skills 1.5.21 → 1.5.23

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { __toESM } from "./_chunks/rolldown-runtime.mjs";
 import { isCancel } from "./_chunks/libs/@clack/core.mjs";
-import { cancel, confirm, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
+import { cancel, confirm, intro, log, multiselect, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
 import { require_picocolors } from "./_chunks/libs/picocolors.mjs";
 import { esm_default } from "./_chunks/libs/simple-git.mjs";
 import { xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
@@ -16,7 +16,7 @@ import { homedir, platform, tmpdir } from "os";
 import * as readline from "readline";
 import { Writable } from "stream";
 import { promisify } from "util";
-import { execFile, execSync, spawn, spawnSync } from "child_process";
+import { execFile, spawn, spawnSync } from "child_process";
 import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
 import { parse } from "yaml";
 import { createHash } from "crypto";
@@ -26,6 +26,7 @@ import { crc32, gunzipSync, inflateRawSync } from "node:zlib";
 import { tmpdir as tmpdir$1 } from "node:os";
 import { pipeline } from "node:stream/promises";
 import * as tar from "tar";
+import { execFile as execFile$1 } from "node:child_process";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const DEFAULT_GITHUB_HOST = "github.com";
 function getGitHubHost() {
@@ -416,8 +417,19 @@ function toggleSearchEntry(selected, entry) {
 	} else if (entry?.type === "item") if (selected.has(entry.item.value)) selected.delete(entry.item.value);
 	else selected.add(entry.item.value);
 }
+function getSelectAllState(selected, items) {
+	const selectedCount = items.filter((item) => selected.has(item.value)).length;
+	if (selectedCount === 0) return "none";
+	if (selectedCount === items.length) return "all";
+	return "partial";
+}
+function toggleAllItems(selected, items) {
+	const shouldClear = getSelectAllState(selected, items) === "all";
+	for (const item of items) if (shouldClear) selected.delete(item.value);
+	else selected.add(item.value);
+}
 async function searchMultiselect(options) {
-	const { message, items, maxVisible = 8, initialSelected = [], required = false, lockedSection, searchable = true, showDetail = false, detailLines = 2, showSelectedSummary = true, selectGroups = false } = options;
+	const { message, items, maxVisible = 8, initialSelected = [], required = false, lockedSection, searchable = true, showDetail = false, detailLines = 2, showSelectedSummary = true, selectGroups = false, selectAll = false } = options;
 	return new Promise((resolve) => {
 		const rl = readline.createInterface({
 			input: process.stdin,
@@ -444,6 +456,8 @@ async function searchMultiselect(options) {
 			const lines = [];
 			const filtered = getFiltered();
 			const entries = buildSearchEntries(filtered, selectGroups, collapsedGroups);
+			const hasSelectAll = selectAll && items.length > 0;
+			const entryCursor = cursor - (hasSelectAll ? 1 : 0);
 			const icon = state === "active" ? S_STEP_ACTIVE : state === "cancel" ? S_STEP_CANCEL : S_STEP_SUBMIT;
 			lines.push(`${icon}  ${import_picocolors.default.bold(message)}`);
 			if (state === "active") {
@@ -462,21 +476,59 @@ async function searchMultiselect(options) {
 					lines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, space select, enter confirm")}`);
 					lines.push(`${S_BAR}`);
 				}
-				const visibleStart = Math.max(0, Math.min(cursor - Math.floor(maxVisible / 2), entries.length - maxVisible));
-				const visibleEnd = Math.min(entries.length, visibleStart + maxVisible);
-				const visibleEntries = entries.slice(visibleStart, visibleEnd);
-				if (filtered.length === 0) lines.push(`${S_BAR}  ${import_picocolors.default.dim("No matches found")}`);
-				else {
+				if (hasSelectAll) {
+					const selectedCount = items.filter((item) => selected.has(item.value)).length;
+					const selectAllState = getSelectAllState(selected, items);
+					const radio = selectAllState === "all" ? S_RADIO_ACTIVE : selectAllState === "partial" ? import_picocolors.default.yellow("◐") : S_RADIO_INACTIVE;
+					const isCursor = cursor === 0;
+					const prefix = isCursor ? import_picocolors.default.cyan("❯") : " ";
+					const label = isCursor ? import_picocolors.default.underline(import_picocolors.default.bold("Select All")) : import_picocolors.default.bold("Select All");
+					lines.push(`${S_BAR} ${prefix} ${radio} ${label} ${import_picocolors.default.dim(`(${selectedCount}/${items.length})`)}`);
+					lines.push(`${S_BAR}   ${S_BAR_H.repeat(36)}`);
+				}
+				const columns = process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
+				const buildFooterLines = (includeDetail, includeSelectedSummary) => {
+					const footerLines = [];
+					if (includeDetail) {
+						const entry = entries[entryCursor];
+						const detail = hasSelectAll && cursor === 0 ? `Select or clear all ${items.length} skills.` : entry?.type === "group" ? `Select all ${entry.items.length} skills in ${entry.group}.` : entry?.item.detail;
+						const detailWidth = Math.max(1, columns - 5);
+						footerLines.push(`${S_BAR}`);
+						footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("Description")}`);
+						for (const line of formatDetailLines(detail, detailWidth, detailLines)) footerLines.push(`${S_BAR}  ${import_picocolors.default.dim(line)}`);
+					}
+					if (includeSelectedSummary) {
+						footerLines.push(`${S_BAR}`);
+						const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
+						if (allSelectedLabels.length === 0) footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("Selected: (none)")}`);
+						else {
+							const summary = allSelectedLabels.length <= 3 ? allSelectedLabels.join(", ") : `${allSelectedLabels.slice(0, 3).join(", ")} +${allSelectedLabels.length - 3} more`;
+							footerLines.push(`${S_BAR}  ${import_picocolors.default.green("Selected:")} ${summary}`);
+						}
+					}
+					if (!searchable) {
+						footerLines.push(`${S_BAR}`);
+						footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, ←→ collapse/expand, space select, enter confirm")}`);
+					}
+					footerLines.push(`${import_picocolors.default.dim("└")}`);
+					return footerLines;
+				};
+				const buildItemLines = (visibleLimit) => {
+					if (filtered.length === 0) return [`${S_BAR}  ${import_picocolors.default.dim("No matches found")}`];
+					const itemLines = [];
+					const visibleStart = Math.max(0, Math.min(entryCursor - Math.floor(visibleLimit / 2), entries.length - visibleLimit));
+					const visibleEnd = Math.min(entries.length, visibleStart + visibleLimit);
+					const visibleEntries = entries.slice(visibleStart, visibleEnd);
 					for (let i = 0; i < visibleEntries.length; i++) {
 						const entry = visibleEntries[i];
-						const isCursor = visibleStart + i === cursor;
+						const isCursor = visibleStart + i === entryCursor;
 						if (entry.type === "group") {
 							const selectedCount = entry.items.filter((item) => selected.has(item.value)).length;
 							const radio = selectedCount === entry.items.length ? S_RADIO_ACTIVE : selectedCount > 0 ? import_picocolors.default.yellow("◐") : S_RADIO_INACTIVE;
 							const label = isCursor ? import_picocolors.default.underline(import_picocolors.default.bold(entry.group)) : import_picocolors.default.bold(entry.group);
 							const prefix = isCursor ? import_picocolors.default.cyan("❯") : " ";
 							const disclosure = import_picocolors.default.dim(entry.collapsed ? "▸" : "▾");
-							lines.push(`${S_BAR} ${prefix} ${disclosure} ${radio} ${label}`);
+							itemLines.push(`${S_BAR} ${prefix} ${disclosure} ${radio} ${label}`);
 							continue;
 						}
 						const item = entry.item;
@@ -487,7 +539,7 @@ async function searchMultiselect(options) {
 						const groupItems = selectGroups && item.group ? filtered.filter((i) => i.group === item.group) : [];
 						const isLastInGroup = groupItems.at(-1) === item;
 						const tree = groupItems.length > 0 ? `${import_picocolors.default.dim(isLastInGroup ? "└─" : "├─")} ` : "";
-						lines.push(`${S_BAR} ${prefix} ${tree}${radio} ${label}${hint}`);
+						itemLines.push(`${S_BAR} ${prefix} ${tree}${radio} ${label}${hint}`);
 					}
 					const hiddenBefore = visibleStart;
 					const hiddenAfter = entries.length - visibleEnd;
@@ -495,32 +547,48 @@ async function searchMultiselect(options) {
 						const parts = [];
 						if (hiddenBefore > 0) parts.push(`↑ ${hiddenBefore} more`);
 						if (hiddenAfter > 0) parts.push(`↓ ${hiddenAfter} more`);
-						lines.push(`${S_BAR}  ${import_picocolors.default.dim(parts.join("  "))}`);
+						itemLines.push(`${S_BAR}  ${import_picocolors.default.dim(parts.join("  "))}`);
 					}
-				}
-				if (showDetail) {
-					const entry = entries[cursor];
-					const detail = entry?.type === "group" ? `Select all ${entry.items.length} skills in ${entry.group}.` : entry?.item.detail;
-					const columns = process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
-					const detailWidth = Math.max(1, columns - 5);
-					lines.push(`${S_BAR}`);
-					lines.push(`${S_BAR}  ${import_picocolors.default.dim("Description")}`);
-					for (const line of formatDetailLines(detail, detailWidth, detailLines)) lines.push(`${S_BAR}  ${import_picocolors.default.dim(line)}`);
-				}
-				if (showSelectedSummary) {
-					lines.push(`${S_BAR}`);
-					const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
-					if (allSelectedLabels.length === 0) lines.push(`${S_BAR}  ${import_picocolors.default.dim("Selected: (none)")}`);
-					else {
-						const summary = allSelectedLabels.length <= 3 ? allSelectedLabels.join(", ") : `${allSelectedLabels.slice(0, 3).join(", ")} +${allSelectedLabels.length - 3} more`;
-						lines.push(`${S_BAR}  ${import_picocolors.default.green("Selected:")} ${summary}`);
+					return itemLines;
+				};
+				const terminalRows = process.stdout.rows && process.stdout.rows > 0 ? process.stdout.rows : void 0;
+				const maxFrameRows = terminalRows ? Math.max(1, terminalRows - 1) : void 0;
+				const fitFrame = (includeDetail, includeSelectedSummary) => {
+					const footerLines = buildFooterLines(includeDetail, includeSelectedSummary);
+					let visibleLimit = Math.max(1, maxVisible);
+					let itemLines = buildItemLines(visibleLimit);
+					let frameRows = countVisualRowsForLines([
+						...lines,
+						...itemLines,
+						...footerLines
+					], columns);
+					while (maxFrameRows && frameRows > maxFrameRows && visibleLimit > 1) {
+						visibleLimit -= 1;
+						itemLines = buildItemLines(visibleLimit);
+						frameRows = countVisualRowsForLines([
+							...lines,
+							...itemLines,
+							...footerLines
+						], columns);
 					}
+					return {
+						itemLines,
+						footerLines,
+						frameRows
+					};
+				};
+				let includeDetail = showDetail;
+				let includeSelectedSummary = showSelectedSummary;
+				let fitted = fitFrame(includeDetail, includeSelectedSummary);
+				if (maxFrameRows && fitted.frameRows > maxFrameRows && includeDetail) {
+					includeDetail = false;
+					fitted = fitFrame(includeDetail, includeSelectedSummary);
 				}
-				if (!searchable) {
-					lines.push(`${S_BAR}`);
-					lines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, ←→ collapse/expand, space select, enter confirm")}`);
+				if (maxFrameRows && fitted.frameRows > maxFrameRows && includeSelectedSummary) {
+					includeSelectedSummary = false;
+					fitted = fitFrame(includeDetail, includeSelectedSummary);
 				}
-				lines.push(`${import_picocolors.default.dim("└")}`);
+				lines.push(...fitted.itemLines, ...fitted.footerLines);
 			} else if (state === "submit") {
 				const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
 				lines.push(`${S_BAR}  ${import_picocolors.default.dim(allSelectedLabels.join(", "))}`);
@@ -548,6 +616,9 @@ async function searchMultiselect(options) {
 		const keypressHandler = (_str, key) => {
 			if (!key) return;
 			const entries = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups);
+			const hasSelectAll = selectAll && items.length > 0;
+			const cursorOffset = hasSelectAll ? 1 : 0;
+			const entry = entries[cursor - cursorOffset];
 			if (key.name === "return") {
 				submit();
 				return;
@@ -562,12 +633,11 @@ async function searchMultiselect(options) {
 				return;
 			}
 			if (key.name === "down") {
-				cursor = Math.min(entries.length - 1, cursor + 1);
+				cursor = Math.min(entries.length + cursorOffset - 1, cursor + 1);
 				render();
 				return;
 			}
 			if (selectGroups && key.name === "right") {
-				const entry = entries[cursor];
 				if (entry?.type === "group" && entry.collapsed) {
 					collapsedGroups.delete(entry.group);
 					render();
@@ -575,18 +645,17 @@ async function searchMultiselect(options) {
 				return;
 			}
 			if (selectGroups && key.name === "left") {
-				const entry = entries[cursor];
 				const group = entry?.type === "group" ? entry.group : entry?.item.group;
 				if (group) {
 					collapsedGroups.add(group);
-					cursor = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups).findIndex((collapsedEntry) => collapsedEntry.type === "group" && collapsedEntry.group === group);
+					cursor = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups).findIndex((collapsedEntry) => collapsedEntry.type === "group" && collapsedEntry.group === group) + cursorOffset;
 					render();
 				}
 				return;
 			}
 			if (key.name === "space") {
-				const entry = entries[cursor];
-				toggleSearchEntry(selected, entry);
+				if (hasSelectAll && cursor === 0) toggleAllItems(selected, items);
+				else toggleSearchEntry(selected, entry);
 				render();
 				return;
 			}
@@ -811,6 +880,38 @@ async function cloneRepo(url, ref) {
 		throw new GitCloneError(`Failed to clone ${url}: ${errorMessage}`, url, false, false);
 	}
 }
+async function getGitTreeHash(repoDir, skillPath) {
+	const segments = skillPath.replace(/\\/g, "/").split("/");
+	segments.pop();
+	const folderPath = segments.join("/");
+	const revision = folderPath ? `HEAD:${folderPath}` : "HEAD^{tree}";
+	try {
+		const hash = (await new Promise((resolve, reject) => {
+			execFile("git", [
+				"-C",
+				repoDir,
+				"rev-parse",
+				"--verify",
+				"--end-of-options",
+				revision
+			], {
+				encoding: "utf8",
+				timeout: CLONE_TIMEOUT_MS,
+				env: {
+					...process.env,
+					GIT_OPTIONAL_LOCKS: "0",
+					GIT_TERMINAL_PROMPT: "0"
+				}
+			}, (error, output) => {
+				if (error) reject(error);
+				else resolve(output);
+			});
+		})).trim();
+		return /^[0-9a-f]{40}$/i.test(hash) ? hash.toLowerCase() : null;
+	} catch {
+		return null;
+	}
+}
 async function cleanupTempDir(dir) {
 	const normalizedDir = normalize(resolve(dir));
 	const normalizedTmpDir = normalize(resolve(tmpdir()));
@@ -902,27 +1003,45 @@ function getLocalLockPath(cwd) {
 	return join(cwd || process.cwd(), LOCAL_LOCK_FILE);
 }
 async function readLocalLock(cwd) {
-	const lockPath = getLocalLockPath(cwd);
+	const lockDir = cwd || process.cwd();
+	const lockPath = getLocalLockPath(lockDir);
 	try {
 		const content = await readFile(lockPath, "utf-8");
 		const parsed = JSON.parse(content);
 		if (typeof parsed.version !== "number" || !parsed.skills) return createEmptyLocalLock();
 		if (parsed.version < CURRENT_VERSION$1) return createEmptyLocalLock();
+		for (const entry of Object.values(parsed.skills)) if (entry.sourceType === "local" && !isAbsolute(entry.source)) entry.source = resolve(lockDir, entry.source);
 		return parsed;
 	} catch {
 		return createEmptyLocalLock();
 	}
 }
 async function writeLocalLock(lock, cwd) {
-	const lockPath = getLocalLockPath(cwd);
+	const lockDir = cwd || process.cwd();
+	const lockPath = getLocalLockPath(lockDir);
 	const sortedSkills = {};
-	for (const key of Object.keys(lock.skills).sort()) sortedSkills[key] = lock.skills[key];
+	for (const key of Object.keys(lock.skills).sort()) {
+		const entry = lock.skills[key];
+		sortedSkills[key] = entry.sourceType === "local" ? {
+			...entry,
+			source: getPortableLocalSource(entry.source, lockDir)
+		} : entry;
+	}
 	const sorted = {
 		version: lock.version,
 		skills: sortedSkills
 	};
 	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
 }
+function getPortableLocalSource(source, lockDir) {
+	const absoluteSource = isAbsolute(source) ? source : resolve(lockDir, source);
+	const relativeSource = relative(lockDir, absoluteSource);
+	if (isAbsolute(relativeSource)) return absoluteSource.split(sep).join("/");
+	const portableSource = relativeSource.split(sep).join("/");
+	if (!portableSource) return ".";
+	if (portableSource === ".." || portableSource.startsWith("../")) return portableSource;
+	return `./${portableSource}`;
+}
 async function computeSkillFolderHash(skillDir) {
 	const files = [];
 	await collectFiles(skillDir, skillDir, files);
@@ -969,6 +1088,8 @@ function createEmptyLocalLock() {
 		skills: {}
 	};
 }
+const AGENTS_DIR$1 = ".agents";
+const SKILLS_SUBDIR = "skills";
 const SKIP_DIRS = [
 	"node_modules",
 	".git",
@@ -992,11 +1113,13 @@ const AGENT_PROJECT_SKILL_DIRS = [
 	".kilocode/skills",
 	".kimchi/skills",
 	".kiro/skills",
+	".minimax/skills",
 	".mux/skills",
 	".neovate/skills",
 	".opencode/skills",
 	".openhands/skills",
 	".pi/skills",
+	".posit/assistant/skills",
 	".qoder/skills",
 	".roo/skills",
 	".trae/skills",
@@ -1138,25 +1261,18 @@ async function discoverSkills(basePath, subpath, options) {
 		seenNames.add(skill.name);
 		return true;
 	};
-	for (const dir of prioritySearchDirs) {
-		const walkDeep = deepContainerDirs.has(dir);
+	const walkSkillDirs = async (dir, maxDepth, depth = 1) => {
 		try {
 			const entries = await readdir(dir, { withFileTypes: true });
 			for (const entry of entries) {
 				if (!entry.isDirectory()) continue;
 				const childDir = join(dir, entry.name);
-				if (await tryAddSkillAt(childDir) || !walkDeep) continue;
-				if (SKIP_DIRS.includes(entry.name)) continue;
-				try {
-					const grandEntries = await readdir(childDir, { withFileTypes: true });
-					for (const grand of grandEntries) {
-						if (!grand.isDirectory() || SKIP_DIRS.includes(grand.name)) continue;
-						await tryAddSkillAt(join(childDir, grand.name));
-					}
-				} catch {}
+				if (await tryAddSkillAt(childDir) || depth >= maxDepth || SKIP_DIRS.includes(entry.name)) continue;
+				await walkSkillDirs(childDir, maxDepth, depth + 1);
 			}
 		} catch {}
-	}
+	};
+	for (const dir of prioritySearchDirs) await walkSkillDirs(dir, deepContainerDirs.has(dir) ? 3 : 1);
 	if (skills.length === 0 || options?.fullDepth) {
 		const allSkillDirs = await findSkillDirs(searchPath);
 		for (const skillDir of allSkillDirs) {
@@ -1211,6 +1327,12 @@ function isZCodeInstalled(homeDir = home, pathExists = existsSync) {
 function isKimchiInstalled(homeDir = home, pathExists = existsSync) {
 	return pathExists(join(homeDir, ".config", "kimchi"));
 }
+function isMiniMaxCodeInstalled(homeDir = home, pathExists = existsSync) {
+	return pathExists(join(homeDir, ".minimax")) || pathExists("/Applications/MiniMax Code.app");
+}
+function isPositAssistantInstalled(homeDir = home, pathExists = existsSync) {
+	return pathExists(join(homeDir, ".posit/assistant")) || pathExists(join(homeDir, ".positai"));
+}
 const agents = {
 	"aider-desk": {
 		name: "aider-desk",
@@ -1621,6 +1743,15 @@ const agents = {
 			return existsSync(join(home, ".mcpjam"));
 		}
 	},
+	"minimax-code": {
+		name: "minimax-code",
+		displayName: "MiniMax Code",
+		skillsDir: ".minimax/skills",
+		globalSkillsDir: join(home, ".minimax/skills"),
+		detectInstalled: async () => {
+			return isMiniMaxCodeInstalled();
+		}
+	},
 	"mistral-vibe": {
 		name: "mistral-vibe",
 		displayName: "Mistral Vibe",
@@ -1684,6 +1815,15 @@ const agents = {
 			return existsSync(join(home, ".pi/agent"));
 		}
 	},
+	"posit-assistant": {
+		name: "posit-assistant",
+		displayName: "Posit Assistant",
+		skillsDir: ".posit/assistant/skills",
+		globalSkillsDir: join(home, ".posit/assistant/skills"),
+		detectInstalled: async () => {
+			return isPositAssistantInstalled();
+		}
+	},
 	qoder: {
 		name: "qoder",
 		displayName: "Qoder",
@@ -1921,8 +2061,6 @@ function getNonUniversalAgents() {
 function isUniversalAgent(type) {
 	return agents[type].skillsDir === ".agents/skills";
 }
-const AGENTS_DIR$1 = ".agents";
-const SKILLS_SUBDIR = "skills";
 function sanitizeName(name) {
 	return name.toLowerCase().replace(/[^a-z0-9._]+/g, "-").replace(/^[.\-]+|[.\-]+$/g, "").substring(0, 255) || "unnamed-skill";
 }
@@ -2543,6 +2681,7 @@ function setVersion(version) {
 	cliVersion = version;
 }
 async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
+	if (!isEnabled()) return null;
 	if (skillSlugs.length === 0) return null;
 	try {
 		const params = new URLSearchParams({
@@ -2851,6 +2990,16 @@ const DISCOVERY_SCHEMA_V2 = "https://schemas.agentskills.io/discovery/0.2.0/sche
 const MAX_ARCHIVE_UNPACKED_BYTES = 50 * 1024 * 1024;
 const MAX_ARCHIVE_FILES = 1e3;
 const DISCOVERY_TIMEOUT_MS = 1e4;
+var WellKnownScopeNotFoundError = class extends Error {
+	scopePath;
+	rootUrl;
+	constructor(scopePath, rootUrl) {
+		super(`No skills found for the scoped path '${scopePath}' on ${rootUrl}. Not falling back to the root skills index because that would install every skill the host publishes. Check the URL, or run 'skills add ${rootUrl}' to install from the root index.`);
+		this.name = "WellKnownScopeNotFoundError";
+		this.scopePath = scopePath;
+		this.rootUrl = rootUrl;
+	}
+};
 var WellKnownProvider = class {
 	id = "well-known";
 	displayName = "Well-Known Skills";
@@ -2873,10 +3022,10 @@ var WellKnownProvider = class {
 			return { matches: false };
 		}
 	}
-	async fetchIndex(baseUrl) {
-		return (await this.fetchIndexCandidates(baseUrl))[0] ?? null;
+	async fetchIndex(baseUrl, options) {
+		return (await this.fetchIndexCandidates(baseUrl, options))[0] ?? null;
 	}
-	async fetchIndexCandidates(baseUrl) {
+	async fetchIndexCandidates(baseUrl, options) {
 		try {
 			const parsed = new URL(baseUrl);
 			const basePath = parsed.pathname.replace(/\/$/, "");
@@ -2896,7 +3045,10 @@ var WellKnownProvider = class {
 			}
 			const candidates = [];
 			for (const { indexUrl, baseUrl: resolvedBase, wellKnownPath } of urlsToTry) try {
-				const response = await fetch(indexUrl, { signal });
+				const response = await fetch(indexUrl, {
+					signal,
+					...options?.updateCheck ? { headers: { "X-Skills-Update-Check": "1" } } : {}
+				});
 				if (!response.ok) continue;
 				const rawIndex = await response.json();
 				const normalized = this.normalizeIndex(rawIndex, indexUrl, wellKnownPath);
@@ -3146,16 +3298,34 @@ var WellKnownProvider = class {
 			indexEntry: input.indexEntry
 		};
 	}
-	async fetchAllSkills(url) {
+	getScope(url) {
+		try {
+			const parsed = new URL(url);
+			const scopePath = parsed.pathname.replace(/\/$/, "");
+			if (!scopePath) return null;
+			return {
+				scopePath,
+				rootBaseUrl: `${parsed.protocol}//${parsed.host}`
+			};
+		} catch {
+			return null;
+		}
+	}
+	async fetchAllSkills(url, options = {}) {
 		try {
 			const candidates = await this.fetchIndexCandidates(url);
-			for (const result of candidates) {
+			const scope = this.getScope(url);
+			const scopedCandidates = scope ? candidates.filter((c) => c.resolvedBaseUrl !== scope.rootBaseUrl) : candidates;
+			const includeInternal = options.includeInternal || shouldInstallInternalSkills();
+			for (const result of scopedCandidates) {
 				const skillPromises = result.entries.map((entry) => this.fetchSkillByEntry(entry));
-				const skills = (await Promise.all(skillPromises)).filter((s) => s !== null);
+				const skills = (await Promise.all(skillPromises)).filter((s) => s !== null).filter((skill) => includeInternal || skill.metadata?.internal !== true);
 				if (skills.length > 0) return skills;
 			}
+			if (scope && scopedCandidates.length < candidates.length) throw new WellKnownScopeNotFoundError(scope.scopePath, scope.rootBaseUrl);
 			return [];
-		} catch {
+		} catch (error) {
+			if (error instanceof WellKnownScopeNotFoundError) throw error;
 			return [];
 		}
 	}
@@ -3253,6 +3423,17 @@ var WellKnownProvider = class {
 		return await this.fetchIndex(url) !== null;
 	}
 };
+function computeWellKnownSkillDigest(skill) {
+	if ("digest" in skill.indexEntry && skill.indexEntry.digest) return skill.indexEntry.digest;
+	const hash = createHash$1("sha256");
+	for (const path of Array.from(skill.files.keys()).sort()) {
+		hash.update(path);
+		hash.update("\0");
+		hash.update(skill.files.get(path));
+		hash.update("\0");
+	}
+	return `sha256:${hash.digest("hex")}`;
+}
 const wellKnownProvider = new WellKnownProvider();
 const DEFAULT_DOWNLOAD_MAX_BYTES = 10 * 1024 * 1024;
 const DEFAULT_EXTRACT_MAX_BYTES = 25 * 1024 * 1024;
@@ -3460,25 +3641,9 @@ async function writeSkillLock(lock) {
 	await mkdir(dirname(lockPath), { recursive: true });
 	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
-let _ghWarningShown = false;
 function getGitHubToken() {
 	if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
 	if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
-	if (!_ghWarningShown) {
-		process.stderr.write(`${import_picocolors.default.dim("│  GitHub API request limit reached; checking existing ")}${import_picocolors.default.cyan("gh")}${import_picocolors.default.dim(" authentication…\n")}`);
-		_ghWarningShown = true;
-	}
-	try {
-		const token = execSync("gh auth token", {
-			encoding: "utf-8",
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		}).trim();
-		if (token) return token;
-	} catch {}
 	return null;
 }
 async function addSkillToLock(skillName, entry) {
@@ -3532,13 +3697,15 @@ async function saveSelectedAgents(agents) {
 const DOWNLOAD_BASE_URL = process.env.SKILLS_DOWNLOAD_URL || "https://skills.sh";
 const BLOB_ALLOWED_REPOS = { "zapier/connectors": { downloadUrl: (slug) => `https://connectors-skills.zapier.com/download/${encodeURIComponent(slug)}/snapshot.json` } };
 const FETCH_TIMEOUT = 1e4;
+const GH_API_MAX_BUFFER = 16 * 1024 * 1024;
 function toSkillSlug(name) {
 	return name.toLowerCase().replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 let _rateLimitedThisSession = false;
 async function fetchTreeBranch(ownerRepo, branch, token) {
 	try {
-		const url = `https://api.github.com/repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+		const githubHost = getGitHubHost();
+		const url = `${githubHost === "github.com" ? "https://api.github.com" : `https://${githubHost}/api/v3`}/repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
 		const headers = {
 			Accept: "application/vnd.github.v3+json",
 			"User-Agent": "skills-cli"
@@ -3582,13 +3749,55 @@ async function fetchTreeWithToken(ownerRepo, branches, getToken) {
 	}
 	return null;
 }
+async function fetchTreeWithGitHubCli(ownerRepo, branches) {
+	for (const branch of branches) try {
+		const endpoint = `repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+		const stdout = await new Promise((resolve, reject) => {
+			execFile$1("gh", [
+				"api",
+				endpoint,
+				"--method",
+				"GET",
+				"--hostname",
+				getGitHubHost()
+			], {
+				encoding: "utf8",
+				timeout: FETCH_TIMEOUT,
+				maxBuffer: GH_API_MAX_BUFFER,
+				windowsHide: true,
+				env: {
+					...process.env,
+					GH_PROMPT_DISABLED: "1"
+				}
+			}, (error, output) => {
+				if (error) reject(error);
+				else resolve(output);
+			});
+		});
+		const data = JSON.parse(stdout);
+		if (typeof data.sha !== "string" || !Array.isArray(data.tree)) continue;
+		return {
+			sha: data.sha,
+			branch,
+			tree: data.tree
+		};
+	} catch {}
+	return null;
+}
+async function fetchTreeWithAvailableAuth(ownerRepo, branches, getToken) {
+	if (getToken) {
+		const tree = await fetchTreeWithToken(ownerRepo, branches, getToken);
+		if (tree) return tree;
+	}
+	return fetchTreeWithGitHubCli(ownerRepo, branches);
+}
 async function fetchRepoTree(ownerRepo, ref, getToken) {
 	const branches = ref ? [ref] : [
 		"HEAD",
 		"main",
 		"master"
 	];
-	if (_rateLimitedThisSession && getToken) return fetchTreeWithToken(ownerRepo, branches, getToken);
+	if (_rateLimitedThisSession) return fetchTreeWithAvailableAuth(ownerRepo, branches, getToken);
 	let rateLimited = false;
 	let authRetryable = false;
 	for (const branch of branches) {
@@ -3603,9 +3812,9 @@ async function fetchRepoTree(ownerRepo, ref, getToken) {
 			break;
 		}
 	}
-	if (!getToken || !(rateLimited || authRetryable)) return null;
+	if (!(rateLimited || authRetryable)) return null;
 	if (rateLimited) _rateLimitedThisSession = true;
-	return fetchTreeWithToken(ownerRepo, branches, getToken);
+	return fetchTreeWithAvailableAuth(ownerRepo, branches, getToken);
 }
 function getSkillFolderHashFromTree(tree, skillPath) {
 	let folderPath = skillPath.replace(/\\/g, "/");
@@ -3636,11 +3845,13 @@ const PRIORITY_PREFIXES = [
 	".kilocode/skills/",
 	".kimchi/skills/",
 	".kiro/skills/",
+	".minimax/skills/",
 	".mux/skills/",
 	".neovate/skills/",
 	".opencode/skills/",
 	".openhands/skills/",
 	".pi/skills/",
+	".posit/assistant/skills/",
 	".qoder/skills/",
 	".roo/skills/",
 	".trae/skills/",
@@ -3684,9 +3895,13 @@ function findSkillMdPaths(tree, subpath) {
 				}
 				continue;
 			}
-			if (isContainer && parts.length === 3 && parts[2].toLowerCase() === "skill.md" && !SKIP_DIRS.has(parts[0]) && !SKIP_DIRS.has(parts[1])) {
-				const parentSkillMd = `${fullPrefix}${parts[0]}/SKILL.md`.toLowerCase();
-				if (!lowerSkillMdSet.has(parentSkillMd) && !seen.has(skillMd)) {
+			const skillDirs = parts.slice(0, -1);
+			const hasAncestorSkill = skillDirs.slice(0, -1).some((_, index) => {
+				const ancestorPath = skillDirs.slice(0, index + 1).join("/");
+				return lowerSkillMdSet.has(`${fullPrefix}${ancestorPath}/SKILL.md`.toLowerCase());
+			});
+			if (isContainer && parts.length >= 3 && parts.length <= 4 && parts.at(-1).toLowerCase() === "skill.md" && skillDirs.every((part) => !SKIP_DIRS.has(part)) && !hasAncestorSkill) {
+				if (!seen.has(skillMd)) {
 					priorityResults.push(skillMd);
 					seen.add(skillMd);
 				}
@@ -3729,6 +3944,7 @@ function computeSnapshotHash(files) {
 	return hash.digest("hex");
 }
 async function tryBlobInstall(ownerRepo, options = {}) {
+	if (options.ref !== void 0) return null;
 	const tree = await fetchRepoTree(ownerRepo, options.ref, options.getToken);
 	if (!tree) return null;
 	let skillMdPaths = findSkillMdPaths(tree, options.subpath);
@@ -3801,7 +4017,7 @@ async function tryBlobInstall(ownerRepo, options = {}) {
 		tree
 	};
 }
-var version$1 = "1.5.21";
+var version$1 = "1.5.23";
 const isCancelled$1 = (value) => typeof value === "symbol";
 const EVE_AGENT_LABEL = "eve agent";
 async function isSourcePrivate(source) {
@@ -3954,13 +4170,6 @@ function buildResultLines(results, targetAgents) {
 	if (failedSymlinks.length > 0) lines.push(`  ${import_picocolors.default.yellow("copied:")} ${formatList$1(failedSymlinks)}`);
 	return lines;
 }
-function multiselect(opts) {
-	return multiselect$1({
-		...opts,
-		options: opts.options,
-		message: `${opts.message} ${import_picocolors.default.dim("(space to toggle)")}`
-	});
-}
 async function promptForAgents(message, choices) {
 	let lastSelected;
 	try {
@@ -4020,9 +4229,26 @@ async function selectAgentsInteractive(options) {
 	return selected;
 }
 setVersion(version$1);
+function isSkillsShPackUrl(url) {
+	try {
+		const parsed = new URL(url);
+		return parsed.hostname.replace(/^www\./, "") === "skills.sh" && /^\/p\/[^/]+/.test(parsed.pathname);
+	} catch {
+		return false;
+	}
+}
 async function handleWellKnownSkills(source, url, options, spinner) {
 	spinner.start("Discovering skills from well-known endpoint...");
-	const skills = await wellKnownProvider.fetchAllSkills(url).catch(() => []);
+	let skills = [];
+	try {
+		skills = await wellKnownProvider.fetchAllSkills(url, { includeInternal: Boolean(options.skill && options.skill.length > 0 && !options.skill.includes("*")) });
+	} catch (error) {
+		if (error instanceof WellKnownScopeNotFoundError) {
+			spinner.stop(import_picocolors.default.red("No matching skills"));
+			log.error(error.message);
+			process.exit(1);
+		}
+	}
 	if (skills.length === 0) {
 		spinner.stop(import_picocolors.default.dim("No well-known skills found; trying direct download..."));
 		return false;
@@ -4065,16 +4291,19 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		selectedSkills = skills;
 		log.info(`Installing all ${skills.length} skills`);
 	} else {
-		const selected = await multiselect({
+		const selected = await searchMultiselect({
 			message: "Select skills to install",
-			options: skills.map((s) => ({
+			items: skills.map((s) => ({
 				value: s,
 				label: s.installName,
 				hint: s.description.length > 60 ? s.description.slice(0, 57) + "…" : s.description
 			})),
-			required: true
+			initialSelected: isSkillsShPackUrl(url) ? skills : void 0,
+			required: true,
+			maxVisible: 20,
+			selectAll: true
 		});
-		if (isCancel(selected)) {
+		if (isCancelled$1(selected)) {
 			cancel("Installation cancelled");
 			process.exit(0);
 		}
@@ -4241,7 +4470,9 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 				source: sourceIdentifier,
 				sourceType: "well-known",
 				sourceUrl: skill.sourceUrl,
-				skillFolderHash: ""
+				skillFolderHash: "",
+				sourceBaseUrl: url,
+				wellKnownDigest: computeWellKnownSkillDigest(skill)
 			});
 		} catch {}
 	}
@@ -4254,8 +4485,10 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 				const computedHash = await computeSkillFolderHash(installDir);
 				await addSkillToLocalLock(skill.installName, {
 					source: sourceIdentifier,
+					sourceUrl: url,
 					sourceType: "well-known",
-					computedHash
+					computedHash,
+					wellKnownDigest: computeWellKnownSkillDigest(skill)
 				}, cwd);
 			}
 		} catch {}
@@ -4368,7 +4601,7 @@ async function runAdd(args, options = {}) {
 			options.skill = options.skill || [];
 			if (!options.skill.includes(parsed.skillFilter)) options.skill.push(parsed.skillFilter);
 		}
-		const includeInternal = !!(options.skill && options.skill.length > 0);
+		const includeInternal = !!(options.skill && options.skill.length > 0 && !options.skill.includes("*"));
 		let skills;
 		let blobResult = null;
 		if (parsed.type === "local") {
@@ -4521,7 +4754,8 @@ async function runAdd(args, options = {}) {
 				searchable: !hasGroups,
 				showDetail: true,
 				showSelectedSummary: false,
-				selectGroups: hasGroups
+				selectGroups: hasGroups,
+				selectAll: true
 			});
 			if (isCancelled$1(selected)) {
 				cancel("Installation cancelled");
@@ -4531,7 +4765,7 @@ async function runAdd(args, options = {}) {
 			selectedSkills = selected;
 		}
 		const ownerRepoForAudit = getOwnerRepo(parsed);
-		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : Promise.resolve(null);
+		const auditPromise = ownerRepoForAudit ? repoPrivacyPromise.then((isPrivate) => isPrivate === false ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : null) : Promise.resolve(null);
 		let targetAgents;
 		const validAgents = Object.keys(agents);
 		if (options.agent?.includes("*")) {
@@ -4611,7 +4845,7 @@ async function runAdd(args, options = {}) {
 			const availableSubagents = getEveSubagents(process.cwd());
 			if (options.subagent && options.subagent.length > 0) eveSubagentTargets = options.subagent.map((s) => s === "root" || s === "." ? void 0 : s);
 			else if (availableSubagents.length > 0 && !options.yes) {
-				const selectedSubagents = await multiselect$1({
+				const selectedSubagents = await multiselect({
 					message: "Where should Eve skills be installed?",
 					options: [{
 						value: "",
@@ -5051,6 +5285,7 @@ const DIM$3 = "\x1B[38;5;102m";
 const TEXT$2 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
 const SEARCH_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
+const SEARCH_RESULT_LIMIT = "20";
 function formatInstalls(count) {
 	if (!count || count <= 0) return "";
 	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
@@ -5101,7 +5336,7 @@ async function searchSkillsAPI(query, owner) {
 	try {
 		const params = new URLSearchParams({
 			q: query,
-			limit: "10"
+			limit: SEARCH_RESULT_LIMIT
 		});
 		if (owner) params.set("owner", owner);
 		const url = `${SEARCH_API_BASE}/api/search?${params.toString()}`;
@@ -5277,7 +5512,7 @@ ${DIM$3}  2) npx skills add <owner/repo@skill>${RESET$3}`;
 		}
 		console.log(`${DIM$3}Install with${RESET$3} npx skills add <owner/repo@skill>`);
 		console.log();
-		for (const skill of results.slice(0, 6)) {
+		for (const skill of results) {
 			const pkg = skill.source || skill.slug;
 			const installs = formatInstalls(skill.installs);
 			console.log(`${TEXT$2}${pkg}@${skill.name}${RESET$3}${installs ? ` ${CYAN$1}${installs}${RESET$3}` : ""}`);
@@ -5653,6 +5888,12 @@ function getLocalSource(entry) {
 	if ((entry.sourceType === "git" || entry.sourceType === "gitlab") && isBareShorthand(entry.source)) return null;
 	return entry.source;
 }
+function buildLocalCloneSource(entry) {
+	const source = getLocalSource(entry);
+	if (!source) return null;
+	if (entry.sourceType === "github" && isBareShorthand(source)) return `https://github.com/${source.replace(/\.git$/, "")}.git`;
+	return source;
+}
 function shouldUseFullDepthForUpdate(entry) {
 	if (!entry.skillPath) return false;
 	const source = entry.sourceType && entry.sourceType !== "github" ? getLocalSource(entry) : entry.source;
@@ -5898,6 +6139,17 @@ async function removeCommand(skillNames, options) {
 		options.yes = true;
 		log.info(import_picocolors.default.bgCyan(import_picocolors.default.black(import_picocolors.default.bold(` ${agentResult.agent.name} `))) + " Agent detected — removing non-interactively");
 	}
+	if (skillNames.includes("*")) {
+		options.all = true;
+		skillNames = skillNames.filter((name) => name !== "*");
+	}
+	const namedSkills = skillNames.filter((name) => name !== "*");
+	if (options.all && namedSkills.length > 0) {
+		log.error("Cannot combine --all with specific skill names.");
+		log.info("Use `skills remove --all` to remove every skill, or omit --all to remove only the named skills.");
+		log.info(`Example: skills remove ${namedSkills[0]} -y`);
+		process.exit(1);
+	}
 	const isGlobal = options.global ?? false;
 	const cwd = process.cwd();
 	const spinner$1 = spinner();
@@ -5950,7 +6202,7 @@ async function removeCommand(skillNames, options) {
 			value: s,
 			label: s
 		}));
-		const selected = await multiselect$1({
+		const selected = await multiselect({
 			message: `Select skills to remove ${import_picocolors.default.dim("(space to toggle)")}`,
 			options: choices,
 			required: true
@@ -6029,12 +6281,12 @@ async function removeCommand(skillNames, options) {
 			const lockEntry = await getSkillFromLock(skillName);
 			effectiveSource = lockEntry?.source || "local";
 			effectiveSourceType = lockEntry?.sourceType || "local";
-			await removeSkillFromLock(skillName);
+			if (!isStillUsed) await removeSkillFromLock(skillName);
 		} else {
 			const lockEntry = (await readLocalLock(cwd)).skills[skillName];
 			effectiveSource = lockEntry?.source || "local";
 			effectiveSourceType = lockEntry?.sourceType || "local";
-			await removeSkillFromLocalLock(skillName, cwd);
+			if (!isStillUsed) await removeSkillFromLocalLock(skillName, cwd);
 		}
 		results.push({
 			skill: skillName,
@@ -6085,8 +6337,19 @@ function parseRemoveOptions(args) {
 		const arg = args[i];
 		if (arg === "-g" || arg === "--global") options.global = true;
 		else if (arg === "-y" || arg === "--yes") options.yes = true;
-		else if (arg === "--all") options.all = true;
-		else if (arg === "-a" || arg === "--agent") {
+		else if (arg === "--all") {
+			options.all = true;
+			options.yes = true;
+		} else if (arg === "-s" || arg === "--skill") {
+			i++;
+			let nextArg = args[i];
+			while (i < args.length && nextArg && !nextArg.startsWith("-")) {
+				skills.push(nextArg);
+				i++;
+				nextArg = args[i];
+			}
+			i--;
+		} else if (arg === "-a" || arg === "--agent") {
 			options.agent = options.agent || [];
 			i++;
 			let nextArg = args[i];
@@ -6108,6 +6371,13 @@ const RESET$1 = "\x1B[0m";
 const BOLD$1 = "\x1B[1m";
 const DIM$1 = "\x1B[38;5;102m";
 const TEXT$1 = "\x1B[38;5;145m";
+function getUpdateChildEnv(sourceType) {
+	if (sourceType !== "github") return;
+	return {
+		...process.env,
+		GH_HOST: "github.com"
+	};
+}
 function parseUpdateOptions(args) {
 	const options = {};
 	const positional = [];
@@ -6224,29 +6494,143 @@ async function getProjectSkillsForUpdate(skillFilter) {
 	}
 	return skills;
 }
+async function promptDeletions(source, deletedSkills, isGlobal, options) {
+	if (deletedSkills.length === 0) return;
+	console.log();
+	console.log(`${DIM$1}Warning:${RESET$1} The following skills from ${DIM$1}${source}${RESET$1} appear to have been deleted upstream:`);
+	for (const s of deletedSkills) console.log(`  ${DIM$1}•${RESET$1} ${s}`);
+	if (options.yes || !process.stdin.isTTY) {
+		console.log(`${DIM$1}Skipping deletion in non-interactive mode.${RESET$1}`);
+		return;
+	}
+	const confirmed = await confirm({ message: `Would you like to remove the local copies of these deleted skills?` });
+	if (confirmed && !isCancel(confirmed)) for (const s of deletedSkills) {
+		console.log(`${DIM$1}Removing${RESET$1} ${s}…`);
+		await removeCommand([s], {
+			yes: true,
+			global: isGlobal
+		});
+	}
+}
 async function checkAndPromptForDeletions(source, allLockedForSource, lockSkills, isGlobal, options, discoveredPaths) {
 	const deletedSkills = allLockedForSource.filter((name) => {
 		const entry = lockSkills[name];
 		if (!entry?.skillPath) return false;
 		return !discoveredPaths.includes(entry.skillPath);
 	});
-	if (deletedSkills.length > 0) {
-		console.log();
-		console.log(`${DIM$1}Warning:${RESET$1} The following skills from ${DIM$1}${source}${RESET$1} appear to have been deleted upstream:`);
-		for (const s of deletedSkills) console.log(`  ${DIM$1}•${RESET$1} ${s}`);
-		if (options.yes || !process.stdin.isTTY) console.log(`${DIM$1}Skipping deletion in non-interactive mode.${RESET$1}`);
-		else {
-			const confirmed = await confirm({ message: `Would you like to remove the local copies of these deleted skills?` });
-			if (confirmed && !isCancel(confirmed)) for (const s of deletedSkills) {
-				console.log(`${DIM$1}Removing${RESET$1} ${s}…`);
-				await removeCommand([s], {
-					yes: true,
-					global: isGlobal
-				});
+	await promptDeletions(source, deletedSkills, isGlobal, options);
+	return deletedSkills;
+}
+async function checkWellKnownForUpdates(baseUrl, items) {
+	let indexResult;
+	try {
+		indexResult = await wellKnownProvider.fetchIndex(baseUrl, { updateCheck: true });
+	} catch {
+		return { status: "error" };
+	}
+	if (!indexResult) return { status: "error" };
+	const byName = new Map(indexResult.entries.map((entry) => [entry.name, entry]));
+	const removedSkills = items.filter((item) => !byName.has(item.name)).map((item) => item.name);
+	const localNames = new Set(items.map((item) => item.name));
+	const newSkills = indexResult.entries.map((entry) => entry.name).filter((name) => !localNames.has(name));
+	const changedSkills = [];
+	const needsContentCheck = [];
+	for (const item of items) {
+		const entry = byName.get(item.name);
+		if (!entry) continue;
+		if (entry.version === "0.2.0") {
+			if (!item.digest || entry.digest !== item.digest) changedSkills.push(item.name);
+		} else needsContentCheck.push(item);
+	}
+	if (needsContentCheck.length > 0) {
+		const tracked = new Set(needsContentCheck.map((item) => item.name));
+		const skills = (await Promise.all(indexResult.entries.filter((entry) => tracked.has(entry.name)).map((entry) => wellKnownProvider.fetchSkillByEntry(entry).catch(() => null)))).filter((skill) => skill !== null);
+		if (skills.length === 0) return { status: "error" };
+		const digests = new Map(skills.map((skill) => [skill.installName, computeWellKnownSkillDigest(skill)]));
+		for (const item of needsContentCheck) {
+			const digest = digests.get(item.name);
+			if (!digest || !item.digest || digest !== item.digest) changedSkills.push(item.name);
+		}
+	}
+	if (changedSkills.length === 0 && removedSkills.length === 0) return {
+		status: "current",
+		newSkills
+	};
+	return {
+		status: "changed",
+		changedSkills,
+		removedSkills,
+		newSkills
+	};
+}
+function printNewSkills(baseUrl, newSkills, isGlobal) {
+	if (newSkills.length === 0) return;
+	const names = newSkills.map(sanitizeMetadata);
+	console.log(`  ${DIM$1}${newSkills.length} new skill(s) available from this source:${RESET$1} ${names.join(", ")}`);
+	console.log(`    ${DIM$1}To install: ${TEXT$1}npx skills add ${baseUrl} --skill ${names.join(" ")}${isGlobal ? " -g" : ""}${RESET$1}`);
+}
+async function processWellKnownUpdates(groups, isGlobal, options) {
+	let successCount = 0;
+	let failCount = 0;
+	let changed = false;
+	for (const [baseUrl, items] of groups) {
+		process.stdout.write(`\r${DIM$1}Checking skills from source: ${baseUrl}${RESET$1}\x1b[K\n`);
+		const result = await checkWellKnownForUpdates(baseUrl, items);
+		if (result.status === "error") {
+			console.log(`  ${DIM$1}✗ Failed to check skills from ${baseUrl}${RESET$1}`);
+			continue;
+		}
+		if (result.status === "current") {
+			printNewSkills(baseUrl, result.newSkills, isGlobal);
+			continue;
+		}
+		changed = true;
+		await promptDeletions(baseUrl, result.removedSkills, isGlobal, options);
+		printNewSkills(baseUrl, result.newSkills, isGlobal);
+		if (result.changedSkills.length === 0) continue;
+		const cliEntry = join(__dirname$1, "..", "bin", "cli.mjs");
+		if (!existsSync(cliEntry)) {
+			failCount += result.changedSkills.length;
+			console.log(`  ${DIM$1}✗ CLI entrypoint not found at ${cliEntry}${RESET$1}`);
+			continue;
+		}
+		const itemByName = new Map(items.map((item) => [item.name, item]));
+		for (const name of result.changedSkills) {
+			const safeName = sanitizeMetadata(name);
+			console.log(`${TEXT$1}Updating ${safeName}…${RESET$1}`);
+			const subagents = itemByName.get(name)?.subagents;
+			const subagentArgs = !isGlobal && subagents?.length ? ["--subagent", ...subagents.map((s) => s === "" ? "root" : s)] : [];
+			if (spawnSync(process.execPath, [
+				cliEntry,
+				"add",
+				baseUrl,
+				"--skill",
+				name,
+				...subagentArgs,
+				...isGlobal ? ["-g"] : [],
+				"-y"
+			], {
+				stdio: [
+					"inherit",
+					"pipe",
+					"pipe"
+				],
+				encoding: "utf-8",
+				shell: false
+			}).status === 0) {
+				successCount++;
+				console.log(`  ${TEXT$1}✓${RESET$1} Updated ${safeName}`);
+			} else {
+				failCount++;
+				console.log(`  ${DIM$1}✗ Failed to update ${safeName}${RESET$1}`);
 			}
 		}
 	}
-	return deletedSkills;
+	return {
+		successCount,
+		failCount,
+		changed
+	};
 }
 async function updateGlobalSkills(options = {}) {
 	const lock = await readSkillLock();
@@ -6267,10 +6651,20 @@ async function updateGlobalSkills(options = {}) {
 	const updates = [];
 	const skipped = [];
 	const checkable = [];
+	const wellKnownGroups = /* @__PURE__ */ new Map();
 	for (const skillName of skillNames) {
 		if (!matchesSkillFilter(skillName, options.skills)) continue;
 		const entry = lock.skills[skillName];
 		if (!entry) continue;
+		if (entry.sourceType === "well-known" && entry.sourceBaseUrl && entry.wellKnownDigest) {
+			const group = wellKnownGroups.get(entry.sourceBaseUrl) || [];
+			group.push({
+				name: skillName,
+				digest: entry.wellKnownDigest
+			});
+			wellKnownGroups.set(entry.sourceBaseUrl, group);
+			continue;
+		}
 		if (!entry.skillFolderHash || !entry.skillPath) {
 			skipped.push({
 				name: skillName,
@@ -6286,50 +6680,55 @@ async function updateGlobalSkills(options = {}) {
 			entry
 		});
 	}
+	const wellKnownCount = Array.from(wellKnownGroups.values()).reduce((sum, items) => sum + items.length, 0);
+	const { successCount: wkSuccessCount, failCount: wkFailCount, changed: wkChanged } = await processWellKnownUpdates(wellKnownGroups, true, options);
+	successCount += wkSuccessCount;
+	failCount += wkFailCount;
 	const bySource = /* @__PURE__ */ new Map();
 	for (const item of checkable) {
-		const source = item.entry.source;
-		const existing = bySource.get(source) || [];
+		const key = `${item.entry.source}\n${item.entry.ref ?? ""}`;
+		const existing = bySource.get(key) || [];
 		existing.push(item);
-		bySource.set(source, existing);
+		bySource.set(key, existing);
 	}
-	for (const [source, itemsForSource] of bySource) {
+	for (const [, itemsForSource] of bySource) {
 		const firstEntry = itemsForSource[0].entry;
+		const source = firstEntry.source;
 		const sourceUrl = firstEntry.sourceUrl || firstEntry.source;
 		let tempDir = null;
 		process.stdout.write(`\r${DIM$1}Checking skills from source: ${source}${RESET$1}\x1b[K\n`);
 		try {
-			if (firstEntry.sourceType === "github") {
+			const isGitHubSource = firstEntry.sourceType === "github";
+			if (isGitHubSource) {
 				const tree = await fetchRepoTree(source, firstEntry.ref, getGitHubToken);
-				if (!tree) {
-					console.log(`  ${DIM$1}✗ Failed to fetch tree for ${source}${RESET$1}`);
+				if (tree) {
+					const discoveredPaths = tree.tree.filter((entry) => entry.type === "blob").map((entry) => entry.path);
+					const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
+					const deletedSkillSet = new Set(deletedSkills);
+					for (const { name: skillName, entry } of itemsForSource) {
+						if (deletedSkillSet.has(skillName)) continue;
+						const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
+						if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+							name: skillName,
+							source,
+							entry
+						});
+					}
 					continue;
 				}
-				const discoveredPaths = tree.tree.filter((entry) => entry.type === "blob").map((entry) => entry.path);
-				const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
-				const deletedSkillSet = new Set(deletedSkills);
-				for (const { name: skillName, entry } of itemsForSource) {
-					if (deletedSkillSet.has(skillName)) continue;
-					const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
-					if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-						name: skillName,
-						source,
-						entry
-					});
-				}
-				continue;
+				console.log(`  ${DIM$1}GitHub API unavailable; checking via Git clone${RESET$1}`);
 			}
 			tempDir = await cloneRepo(sourceUrl, firstEntry.ref);
 			const discoveredPaths = (await discoverSkills(tempDir, void 0, { fullDepth: true })).map((skill) => {
 				return join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/");
 			});
-			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
+			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
 			const deletedSkillSet = new Set(deletedSkills);
 			for (const { name: skillName, entry } of itemsForSource) {
 				if (deletedSkillSet.has(skillName)) continue;
 				const skillPath = entry.skillPath;
 				if (!discoveredPaths.includes(skillPath)) continue;
-				const latestHash = await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
+				const latestHash = isGitHubSource && /^[0-9a-f]{40}$/i.test(entry.skillFolderHash) ? await getGitTreeHash(tempDir, skillPath) : await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
 				if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
 					name: skillName,
 					source,
@@ -6343,8 +6742,8 @@ async function updateGlobalSkills(options = {}) {
 		}
 	}
 	if (checkable.length > 0) process.stdout.write("\r\x1B[K");
-	const checkedCount = checkable.length + skipped.length;
-	if (checkable.length === 0 && skipped.length === 0) {
+	const checkedCount = checkable.length + skipped.length + wellKnownCount;
+	if (checkable.length === 0 && skipped.length === 0 && wellKnownCount === 0) {
 		if (!options.skills) console.log(`${DIM$1}No global skills to check.${RESET$1}`);
 		return {
 			successCount,
@@ -6352,6 +6751,14 @@ async function updateGlobalSkills(options = {}) {
 			checkedCount: 0
 		};
 	}
+	if (checkable.length === 0 && skipped.length === 0) {
+		if (!wkChanged) console.log(`${TEXT$1}✓ All global skills are up to date${RESET$1}`);
+		return {
+			successCount,
+			failCount,
+			checkedCount
+		};
+	}
 	if (checkable.length === 0 && skipped.length > 0) {
 		printSkippedSkills(skipped);
 		return {
@@ -6361,7 +6768,7 @@ async function updateGlobalSkills(options = {}) {
 		};
 	}
 	if (updates.length === 0) {
-		console.log(`${TEXT$1}✓ All global skills are up to date${RESET$1}`);
+		if (!wkChanged) console.log(`${TEXT$1}✓ All global skills are up to date${RESET$1}`);
 		return {
 			successCount,
 			failCount,
@@ -6390,6 +6797,8 @@ async function updateGlobalSkills(options = {}) {
 			cliEntry,
 			"add",
 			installUrl,
+			"--skill",
+			update.name,
 			...fullDepthArgs,
 			"-g",
 			"-y"
@@ -6400,6 +6809,7 @@ async function updateGlobalSkills(options = {}) {
 				"pipe"
 			],
 			encoding: "utf-8",
+			env: getUpdateChildEnv(update.entry.sourceType),
 			shell: false
 		}).status === 0) {
 			successCount++;
@@ -6431,9 +6841,24 @@ async function updateProjectSkills(options = {}) {
 			foundCount: 0
 		};
 	}
-	const updatable = projectSkills.filter((s) => s.entry.skillPath);
-	const legacy = projectSkills.filter((s) => !s.entry.skillPath);
-	if (updatable.length === 0) {
+	const wellKnownGroups = /* @__PURE__ */ new Map();
+	const nonWellKnown = [];
+	for (const skill of projectSkills) {
+		const { entry } = skill;
+		if (entry.sourceType === "well-known" && entry.sourceUrl && entry.wellKnownDigest) {
+			const group = wellKnownGroups.get(entry.sourceUrl) || [];
+			group.push({
+				name: skill.name,
+				digest: entry.wellKnownDigest,
+				subagents: entry.subagents
+			});
+			wellKnownGroups.set(entry.sourceUrl, group);
+		} else nonWellKnown.push(skill);
+	}
+	const wellKnownCount = Array.from(wellKnownGroups.values()).reduce((sum, items) => sum + items.length, 0);
+	const updatable = nonWellKnown.filter((s) => s.entry.skillPath);
+	const legacy = nonWellKnown.filter((s) => !s.entry.skillPath);
+	if (updatable.length === 0 && wellKnownCount === 0) {
 		console.log(`${DIM$1}No project skills can be updated in place.${RESET$1}`);
 		printLegacyProjectSkills(legacy);
 		return {
@@ -6455,39 +6880,43 @@ async function updateProjectSkills(options = {}) {
 	if (hasUniversal) targetParts.push("Universal");
 	targetParts.push(...targetAgentNames);
 	if (targetParts.length > 0) console.log(`${TEXT$1}Updating for: ${targetParts.join(", ")}${RESET$1}`);
-	console.log(`${TEXT$1}Refreshing ${updatable.length} skill(s)…${RESET$1}`);
+	console.log(`${TEXT$1}Refreshing ${updatable.length + wellKnownCount} skill(s)…${RESET$1}`);
 	console.log();
+	const { successCount: wkSuccessCount, failCount: wkFailCount } = await processWellKnownUpdates(wellKnownGroups, false, options);
+	successCount += wkSuccessCount;
+	failCount += wkFailCount;
 	const bySource = /* @__PURE__ */ new Map();
 	for (const skill of updatable) {
-		const source = skill.entry.sourceUrl || skill.entry.source;
-		const existing = bySource.get(source) || [];
+		const key = `${skill.entry.sourceUrl || skill.entry.source}\n${skill.entry.ref ?? ""}`;
+		const existing = bySource.get(key) || [];
 		existing.push(skill);
-		bySource.set(source, existing);
+		bySource.set(key, existing);
 	}
 	const localLock = await readLocalLock();
 	const cliEntry = join(__dirname$1, "..", "bin", "cli.mjs");
-	if (!existsSync(cliEntry)) {
+	if (updatable.length > 0 && !existsSync(cliEntry)) {
 		console.log(`${DIM$1}✗ CLI entrypoint not found at ${cliEntry}${RESET$1}`);
 		return {
 			successCount,
-			failCount: updatable.length,
+			failCount: failCount + updatable.length,
 			foundCount: projectSkills.length
 		};
 	}
-	for (const [source, skillsForSource] of bySource) {
+	for (const [, skillsForSource] of bySource) {
 		const firstEntry = skillsForSource[0].entry;
-		const sourceUrl = firstEntry.sourceUrl || firstEntry.source;
+		const source = firstEntry.sourceUrl || firstEntry.source;
+		const cloneSource = buildLocalCloneSource(firstEntry);
 		const ref = firstEntry.ref;
-		const allLockedForSource = Object.entries(localLock.skills).filter(([_, entry]) => (entry.sourceUrl || entry.source) === source).map(([name, _]) => name);
+		const allLockedForSource = Object.entries(localLock.skills).filter(([_, entry]) => (entry.sourceUrl || entry.source) === source && entry.ref === ref).map(([name, _]) => name);
 		let tempDir = null;
 		let deletedSkills = [];
-		if (buildLocalUpdateSource(firstEntry) === null) {
+		if (cloneSource === null) {
 			failCount += skillsForSource.length;
 			console.log(`${DIM$1}✗ Cannot update ${source}: skills-lock.json is missing sourceUrl for this generic Git source${RESET$1}`);
 			continue;
 		}
 		try {
-			tempDir = await cloneRepo(sourceUrl, ref);
+			tempDir = await cloneRepo(cloneSource, ref);
 			const discoveredPaths = (await discoverSkills(tempDir, void 0, { fullDepth: true })).map((s) => {
 				return join(relative(tempDir, s.path), "SKILL.md").split(sep).join("/");
 			});
@@ -6525,6 +6954,7 @@ async function updateProjectSkills(options = {}) {
 					"pipe"
 				],
 				encoding: "utf-8",
+				env: getUpdateChildEnv(skill.entry.sourceType),
 				shell: false
 			}).status === 0) {
 				successCount++;
@@ -6624,7 +7054,6 @@ function parseUseOptions(args) {
 		if (!arg) continue;
 		if (arg === "--help" || arg === "-h") options.help = true;
 		else if (arg === "--full-depth") options.fullDepth = true;
-		else if (arg === "--dangerously-accept-openclaw-risks") options.dangerouslyAcceptOpenclawRisks = true;
 		else if (arg === "--skill" || arg === "-s") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) errors.push(`${arg} requires a skill name`);
@@ -6695,16 +7124,14 @@ async function runUse(sourceArgs, options = {}, parseErrors = []) {
 		if (useAgent && !USE_AGENT_CONFIGS[useAgent]) fail(formatUnsupportedAgentError(useAgent));
 		const source = sourceArgs[0];
 		const parsed = parseSource(source);
-		if (getOwnerRepo(parsed)?.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) fail([
-			"OpenClaw skills are unverified community submissions.",
-			"Skills run with full agent permissions and could be malicious.",
-			`If you understand the risks, re-run with: skills use ${source} --dangerously-accept-openclaw-risks`
-		].join("\n"));
 		const selector = resolveSelector(parsed.skillFilter, options.skill);
 		const includeInternal = selector !== void 0;
 		let selectedSkill;
 		if (parsed.type === "well-known") {
-			const skills = await wellKnownProvider.fetchAllSkills(parsed.url);
+			const skills = await wellKnownProvider.fetchAllSkills(parsed.url, { includeInternal }).catch((error) => {
+				if (error instanceof WellKnownScopeNotFoundError) fail(error.message);
+				return [];
+			});
 			if (skills.length > 0) selectedSkill = selectWellKnownSkill(skills, selector, source);
 			else {
 				const downloaded = await downloadSource(parsed.url);
@@ -6833,8 +7260,6 @@ Options:
   -s, --skill <skill>   Select the skill to use
   -a, --agent <agent>   Start one supported agent interactively (${SUPPORTED_USE_AGENTS.join(", ")})
   --full-depth          Search nested directories like skills add --full-depth
-  --dangerously-accept-openclaw-risks
-                         Allow unverified OpenClaw community skills
   -h, --help            Show this help message
 
 Examples:
@@ -7084,15 +7509,13 @@ ${BOLD}Use Options:${RESET}
   -s, --skill <skill>    Specify the skill to use
   -a, --agent <agent>    Start one supported agent interactively
   --full-depth           Search all subdirectories even when a root SKILL.md exists
-  --dangerously-accept-openclaw-risks
-                         Allow unverified OpenClaw community skills
 
 ${BOLD}Remove Options:${RESET}
   -g, --global           Remove from global scope
-  -a, --agent <agents>   Remove from specific agents (use '*' for all agents)
+  -a, --agent <agents>   Remove from specific agents (omit to clean all agent links)
   -s, --skill <skills>   Specify skills to remove (use '*' for all skills)
   -y, --yes              Skip confirmation prompts
-  --all                  Shorthand for --skill '*' --agent '*' -y
+  --all                  Remove every installed skill (-y implied). Do not combine with named skills.
   
 ${BOLD}Experimental Sync Options:${RESET}
   -a, --agent <agents>   Specify agents to install to (use '*' for all agents)
@@ -7148,10 +7571,10 @@ ${BOLD}Arguments:${RESET}
 
 ${BOLD}Options:${RESET}
   -g, --global       Remove from global scope (~/) instead of project scope
-  -a, --agent        Remove from specific agents (use '*' for all agents)
+  -a, --agent        Remove from specific agents (omit to clean all agent links)
   -s, --skill        Specify skills to remove (use '*' for all skills)
   -y, --yes          Skip confirmation prompts
-  --all              Shorthand for --skill '*' --agent '*' -y
+  --all              Remove every installed skill (-y implied). Do not combine with named skills.
 
 ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} skills remove                           ${DIM}# interactive selection${RESET}