name,
-		description: providerSkill.description,
-		content: providerSkill.content,
-		installName: providerSkill.installName,
-		sourceUrl: providerSkill.sourceUrl,
-		providerId: provider.id,
-		sourceIdentifier: provider.getSourceIdentifier(url),
-		metadata: providerSkill.metadata
-	};
-	spinner.stop(`Found skill: ${import_picocolors.default.cyan(remoteSkill.installName)}`);
-	M.info(`Skill: ${import_picocolors.default.cyan(remoteSkill.name)}`);
-	M.message(import_picocolors.default.dim(remoteSkill.description));
-	M.message(import_picocolors.default.dim(`Source: ${remoteSkill.sourceIdentifier}`));
-	if (options.list) {
-		console.log();
-		M.step(import_picocolors.default.bold("Skill Details"));
-		M.message(`  ${import_picocolors.default.cyan("Name:")} ${remoteSkill.name}`);
-		M.message(`  ${import_picocolors.default.cyan("Install as:")} ${remoteSkill.installName}`);
-		M.message(`  ${import_picocolors.default.cyan("Provider:")} ${provider.displayName}`);
-		M.message(`  ${import_picocolors.default.cyan("Description:")} ${remoteSkill.description}`);
-		console.log();
-		Se("Run without --list to install");
-		process.exit(0);
-	}
-	let targetAgents;
-	const validAgents = Object.keys(agents);
-	const universalAgents = getUniversalAgents();
-	if (options.agent?.includes("*")) {
-		targetAgents = validAgents;
-		M.info(`Installing to all ${targetAgents.length} agents`);
-	} else if (options.agent && options.agent.length > 0) {
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
-		if (invalidAgents.length > 0) {
-			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
-			M.info(`Valid agents: ${validAgents.join(", ")}`);
-			process.exit(1);
-		}
-		targetAgents = options.agent;
-	} else {
-		spinner.start("Loading agents...");
-		const installedAgents = await detectInstalledAgents();
-		const totalAgents = Object.keys(agents).length;
-		spinner.stop(`${totalAgents} agents`);
-		if (installedAgents.length === 0) if (options.yes) {
-			targetAgents = universalAgents;
-			M.info(`Installing to universal agents`);
-		} else {
-			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-		else if (installedAgents.length === 1 || options.yes) {
-			targetAgents = ensureUniversalAgents(installedAgents);
-			const { universal, symlinked } = splitAgentsByType(targetAgents);
-			if (symlinked.length > 0) M.info(`Installing to: ${import_picocolors.default.green("universal")} + ${symlinked.map((a) => import_picocolors.default.cyan(a)).join(", ")}`);
-			else M.info(`Installing to: ${import_picocolors.default.green("universal agents")}`);
-		} else {
-			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-	}
-	let installGlobally = options.global ?? false;
-	const supportsGlobal = targetAgents.some((a) => agents[a].globalSkillsDir !== void 0);
-	if (options.global === void 0 && !options.yes && supportsGlobal) {
-		const scope = await ve({
-			message: "Installation scope",
-			options: [{
-				value: false,
-				label: "Project",
-				hint: "Install in current directory (committed with your project)"
-			}, {
-				value: true,
-				label: "Global",
-				hint: "Install in home directory (available across all projects)"
-			}]
-		});
-		if (pD(scope)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installGlobally = scope;
-	}
-	let installMode = options.copy ? "copy" : "symlink";
-	if (!options.copy && !options.yes) {
-		const modeChoice = await ve({
-			message: "Installation method",
-			options: [{
-				value: "symlink",
-				label: "Symlink (Recommended)",
-				hint: "Single source of truth, easy updates"
-			}, {
-				value: "copy",
-				label: "Copy to all agents",
-				hint: "Independent copies for each agent"
-			}]
-		});
-		if (pD(modeChoice)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installMode = modeChoice;
-	}
-	const cwd = process.cwd();
-	const overwriteChecks = await Promise.all(targetAgents.map(async (agent) => ({
-		agent,
-		installed: await isSkillInstalled(remoteSkill.installName, agent, { global: installGlobally })
-	})));
-	const overwriteStatus = new Map(overwriteChecks.map(({ agent, installed }) => [agent, installed]));
-	const summaryLines = [];
-	const shortCanonical = shortenPath$2(getCanonicalPath(remoteSkill.installName, { global: installGlobally }), cwd);
-	summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-	summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
-	const overwriteAgents = targetAgents.filter((a) => overwriteStatus.get(a)).map((a) => agents[a].displayName);
-	if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
-	console.log();
-	Me(summaryLines.join("\n"), "Installation Summary");
-	if (!options.yes) {
-		const confirmed = await ye({ message: "Proceed with installation?" });
-		if (pD(confirmed) || !confirmed) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-	}
-	spinner.start("Installing skill...");
-	const results = [];
-	for (const agent of targetAgents) {
-		const result = await installRemoteSkillForAgent(remoteSkill, agent, {
-			global: installGlobally,
-			mode: installMode
-		});
-		results.push({
-			skill: remoteSkill.installName,
-			agent: agents[agent].displayName,
-			...result
-		});
-	}
-	spinner.stop("Installation complete");
-	console.log();
-	const successful = results.filter((r) => r.success);
-	const failed = results.filter((r) => !r.success);
-	if (await isSourcePrivate(remoteSkill.sourceIdentifier) !== true) track({
-		event: "install",
-		source: remoteSkill.sourceIdentifier,
-		skills: remoteSkill.installName,
-		agents: targetAgents.join(","),
-		...installGlobally && { global: "1" },
-		skillFiles: JSON.stringify({ [remoteSkill.installName]: url }),
-		sourceType: remoteSkill.providerId
-	});
-	if (successful.length > 0 && installGlobally) try {
-		let skillFolderHash = "";
-		if (remoteSkill.providerId === "github") {
-			const hash = await fetchSkillFolderHash(remoteSkill.sourceIdentifier, url);
-			if (hash) skillFolderHash = hash;
-		}
-		await addSkillToLock(remoteSkill.installName, {
-			source: remoteSkill.sourceIdentifier,
-			sourceType: remoteSkill.providerId,
-			sourceUrl: url,
-			skillFolderHash
-		});
-	} catch {}
-	if (successful.length > 0 && !installGlobally) try {
-		const firstResult = successful[0];
-		const computedHash = await computeSkillFolderHash(firstResult.canonicalPath || firstResult.path);
-		await addSkillToLocalLock(remoteSkill.installName, {
-			source: remoteSkill.sourceIdentifier,
-			sourceType: remoteSkill.providerId,
-			computedHash
-		}, cwd);
-	} catch {}
-	if (successful.length > 0) {
-		const resultLines = [];
-		const firstResult = successful[0];
-		if (firstResult.mode === "copy") {
-			resultLines.push(`${import_picocolors.default.green("✓")} ${remoteSkill.installName} ${import_picocolors.default.dim("(copied)")}`);
-			for (const r of successful) {
-				const shortPath = shortenPath$2(r.path, cwd);
-				resultLines.push(`  ${import_picocolors.default.dim("→")} ${shortPath}`);
-			}
-		} else {
-			if (firstResult.canonicalPath) {
-				const shortPath = shortenPath$2(firstResult.canonicalPath, cwd);
-				resultLines.push(`${import_picocolors.default.green("✓")} ${shortPath}`);
-			} else resultLines.push(`${import_picocolors.default.green("✓")} ${remoteSkill.installName}`);
-			resultLines.push(...buildResultLines(successful, targetAgents));
-		}
-		const title = import_picocolors.default.green("Installed 1 skill");
-		Me(resultLines.join("\n"), title);
-		const symlinkFailures = successful.filter((r) => r.mode === "symlink" && r.symlinkFailed);
-		if (symlinkFailures.length > 0) {
-			const copiedAgentNames = symlinkFailures.map((r) => r.agent);
-			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgentNames)}`));
-			M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
-		}
-	}
-	if (failed.length > 0) {
-		console.log();
-		M.error(import_picocolors.default.red(`Failed to install ${failed.length}`));
-		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.skill} → ${r.agent}: ${import_picocolors.default.dim(r.error)}`);
-	}
-	console.log();
-	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
-	await promptForFindSkills(options, targetAgents);
-}
 async function handleWellKnownSkills(source, url, options, spinner) {
 	spinner.start("Discovering skills from well-known endpoint...");
 	const skills = await wellKnownProvider.fetchAllSkills(url);
@@ -2639,188 +2219,6 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
 	await promptForFindSkills(options, targetAgents);
 }
-async function handleDirectUrlSkillLegacy(source, url, options, spinner) {
-	spinner.start("Fetching skill.md...");
-	const mintlifySkill = await fetchMintlifySkill(url);
-	if (!mintlifySkill) {
-		spinner.stop(import_picocolors.default.red("Invalid skill"));
-		Se(import_picocolors.default.red("Could not fetch skill.md or missing required frontmatter (name, description, mintlify-proj)."));
-		process.exit(1);
-	}
-	const remoteSkill = {
-		name: mintlifySkill.name,
-		description: mintlifySkill.description,
-		content: mintlifySkill.content,
-		installName: mintlifySkill.mintlifySite,
-		sourceUrl: mintlifySkill.sourceUrl,
-		providerId: "mintlify",
-		sourceIdentifier: "mintlify/com"
-	};
-	spinner.stop(`Found skill: ${import_picocolors.default.cyan(remoteSkill.installName)}`);
-	M.info(`Skill: ${import_picocolors.default.cyan(remoteSkill.name)}`);
-	M.message(import_picocolors.default.dim(remoteSkill.description));
-	if (options.list) {
-		console.log();
-		M.step(import_picocolors.default.bold("Skill Details"));
-		M.message(`  ${import_picocolors.default.cyan("Name:")} ${remoteSkill.name}`);
-		M.message(`  ${import_picocolors.default.cyan("Site:")} ${remoteSkill.installName}`);
-		M.message(`  ${import_picocolors.default.cyan("Description:")} ${remoteSkill.description}`);
-		console.log();
-		Se("Run without --list to install");
-		process.exit(0);
-	}
-	let targetAgents;
-	const validAgents = Object.keys(agents);
-	if (options.agent?.includes("*")) {
-		targetAgents = validAgents;
-		M.info(`Installing to all ${targetAgents.length} agents`);
-	} else if (options.agent && options.agent.length > 0) {
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
-		if (invalidAgents.length > 0) {
-			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
-			M.info(`Valid agents: ${validAgents.join(", ")}`);
-			process.exit(1);
-		}
-		targetAgents = options.agent;
-	} else {
-		spinner.start("Loading agents...");
-		const installedAgents = await detectInstalledAgents();
-		const totalAgents = Object.keys(agents).length;
-		spinner.stop(`${totalAgents} agents`);
-		if (installedAgents.length === 0) if (options.yes) {
-			targetAgents = validAgents;
-			M.info("Installing to all agents");
-		} else {
-			M.info("Select agents to install skills to");
-			const selected = await promptForAgents("Which agents do you want to install to?", Object.entries(agents).map(([key, config]) => ({
-				value: key,
-				label: config.displayName
-			})));
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-		else if (installedAgents.length === 1 || options.yes) {
-			targetAgents = ensureUniversalAgents(installedAgents);
-			if (installedAgents.length === 1) {
-				const firstAgent = installedAgents[0];
-				M.info(`Installing to: ${import_picocolors.default.cyan(agents[firstAgent].displayName)}`);
-			} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
-		} else {
-			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-	}
-	let installGlobally = options.global ?? false;
-	const supportsGlobal = targetAgents.some((a) => agents[a].globalSkillsDir !== void 0);
-	if (options.global === void 0 && !options.yes && supportsGlobal) {
-		const scope = await ve({
-			message: "Installation scope",
-			options: [{
-				value: false,
-				label: "Project",
-				hint: "Install in current directory (committed with your project)"
-			}, {
-				value: true,
-				label: "Global",
-				hint: "Install in home directory (available across all projects)"
-			}]
-		});
-		if (pD(scope)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installGlobally = scope;
-	}
-	const installMode = "symlink";
-	const cwd = process.cwd();
-	const overwriteChecks = await Promise.all(targetAgents.map(async (agent) => ({
-		agent,
-		installed: await isSkillInstalled(remoteSkill.installName, agent, { global: installGlobally })
-	})));
-	const overwriteStatus = new Map(overwriteChecks.map(({ agent, installed }) => [agent, installed]));
-	const summaryLines = [];
-	targetAgents.map((a) => agents[a].displayName);
-	const shortCanonical = shortenPath$2(getCanonicalPath(remoteSkill.installName, { global: installGlobally }), cwd);
-	summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-	summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
-	const overwriteAgents = targetAgents.filter((a) => overwriteStatus.get(a)).map((a) => agents[a].displayName);
-	if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
-	console.log();
-	Me(summaryLines.join("\n"), "Installation Summary");
-	if (!options.yes) {
-		const confirmed = await ye({ message: "Proceed with installation?" });
-		if (pD(confirmed) || !confirmed) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-	}
-	spinner.start("Installing skill...");
-	const results = [];
-	for (const agent of targetAgents) {
-		const result = await installRemoteSkillForAgent(remoteSkill, agent, {
-			global: installGlobally,
-			mode: installMode
-		});
-		results.push({
-			skill: remoteSkill.installName,
-			agent: agents[agent].displayName,
-			...result
-		});
-	}
-	spinner.stop("Installation complete");
-	console.log();
-	const successful = results.filter((r) => r.success);
-	const failed = results.filter((r) => !r.success);
-	track({
-		event: "install",
-		source: "mintlify/com",
-		skills: remoteSkill.installName,
-		agents: targetAgents.join(","),
-		...installGlobally && { global: "1" },
-		skillFiles: JSON.stringify({ [remoteSkill.installName]: url }),
-		sourceType: "mintlify"
-	});
-	if (successful.length > 0 && installGlobally) try {
-		await addSkillToLock(remoteSkill.installName, {
-			source: `mintlify/${remoteSkill.installName}`,
-			sourceType: "mintlify",
-			sourceUrl: url,
-			skillFolderHash: ""
-		});
-	} catch {}
-	if (successful.length > 0) {
-		const resultLines = [];
-		const firstResult = successful[0];
-		if (firstResult.canonicalPath) {
-			const shortPath = shortenPath$2(firstResult.canonicalPath, cwd);
-			resultLines.push(`${import_picocolors.default.green("✓")} ${shortPath}`);
-		} else resultLines.push(`${import_picocolors.default.green("✓")} ${remoteSkill.installName}`);
-		resultLines.push(...buildResultLines(successful, targetAgents));
-		const title = import_picocolors.default.green("Installed 1 skill");
-		Me(resultLines.join("\n"), title);
-		const symlinkFailures = successful.filter((r) => r.mode === "symlink" && r.symlinkFailed);
-		if (symlinkFailures.length > 0) {
-			const copiedAgentNames = symlinkFailures.map((r) => r.agent);
-			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgentNames)}`));
-			M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
-		}
-	}
-	if (failed.length > 0) {
-		console.log();
-		M.error(import_picocolors.default.red(`Failed to install ${failed.length}`));
-		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.skill} → ${r.agent}: ${import_picocolors.default.dim(r.error)}`);
-	}
-	console.log();
-	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
-	await promptForFindSkills(options, targetAgents);
-}
 async function runAdd(args, options = {}) {
 	const source = args[0];
 	let installTipShown = false;
@@ -2855,10 +2253,6 @@ async function runAdd(args, options = {}) {
 		spinner.start("Parsing source...");
 		const parsed = parseSource(source);
 		spinner.stop(`Source: ${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
-		if (parsed.type === "direct-url") {
-			await handleRemoteSkill(source, parsed.url, options, spinner);
-			return;
-		}
 		if (parsed.type === "well-known") {
 			await handleWellKnownSkills(source, parsed.url, options, spinner);
 			return;
@@ -3208,7 +2602,7 @@ async function runAdd(args, options = {}) {
 					let skillFolderHash = "";
 					const skillPathValue = skillFiles[skill.name];
 					if (parsed.type === "github" && skillPathValue) {
-						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue);
+						const hash = await fetchSkillFolderHash(normalizedSource, skillPathValue, getGitHubToken());
 						if (hash) skillFolderHash = hash;
 					}
 					await addSkillToLock(skill.name, {
@@ -4473,6 +3867,22 @@ function readSkillLock() {
 		};
 	}
 }
+function getSkipReason(entry) {
+	if (entry.sourceType === "local") return "Local path";
+	if (entry.sourceType === "git") return "Git URL (hash tracking not supported)";
+	if (!entry.skillFolderHash) return "No version hash available";
+	if (!entry.skillPath) return "No skill path recorded";
+	return "No version tracking";
+}
+function printSkippedSkills(skipped) {
+	if (skipped.length === 0) return;
+	console.log();
+	console.log(`${DIM}${skipped.length} skill(s) cannot be checked automatically:${RESET}`);
+	for (const skill of skipped) {
+		console.log(`  ${TEXT}•${RESET} ${skill.name} ${DIM}(${skill.reason})${RESET}`);
+		console.log(`    ${DIM}To update: ${TEXT}npx skills add ${skill.sourceUrl} -g -y${RESET}`);
+	}
+}
 async function runCheck(args = []) {
 	console.log(`${TEXT}Checking for skill updates...${RESET}`);
 	console.log();
@@ -4485,12 +3895,16 @@ async function runCheck(args = []) {
 	}
 	const token = getGitHubToken();
 	const skillsBySource = /* @__PURE__ */ new Map();
-	let skippedCount = 0;
+	const skipped = [];
 	for (const skillName of skillNames) {
 		const entry = lock.skills[skillName];
 		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) {
-			skippedCount++;
+		if (!entry.skillFolderHash || !entry.skillPath) {
+			skipped.push({
+				name: skillName,
+				reason: getSkipReason(entry),
+				sourceUrl: entry.sourceUrl
+			});
 			continue;
 		}
 		const existing = skillsBySource.get(entry.source) || [];
@@ -4500,9 +3914,10 @@ async function runCheck(args = []) {
 		});
 		skillsBySource.set(entry.source, existing);
 	}
-	const totalSkills = skillNames.length - skippedCount;
+	const totalSkills = skillNames.length - skipped.length;
 	if (totalSkills === 0) {
 		console.log(`${DIM}No GitHub skills to check.${RESET}`);
+		printSkippedSkills(skipped);
 		return;
 	}
 	console.log(`${DIM}Checking ${totalSkills} skill(s) for updates...${RESET}`);
@@ -4545,6 +3960,7 @@ async function runCheck(args = []) {
 		console.log();
 		console.log(`${DIM}Could not check ${errors.length} skill(s) (may need reinstall)${RESET}`);
 	}
+	printSkippedSkills(skipped);
 	track({
 		event: "check",
 		skillCount: String(totalSkills),
@@ -4564,12 +3980,18 @@ async function runUpdate() {
 	}
 	const token = getGitHubToken();
 	const updates = [];
-	let checkedCount = 0;
+	const skipped = [];
 	for (const skillName of skillNames) {
 		const entry = lock.skills[skillName];
 		if (!entry) continue;
-		if (entry.sourceType !== "github" || !entry.skillFolderHash || !entry.skillPath) continue;
-		checkedCount++;
+		if (!entry.skillFolderHash || !entry.skillPath) {
+			skipped.push({
+				name: skillName,
+				reason: getSkipReason(entry),
+				sourceUrl: entry.sourceUrl
+			});
+			continue;
+		}
 		try {
 			const latestHash = await fetchSkillFolderHash(entry.source, entry.skillPath, token);
 			if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
@@ -4579,8 +4001,9 @@ async function runUpdate() {
 			});
 		} catch {}
 	}
-	if (checkedCount === 0) {
+	if (skillNames.length - skipped.length === 0) {
 		console.log(`${DIM}No skills to check.${RESET}`);
+		printSkippedSkills(skipped);
 		return;
 	}
 	if (updates.length === 0) {
@@ -4610,11 +4033,14 @@ async function runUpdate() {
 			installUrl,
 			"-g",
 			"-y"
-		], { stdio: [
-			"inherit",
-			"pipe",
-			"pipe"
-		] }).status === 0) {
+		], {
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			shell: process.platform === "win32"
+		}).status === 0) {
 			successCount++;
 			console.log(`  ${TEXT}✓${RESET} Updated ${update.name}`);
 		} else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {