skills 1.5.22 → 1.5.23

package/README.md

@@ -3,7 +3,7 @@
 The CLI for the open agent skills ecosystem.
 
 <!-- agent-list:start -->
-Supports **OpenCode**, **Claude Code**, **Codex**, **Cursor**, and [72 more](#supported-agents).
+Supports **OpenCode**, **Claude Code**, **Codex**, **Cursor**, and [73 more](#supported-agents).
 <!-- agent-list:end -->
 
 [![skills.sh](https://skills.sh/b/vercel-labs/skills)](https://skills.sh/vercel-labs/skills)
@@ -47,6 +47,28 @@ npx skills add git@github.com:vercel-labs/agent-skills.git
 npx skills add ./my-local-skills
 ```
 
+### Private Repositories
+
+Use the same command for public and private repositories. The CLI uses the authentication already configured for the repository URL:
+
+```bash
+# GitHub shorthand or HTTPS (Git credential helper, GitHub CLI, then SSH fallback)
+npx skills add acme/private-skills
+
+# SSH on GitHub, GitLab, or another Git host
+npx skills add git@github.com:acme/private-skills.git
+npx skills add ssh://git@git.example.com/acme/private-skills.git
+
+# HTTPS on any Git host (uses your configured Git credential helper)
+npx skills add https://git.example.com/acme/private-skills.git
+```
+
+For GitHub HTTPS and shorthand sources, `skills` first uses normal Git credentials. If that fails and GitHub CLI is authenticated, it tries `gh repo clone`, followed by SSH. It does not execute `gh auth token` or copy the stored GitHub CLI credential into the Node.js process.
+
+For GitHub tree lookups, `skills` first tries the API anonymously, then an explicitly supplied environment token, then `gh api`. GitHub CLI applies its own stored authentication and returns only the API response; the credential is never printed to or read by `skills`. If API access still fails, update checks fall back to an authenticated Git clone.
+
+`GITHUB_TOKEN` or `GH_TOKEN` can be set explicitly for GitHub API access, including private repository downloads and update checks. They are optional for installs when Git, GitHub CLI, or SSH authentication is already configured.
+
 ### Options
 
 | Option                    | Description                                                                                                                                        |
@@ -297,6 +319,7 @@ Skills can be installed to any of these agents:
 | OpenHands | `openhands` | `.openhands/skills/` | `~/.openhands/skills/` |
 | Ona | `ona` | `.ona/skills/` | `~/.ona/skills/` |
 | Pi | `pi` | `.pi/skills/` | `~/.pi/agent/skills/` |
+| Posit Assistant | `posit-assistant` | `.posit/assistant/skills/` | `~/.posit/assistant/skills/` |
 | Qoder | `qoder` | `.qoder/skills/` | `~/.qoder/skills/` |
 | Qoder CN | `qoder-cn` | `.qoder/skills/` | `~/.qoder-cn/skills/` |
 | Qwen Code | `qwen-code` | `.qwen/skills/` | `~/.qwen/skills/` |
@@ -430,6 +453,7 @@ discover `SKILL.md` files outside these container directories (e.g. under
 - `.openhands/skills/`
 - `.ona/skills/`
 - `.pi/skills/`
+- `.posit/assistant/skills/`
 - `.qoder/skills/`
 - `.qwen/skills/`
 - `.reasonix/skills/`
@@ -504,6 +528,8 @@ Ensure you have write access to the target directory.
 | `INSTALL_INTERNAL_SKILLS` | Set to `1` or `true` to show and install skills marked as `internal: true` |
 | `DISABLE_TELEMETRY`       | Set to disable anonymous usage telemetry                                   |
 | `DO_NOT_TRACK`            | Alternative way to disable telemetry                                       |
+| `GITHUB_TOKEN`            | Optional explicit token for authenticated GitHub API requests              |
+| `GH_TOKEN`                | Fallback explicit token for authenticated GitHub API requests              |
 
 ```bash
 # Install internal skills
@@ -514,7 +540,7 @@ INSTALL_INTERNAL_SKILLS=1 npx skills add vercel-labs/agent-skills --list
 
 This CLI collects anonymous usage data to help improve the tool. No personal information is collected.
 
-Telemetry is automatically disabled in CI environments.
+GitHub repository and skill identifiers are sent only for repositories that GitHub positively confirms are public. Other remote source types may include source and skill identifiers in install telemetry because their visibility cannot be checked through GitHub. Security-audit requests remain limited to confirmed-public GitHub repositories. Set `DISABLE_TELEMETRY=1` or `DO_NOT_TRACK=1` to disable both entirely.
 
 ## Related Links
 
@@ -542,6 +568,7 @@ Telemetry is automatically disabled in CI environments.
 - [Qwen Code Skills Documentation](https://qwenlm.github.io/qwen-code-docs/en/users/features/skills/)
 - [OpenHands Skills Documentation](https://docs.openhands.ai/modules/usage/how-to/using-skills)
 - [Pi Skills Documentation](https://github.com/badlogic/pi-mono/blob/main/packages/coding-agent/docs/skills.md)
+- [Posit Assistant Skills Documentation](https://assistant.posit.co/docs/features/skills/)
 - [Qoder Skills Documentation](https://docs.qoder.com/cli/Skills)
 - [Replit Skills Documentation](https://docs.replit.com/replitai/skills)
 - [Roo Code Skills Documentation](https://docs.roocode.com/features/skills)

package/dist/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { __toESM } from "./_chunks/rolldown-runtime.mjs";
 import { isCancel } from "./_chunks/libs/@clack/core.mjs";
-import { cancel, confirm, intro, log, multiselect as multiselect$1, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
+import { cancel, confirm, intro, log, multiselect, note, outro, select, spinner } from "./_chunks/libs/@clack/prompts.mjs";
 import { require_picocolors } from "./_chunks/libs/picocolors.mjs";
 import { esm_default } from "./_chunks/libs/simple-git.mjs";
 import { xdgConfig } from "./_chunks/libs/xdg-basedir.mjs";
@@ -16,7 +16,7 @@ import { homedir, platform, tmpdir } from "os";
 import * as readline from "readline";
 import { Writable } from "stream";
 import { promisify } from "util";
-import { execFile, execSync, spawn, spawnSync } from "child_process";
+import { execFile, spawn, spawnSync } from "child_process";
 import { access, chmod, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
 import { parse } from "yaml";
 import { createHash } from "crypto";
@@ -26,6 +26,7 @@ import { crc32, gunzipSync, inflateRawSync } from "node:zlib";
 import { tmpdir as tmpdir$1 } from "node:os";
 import { pipeline } from "node:stream/promises";
 import * as tar from "tar";
+import { execFile as execFile$1 } from "node:child_process";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const DEFAULT_GITHUB_HOST = "github.com";
 function getGitHubHost() {
@@ -416,8 +417,19 @@ function toggleSearchEntry(selected, entry) {
 	} else if (entry?.type === "item") if (selected.has(entry.item.value)) selected.delete(entry.item.value);
 	else selected.add(entry.item.value);
 }
+function getSelectAllState(selected, items) {
+	const selectedCount = items.filter((item) => selected.has(item.value)).length;
+	if (selectedCount === 0) return "none";
+	if (selectedCount === items.length) return "all";
+	return "partial";
+}
+function toggleAllItems(selected, items) {
+	const shouldClear = getSelectAllState(selected, items) === "all";
+	for (const item of items) if (shouldClear) selected.delete(item.value);
+	else selected.add(item.value);
+}
 async function searchMultiselect(options) {
-	const { message, items, maxVisible = 8, initialSelected = [], required = false, lockedSection, searchable = true, showDetail = false, detailLines = 2, showSelectedSummary = true, selectGroups = false } = options;
+	const { message, items, maxVisible = 8, initialSelected = [], required = false, lockedSection, searchable = true, showDetail = false, detailLines = 2, showSelectedSummary = true, selectGroups = false, selectAll = false } = options;
 	return new Promise((resolve) => {
 		const rl = readline.createInterface({
 			input: process.stdin,
@@ -444,6 +456,8 @@ async function searchMultiselect(options) {
 			const lines = [];
 			const filtered = getFiltered();
 			const entries = buildSearchEntries(filtered, selectGroups, collapsedGroups);
+			const hasSelectAll = selectAll && items.length > 0;
+			const entryCursor = cursor - (hasSelectAll ? 1 : 0);
 			const icon = state === "active" ? S_STEP_ACTIVE : state === "cancel" ? S_STEP_CANCEL : S_STEP_SUBMIT;
 			lines.push(`${icon}  ${import_picocolors.default.bold(message)}`);
 			if (state === "active") {
@@ -462,21 +476,59 @@ async function searchMultiselect(options) {
 					lines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, space select, enter confirm")}`);
 					lines.push(`${S_BAR}`);
 				}
-				const visibleStart = Math.max(0, Math.min(cursor - Math.floor(maxVisible / 2), entries.length - maxVisible));
-				const visibleEnd = Math.min(entries.length, visibleStart + maxVisible);
-				const visibleEntries = entries.slice(visibleStart, visibleEnd);
-				if (filtered.length === 0) lines.push(`${S_BAR}  ${import_picocolors.default.dim("No matches found")}`);
-				else {
+				if (hasSelectAll) {
+					const selectedCount = items.filter((item) => selected.has(item.value)).length;
+					const selectAllState = getSelectAllState(selected, items);
+					const radio = selectAllState === "all" ? S_RADIO_ACTIVE : selectAllState === "partial" ? import_picocolors.default.yellow("◐") : S_RADIO_INACTIVE;
+					const isCursor = cursor === 0;
+					const prefix = isCursor ? import_picocolors.default.cyan("❯") : " ";
+					const label = isCursor ? import_picocolors.default.underline(import_picocolors.default.bold("Select All")) : import_picocolors.default.bold("Select All");
+					lines.push(`${S_BAR} ${prefix} ${radio} ${label} ${import_picocolors.default.dim(`(${selectedCount}/${items.length})`)}`);
+					lines.push(`${S_BAR}   ${S_BAR_H.repeat(36)}`);
+				}
+				const columns = process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
+				const buildFooterLines = (includeDetail, includeSelectedSummary) => {
+					const footerLines = [];
+					if (includeDetail) {
+						const entry = entries[entryCursor];
+						const detail = hasSelectAll && cursor === 0 ? `Select or clear all ${items.length} skills.` : entry?.type === "group" ? `Select all ${entry.items.length} skills in ${entry.group}.` : entry?.item.detail;
+						const detailWidth = Math.max(1, columns - 5);
+						footerLines.push(`${S_BAR}`);
+						footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("Description")}`);
+						for (const line of formatDetailLines(detail, detailWidth, detailLines)) footerLines.push(`${S_BAR}  ${import_picocolors.default.dim(line)}`);
+					}
+					if (includeSelectedSummary) {
+						footerLines.push(`${S_BAR}`);
+						const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
+						if (allSelectedLabels.length === 0) footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("Selected: (none)")}`);
+						else {
+							const summary = allSelectedLabels.length <= 3 ? allSelectedLabels.join(", ") : `${allSelectedLabels.slice(0, 3).join(", ")} +${allSelectedLabels.length - 3} more`;
+							footerLines.push(`${S_BAR}  ${import_picocolors.default.green("Selected:")} ${summary}`);
+						}
+					}
+					if (!searchable) {
+						footerLines.push(`${S_BAR}`);
+						footerLines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, ←→ collapse/expand, space select, enter confirm")}`);
+					}
+					footerLines.push(`${import_picocolors.default.dim("└")}`);
+					return footerLines;
+				};
+				const buildItemLines = (visibleLimit) => {
+					if (filtered.length === 0) return [`${S_BAR}  ${import_picocolors.default.dim("No matches found")}`];
+					const itemLines = [];
+					const visibleStart = Math.max(0, Math.min(entryCursor - Math.floor(visibleLimit / 2), entries.length - visibleLimit));
+					const visibleEnd = Math.min(entries.length, visibleStart + visibleLimit);
+					const visibleEntries = entries.slice(visibleStart, visibleEnd);
 					for (let i = 0; i < visibleEntries.length; i++) {
 						const entry = visibleEntries[i];
-						const isCursor = visibleStart + i === cursor;
+						const isCursor = visibleStart + i === entryCursor;
 						if (entry.type === "group") {
 							const selectedCount = entry.items.filter((item) => selected.has(item.value)).length;
 							const radio = selectedCount === entry.items.length ? S_RADIO_ACTIVE : selectedCount > 0 ? import_picocolors.default.yellow("◐") : S_RADIO_INACTIVE;
 							const label = isCursor ? import_picocolors.default.underline(import_picocolors.default.bold(entry.group)) : import_picocolors.default.bold(entry.group);
 							const prefix = isCursor ? import_picocolors.default.cyan("❯") : " ";
 							const disclosure = import_picocolors.default.dim(entry.collapsed ? "▸" : "▾");
-							lines.push(`${S_BAR} ${prefix} ${disclosure} ${radio} ${label}`);
+							itemLines.push(`${S_BAR} ${prefix} ${disclosure} ${radio} ${label}`);
 							continue;
 						}
 						const item = entry.item;
@@ -487,7 +539,7 @@ async function searchMultiselect(options) {
 						const groupItems = selectGroups && item.group ? filtered.filter((i) => i.group === item.group) : [];
 						const isLastInGroup = groupItems.at(-1) === item;
 						const tree = groupItems.length > 0 ? `${import_picocolors.default.dim(isLastInGroup ? "└─" : "├─")} ` : "";
-						lines.push(`${S_BAR} ${prefix} ${tree}${radio} ${label}${hint}`);
+						itemLines.push(`${S_BAR} ${prefix} ${tree}${radio} ${label}${hint}`);
 					}
 					const hiddenBefore = visibleStart;
 					const hiddenAfter = entries.length - visibleEnd;
@@ -495,32 +547,48 @@ async function searchMultiselect(options) {
 						const parts = [];
 						if (hiddenBefore > 0) parts.push(`↑ ${hiddenBefore} more`);
 						if (hiddenAfter > 0) parts.push(`↓ ${hiddenAfter} more`);
-						lines.push(`${S_BAR}  ${import_picocolors.default.dim(parts.join("  "))}`);
+						itemLines.push(`${S_BAR}  ${import_picocolors.default.dim(parts.join("  "))}`);
 					}
-				}
-				if (showDetail) {
-					const entry = entries[cursor];
-					const detail = entry?.type === "group" ? `Select all ${entry.items.length} skills in ${entry.group}.` : entry?.item.detail;
-					const columns = process.stdout.columns && process.stdout.columns > 0 ? process.stdout.columns : 80;
-					const detailWidth = Math.max(1, columns - 5);
-					lines.push(`${S_BAR}`);
-					lines.push(`${S_BAR}  ${import_picocolors.default.dim("Description")}`);
-					for (const line of formatDetailLines(detail, detailWidth, detailLines)) lines.push(`${S_BAR}  ${import_picocolors.default.dim(line)}`);
-				}
-				if (showSelectedSummary) {
-					lines.push(`${S_BAR}`);
-					const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
-					if (allSelectedLabels.length === 0) lines.push(`${S_BAR}  ${import_picocolors.default.dim("Selected: (none)")}`);
-					else {
-						const summary = allSelectedLabels.length <= 3 ? allSelectedLabels.join(", ") : `${allSelectedLabels.slice(0, 3).join(", ")} +${allSelectedLabels.length - 3} more`;
-						lines.push(`${S_BAR}  ${import_picocolors.default.green("Selected:")} ${summary}`);
+					return itemLines;
+				};
+				const terminalRows = process.stdout.rows && process.stdout.rows > 0 ? process.stdout.rows : void 0;
+				const maxFrameRows = terminalRows ? Math.max(1, terminalRows - 1) : void 0;
+				const fitFrame = (includeDetail, includeSelectedSummary) => {
+					const footerLines = buildFooterLines(includeDetail, includeSelectedSummary);
+					let visibleLimit = Math.max(1, maxVisible);
+					let itemLines = buildItemLines(visibleLimit);
+					let frameRows = countVisualRowsForLines([
+						...lines,
+						...itemLines,
+						...footerLines
+					], columns);
+					while (maxFrameRows && frameRows > maxFrameRows && visibleLimit > 1) {
+						visibleLimit -= 1;
+						itemLines = buildItemLines(visibleLimit);
+						frameRows = countVisualRowsForLines([
+							...lines,
+							...itemLines,
+							...footerLines
+						], columns);
 					}
+					return {
+						itemLines,
+						footerLines,
+						frameRows
+					};
+				};
+				let includeDetail = showDetail;
+				let includeSelectedSummary = showSelectedSummary;
+				let fitted = fitFrame(includeDetail, includeSelectedSummary);
+				if (maxFrameRows && fitted.frameRows > maxFrameRows && includeDetail) {
+					includeDetail = false;
+					fitted = fitFrame(includeDetail, includeSelectedSummary);
 				}
-				if (!searchable) {
-					lines.push(`${S_BAR}`);
-					lines.push(`${S_BAR}  ${import_picocolors.default.dim("↑↓ move, ←→ collapse/expand, space select, enter confirm")}`);
+				if (maxFrameRows && fitted.frameRows > maxFrameRows && includeSelectedSummary) {
+					includeSelectedSummary = false;
+					fitted = fitFrame(includeDetail, includeSelectedSummary);
 				}
-				lines.push(`${import_picocolors.default.dim("└")}`);
+				lines.push(...fitted.itemLines, ...fitted.footerLines);
 			} else if (state === "submit") {
 				const allSelectedLabels = [...lockedSection ? lockedSection.items.map((i) => i.label) : [], ...items.filter((item) => selected.has(item.value)).map((item) => item.label)];
 				lines.push(`${S_BAR}  ${import_picocolors.default.dim(allSelectedLabels.join(", "))}`);
@@ -548,6 +616,9 @@ async function searchMultiselect(options) {
 		const keypressHandler = (_str, key) => {
 			if (!key) return;
 			const entries = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups);
+			const hasSelectAll = selectAll && items.length > 0;
+			const cursorOffset = hasSelectAll ? 1 : 0;
+			const entry = entries[cursor - cursorOffset];
 			if (key.name === "return") {
 				submit();
 				return;
@@ -562,12 +633,11 @@ async function searchMultiselect(options) {
 				return;
 			}
 			if (key.name === "down") {
-				cursor = Math.min(entries.length - 1, cursor + 1);
+				cursor = Math.min(entries.length + cursorOffset - 1, cursor + 1);
 				render();
 				return;
 			}
 			if (selectGroups && key.name === "right") {
-				const entry = entries[cursor];
 				if (entry?.type === "group" && entry.collapsed) {
 					collapsedGroups.delete(entry.group);
 					render();
@@ -575,18 +645,17 @@ async function searchMultiselect(options) {
 				return;
 			}
 			if (selectGroups && key.name === "left") {
-				const entry = entries[cursor];
 				const group = entry?.type === "group" ? entry.group : entry?.item.group;
 				if (group) {
 					collapsedGroups.add(group);
-					cursor = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups).findIndex((collapsedEntry) => collapsedEntry.type === "group" && collapsedEntry.group === group);
+					cursor = buildSearchEntries(getFiltered(), selectGroups, collapsedGroups).findIndex((collapsedEntry) => collapsedEntry.type === "group" && collapsedEntry.group === group) + cursorOffset;
 					render();
 				}
 				return;
 			}
 			if (key.name === "space") {
-				const entry = entries[cursor];
-				toggleSearchEntry(selected, entry);
+				if (hasSelectAll && cursor === 0) toggleAllItems(selected, items);
+				else toggleSearchEntry(selected, entry);
 				render();
 				return;
 			}
@@ -811,6 +880,38 @@ async function cloneRepo(url, ref) {
 		throw new GitCloneError(`Failed to clone ${url}: ${errorMessage}`, url, false, false);
 	}
 }
+async function getGitTreeHash(repoDir, skillPath) {
+	const segments = skillPath.replace(/\\/g, "/").split("/");
+	segments.pop();
+	const folderPath = segments.join("/");
+	const revision = folderPath ? `HEAD:${folderPath}` : "HEAD^{tree}";
+	try {
+		const hash = (await new Promise((resolve, reject) => {
+			execFile("git", [
+				"-C",
+				repoDir,
+				"rev-parse",
+				"--verify",
+				"--end-of-options",
+				revision
+			], {
+				encoding: "utf8",
+				timeout: CLONE_TIMEOUT_MS,
+				env: {
+					...process.env,
+					GIT_OPTIONAL_LOCKS: "0",
+					GIT_TERMINAL_PROMPT: "0"
+				}
+			}, (error, output) => {
+				if (error) reject(error);
+				else resolve(output);
+			});
+		})).trim();
+		return /^[0-9a-f]{40}$/i.test(hash) ? hash.toLowerCase() : null;
+	} catch {
+		return null;
+	}
+}
 async function cleanupTempDir(dir) {
 	const normalizedDir = normalize(resolve(dir));
 	const normalizedTmpDir = normalize(resolve(tmpdir()));
@@ -1018,6 +1119,7 @@ const AGENT_PROJECT_SKILL_DIRS = [
 	".opencode/skills",
 	".openhands/skills",
 	".pi/skills",
+	".posit/assistant/skills",
 	".qoder/skills",
 	".roo/skills",
 	".trae/skills",
@@ -1228,6 +1330,9 @@ function isKimchiInstalled(homeDir = home, pathExists = existsSync) {
 function isMiniMaxCodeInstalled(homeDir = home, pathExists = existsSync) {
 	return pathExists(join(homeDir, ".minimax")) || pathExists("/Applications/MiniMax Code.app");
 }
+function isPositAssistantInstalled(homeDir = home, pathExists = existsSync) {
+	return pathExists(join(homeDir, ".posit/assistant")) || pathExists(join(homeDir, ".positai"));
+}
 const agents = {
 	"aider-desk": {
 		name: "aider-desk",
@@ -1710,6 +1815,15 @@ const agents = {
 			return existsSync(join(home, ".pi/agent"));
 		}
 	},
+	"posit-assistant": {
+		name: "posit-assistant",
+		displayName: "Posit Assistant",
+		skillsDir: ".posit/assistant/skills",
+		globalSkillsDir: join(home, ".posit/assistant/skills"),
+		detectInstalled: async () => {
+			return isPositAssistantInstalled();
+		}
+	},
 	qoder: {
 		name: "qoder",
 		displayName: "Qoder",
@@ -2567,6 +2681,7 @@ function setVersion(version) {
 	cliVersion = version;
 }
 async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
+	if (!isEnabled()) return null;
 	if (skillSlugs.length === 0) return null;
 	try {
 		const params = new URLSearchParams({
@@ -2875,6 +2990,16 @@ const DISCOVERY_SCHEMA_V2 = "https://schemas.agentskills.io/discovery/0.2.0/sche
 const MAX_ARCHIVE_UNPACKED_BYTES = 50 * 1024 * 1024;
 const MAX_ARCHIVE_FILES = 1e3;
 const DISCOVERY_TIMEOUT_MS = 1e4;
+var WellKnownScopeNotFoundError = class extends Error {
+	scopePath;
+	rootUrl;
+	constructor(scopePath, rootUrl) {
+		super(`No skills found for the scoped path '${scopePath}' on ${rootUrl}. Not falling back to the root skills index because that would install every skill the host publishes. Check the URL, or run 'skills add ${rootUrl}' to install from the root index.`);
+		this.name = "WellKnownScopeNotFoundError";
+		this.scopePath = scopePath;
+		this.rootUrl = rootUrl;
+	}
+};
 var WellKnownProvider = class {
 	id = "well-known";
 	displayName = "Well-Known Skills";
@@ -3173,16 +3298,34 @@ var WellKnownProvider = class {
 			indexEntry: input.indexEntry
 		};
 	}
-	async fetchAllSkills(url) {
+	getScope(url) {
+		try {
+			const parsed = new URL(url);
+			const scopePath = parsed.pathname.replace(/\/$/, "");
+			if (!scopePath) return null;
+			return {
+				scopePath,
+				rootBaseUrl: `${parsed.protocol}//${parsed.host}`
+			};
+		} catch {
+			return null;
+		}
+	}
+	async fetchAllSkills(url, options = {}) {
 		try {
 			const candidates = await this.fetchIndexCandidates(url);
-			for (const result of candidates) {
+			const scope = this.getScope(url);
+			const scopedCandidates = scope ? candidates.filter((c) => c.resolvedBaseUrl !== scope.rootBaseUrl) : candidates;
+			const includeInternal = options.includeInternal || shouldInstallInternalSkills();
+			for (const result of scopedCandidates) {
 				const skillPromises = result.entries.map((entry) => this.fetchSkillByEntry(entry));
-				const skills = (await Promise.all(skillPromises)).filter((s) => s !== null);
+				const skills = (await Promise.all(skillPromises)).filter((s) => s !== null).filter((skill) => includeInternal || skill.metadata?.internal !== true);
 				if (skills.length > 0) return skills;
 			}
+			if (scope && scopedCandidates.length < candidates.length) throw new WellKnownScopeNotFoundError(scope.scopePath, scope.rootBaseUrl);
 			return [];
-		} catch {
+		} catch (error) {
+			if (error instanceof WellKnownScopeNotFoundError) throw error;
 			return [];
 		}
 	}
@@ -3498,25 +3641,9 @@ async function writeSkillLock(lock) {
 	await mkdir(dirname(lockPath), { recursive: true });
 	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
-let _ghWarningShown = false;
 function getGitHubToken() {
 	if (process.env.GITHUB_TOKEN) return process.env.GITHUB_TOKEN;
 	if (process.env.GH_TOKEN) return process.env.GH_TOKEN;
-	if (!_ghWarningShown) {
-		process.stderr.write(`${import_picocolors.default.dim("│  GitHub API request limit reached; checking existing ")}${import_picocolors.default.cyan("gh")}${import_picocolors.default.dim(" authentication…\n")}`);
-		_ghWarningShown = true;
-	}
-	try {
-		const token = execSync("gh auth token", {
-			encoding: "utf-8",
-			stdio: [
-				"pipe",
-				"pipe",
-				"pipe"
-			]
-		}).trim();
-		if (token) return token;
-	} catch {}
 	return null;
 }
 async function addSkillToLock(skillName, entry) {
@@ -3570,13 +3697,15 @@ async function saveSelectedAgents(agents) {
 const DOWNLOAD_BASE_URL = process.env.SKILLS_DOWNLOAD_URL || "https://skills.sh";
 const BLOB_ALLOWED_REPOS = { "zapier/connectors": { downloadUrl: (slug) => `https://connectors-skills.zapier.com/download/${encodeURIComponent(slug)}/snapshot.json` } };
 const FETCH_TIMEOUT = 1e4;
+const GH_API_MAX_BUFFER = 16 * 1024 * 1024;
 function toSkillSlug(name) {
 	return name.toLowerCase().replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]/g, "").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 let _rateLimitedThisSession = false;
 async function fetchTreeBranch(ownerRepo, branch, token) {
 	try {
-		const url = `https://api.github.com/repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+		const githubHost = getGitHubHost();
+		const url = `${githubHost === "github.com" ? "https://api.github.com" : `https://${githubHost}/api/v3`}/repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
 		const headers = {
 			Accept: "application/vnd.github.v3+json",
 			"User-Agent": "skills-cli"
@@ -3620,13 +3749,55 @@ async function fetchTreeWithToken(ownerRepo, branches, getToken) {
 	}
 	return null;
 }
+async function fetchTreeWithGitHubCli(ownerRepo, branches) {
+	for (const branch of branches) try {
+		const endpoint = `repos/${ownerRepo}/git/trees/${encodeURIComponent(branch)}?recursive=1`;
+		const stdout = await new Promise((resolve, reject) => {
+			execFile$1("gh", [
+				"api",
+				endpoint,
+				"--method",
+				"GET",
+				"--hostname",
+				getGitHubHost()
+			], {
+				encoding: "utf8",
+				timeout: FETCH_TIMEOUT,
+				maxBuffer: GH_API_MAX_BUFFER,
+				windowsHide: true,
+				env: {
+					...process.env,
+					GH_PROMPT_DISABLED: "1"
+				}
+			}, (error, output) => {
+				if (error) reject(error);
+				else resolve(output);
+			});
+		});
+		const data = JSON.parse(stdout);
+		if (typeof data.sha !== "string" || !Array.isArray(data.tree)) continue;
+		return {
+			sha: data.sha,
+			branch,
+			tree: data.tree
+		};
+	} catch {}
+	return null;
+}
+async function fetchTreeWithAvailableAuth(ownerRepo, branches, getToken) {
+	if (getToken) {
+		const tree = await fetchTreeWithToken(ownerRepo, branches, getToken);
+		if (tree) return tree;
+	}
+	return fetchTreeWithGitHubCli(ownerRepo, branches);
+}
 async function fetchRepoTree(ownerRepo, ref, getToken) {
 	const branches = ref ? [ref] : [
 		"HEAD",
 		"main",
 		"master"
 	];
-	if (_rateLimitedThisSession && getToken) return fetchTreeWithToken(ownerRepo, branches, getToken);
+	if (_rateLimitedThisSession) return fetchTreeWithAvailableAuth(ownerRepo, branches, getToken);
 	let rateLimited = false;
 	let authRetryable = false;
 	for (const branch of branches) {
@@ -3641,9 +3812,9 @@ async function fetchRepoTree(ownerRepo, ref, getToken) {
 			break;
 		}
 	}
-	if (!getToken || !(rateLimited || authRetryable)) return null;
+	if (!(rateLimited || authRetryable)) return null;
 	if (rateLimited) _rateLimitedThisSession = true;
-	return fetchTreeWithToken(ownerRepo, branches, getToken);
+	return fetchTreeWithAvailableAuth(ownerRepo, branches, getToken);
 }
 function getSkillFolderHashFromTree(tree, skillPath) {
 	let folderPath = skillPath.replace(/\\/g, "/");
@@ -3680,6 +3851,7 @@ const PRIORITY_PREFIXES = [
 	".opencode/skills/",
 	".openhands/skills/",
 	".pi/skills/",
+	".posit/assistant/skills/",
 	".qoder/skills/",
 	".roo/skills/",
 	".trae/skills/",
@@ -3772,6 +3944,7 @@ function computeSnapshotHash(files) {
 	return hash.digest("hex");
 }
 async function tryBlobInstall(ownerRepo, options = {}) {
+	if (options.ref !== void 0) return null;
 	const tree = await fetchRepoTree(ownerRepo, options.ref, options.getToken);
 	if (!tree) return null;
 	let skillMdPaths = findSkillMdPaths(tree, options.subpath);
@@ -3844,7 +4017,7 @@ async function tryBlobInstall(ownerRepo, options = {}) {
 		tree
 	};
 }
-var version$1 = "1.5.22";
+var version$1 = "1.5.23";
 const isCancelled$1 = (value) => typeof value === "symbol";
 const EVE_AGENT_LABEL = "eve agent";
 async function isSourcePrivate(source) {
@@ -3997,13 +4170,6 @@ function buildResultLines(results, targetAgents) {
 	if (failedSymlinks.length > 0) lines.push(`  ${import_picocolors.default.yellow("copied:")} ${formatList$1(failedSymlinks)}`);
 	return lines;
 }
-function multiselect(opts) {
-	return multiselect$1({
-		...opts,
-		options: opts.options,
-		message: `${opts.message} ${import_picocolors.default.dim("(space to toggle)")}`
-	});
-}
 async function promptForAgents(message, choices) {
 	let lastSelected;
 	try {
@@ -4073,7 +4239,16 @@ function isSkillsShPackUrl(url) {
 }
 async function handleWellKnownSkills(source, url, options, spinner) {
 	spinner.start("Discovering skills from well-known endpoint...");
-	const skills = await wellKnownProvider.fetchAllSkills(url).catch(() => []);
+	let skills = [];
+	try {
+		skills = await wellKnownProvider.fetchAllSkills(url, { includeInternal: Boolean(options.skill && options.skill.length > 0 && !options.skill.includes("*")) });
+	} catch (error) {
+		if (error instanceof WellKnownScopeNotFoundError) {
+			spinner.stop(import_picocolors.default.red("No matching skills"));
+			log.error(error.message);
+			process.exit(1);
+		}
+	}
 	if (skills.length === 0) {
 		spinner.stop(import_picocolors.default.dim("No well-known skills found; trying direct download..."));
 		return false;
@@ -4116,17 +4291,19 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		selectedSkills = skills;
 		log.info(`Installing all ${skills.length} skills`);
 	} else {
-		const selected = await multiselect({
+		const selected = await searchMultiselect({
 			message: "Select skills to install",
-			options: skills.map((s) => ({
+			items: skills.map((s) => ({
 				value: s,
 				label: s.installName,
 				hint: s.description.length > 60 ? s.description.slice(0, 57) + "…" : s.description
 			})),
-			initialValues: isSkillsShPackUrl(url) ? skills : void 0,
-			required: true
+			initialSelected: isSkillsShPackUrl(url) ? skills : void 0,
+			required: true,
+			maxVisible: 20,
+			selectAll: true
 		});
-		if (isCancel(selected)) {
+		if (isCancelled$1(selected)) {
 			cancel("Installation cancelled");
 			process.exit(0);
 		}
@@ -4424,7 +4601,7 @@ async function runAdd(args, options = {}) {
 			options.skill = options.skill || [];
 			if (!options.skill.includes(parsed.skillFilter)) options.skill.push(parsed.skillFilter);
 		}
-		const includeInternal = !!(options.skill && options.skill.length > 0);
+		const includeInternal = !!(options.skill && options.skill.length > 0 && !options.skill.includes("*"));
 		let skills;
 		let blobResult = null;
 		if (parsed.type === "local") {
@@ -4577,7 +4754,8 @@ async function runAdd(args, options = {}) {
 				searchable: !hasGroups,
 				showDetail: true,
 				showSelectedSummary: false,
-				selectGroups: hasGroups
+				selectGroups: hasGroups,
+				selectAll: true
 			});
 			if (isCancelled$1(selected)) {
 				cancel("Installation cancelled");
@@ -4587,7 +4765,7 @@ async function runAdd(args, options = {}) {
 			selectedSkills = selected;
 		}
 		const ownerRepoForAudit = getOwnerRepo(parsed);
-		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : Promise.resolve(null);
+		const auditPromise = ownerRepoForAudit ? repoPrivacyPromise.then((isPrivate) => isPrivate === false ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : null) : Promise.resolve(null);
 		let targetAgents;
 		const validAgents = Object.keys(agents);
 		if (options.agent?.includes("*")) {
@@ -4667,7 +4845,7 @@ async function runAdd(args, options = {}) {
 			const availableSubagents = getEveSubagents(process.cwd());
 			if (options.subagent && options.subagent.length > 0) eveSubagentTargets = options.subagent.map((s) => s === "root" || s === "." ? void 0 : s);
 			else if (availableSubagents.length > 0 && !options.yes) {
-				const selectedSubagents = await multiselect$1({
+				const selectedSubagents = await multiselect({
 					message: "Where should Eve skills be installed?",
 					options: [{
 						value: "",
@@ -5961,6 +6139,17 @@ async function removeCommand(skillNames, options) {
 		options.yes = true;
 		log.info(import_picocolors.default.bgCyan(import_picocolors.default.black(import_picocolors.default.bold(` ${agentResult.agent.name} `))) + " Agent detected — removing non-interactively");
 	}
+	if (skillNames.includes("*")) {
+		options.all = true;
+		skillNames = skillNames.filter((name) => name !== "*");
+	}
+	const namedSkills = skillNames.filter((name) => name !== "*");
+	if (options.all && namedSkills.length > 0) {
+		log.error("Cannot combine --all with specific skill names.");
+		log.info("Use `skills remove --all` to remove every skill, or omit --all to remove only the named skills.");
+		log.info(`Example: skills remove ${namedSkills[0]} -y`);
+		process.exit(1);
+	}
 	const isGlobal = options.global ?? false;
 	const cwd = process.cwd();
 	const spinner$1 = spinner();
@@ -6013,7 +6202,7 @@ async function removeCommand(skillNames, options) {
 			value: s,
 			label: s
 		}));
-		const selected = await multiselect$1({
+		const selected = await multiselect({
 			message: `Select skills to remove ${import_picocolors.default.dim("(space to toggle)")}`,
 			options: choices,
 			required: true
@@ -6148,8 +6337,19 @@ function parseRemoveOptions(args) {
 		const arg = args[i];
 		if (arg === "-g" || arg === "--global") options.global = true;
 		else if (arg === "-y" || arg === "--yes") options.yes = true;
-		else if (arg === "--all") options.all = true;
-		else if (arg === "-a" || arg === "--agent") {
+		else if (arg === "--all") {
+			options.all = true;
+			options.yes = true;
+		} else if (arg === "-s" || arg === "--skill") {
+			i++;
+			let nextArg = args[i];
+			while (i < args.length && nextArg && !nextArg.startsWith("-")) {
+				skills.push(nextArg);
+				i++;
+				nextArg = args[i];
+			}
+			i--;
+		} else if (arg === "-a" || arg === "--agent") {
 			options.agent = options.agent || [];
 			i++;
 			let nextArg = args[i];
@@ -6486,48 +6686,49 @@ async function updateGlobalSkills(options = {}) {
 	failCount += wkFailCount;
 	const bySource = /* @__PURE__ */ new Map();
 	for (const item of checkable) {
-		const source = item.entry.source;
-		const existing = bySource.get(source) || [];
+		const key = `${item.entry.source}\n${item.entry.ref ?? ""}`;
+		const existing = bySource.get(key) || [];
 		existing.push(item);
-		bySource.set(source, existing);
+		bySource.set(key, existing);
 	}
-	for (const [source, itemsForSource] of bySource) {
+	for (const [, itemsForSource] of bySource) {
 		const firstEntry = itemsForSource[0].entry;
+		const source = firstEntry.source;
 		const sourceUrl = firstEntry.sourceUrl || firstEntry.source;
 		let tempDir = null;
 		process.stdout.write(`\r${DIM$1}Checking skills from source: ${source}${RESET$1}\x1b[K\n`);
 		try {
-			if (firstEntry.sourceType === "github") {
+			const isGitHubSource = firstEntry.sourceType === "github";
+			if (isGitHubSource) {
 				const tree = await fetchRepoTree(source, firstEntry.ref, getGitHubToken);
-				if (!tree) {
-					console.log(`  ${DIM$1}✗ Failed to fetch tree for ${source}${RESET$1}`);
+				if (tree) {
+					const discoveredPaths = tree.tree.filter((entry) => entry.type === "blob").map((entry) => entry.path);
+					const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
+					const deletedSkillSet = new Set(deletedSkills);
+					for (const { name: skillName, entry } of itemsForSource) {
+						if (deletedSkillSet.has(skillName)) continue;
+						const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
+						if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
+							name: skillName,
+							source,
+							entry
+						});
+					}
 					continue;
 				}
-				const discoveredPaths = tree.tree.filter((entry) => entry.type === "blob").map((entry) => entry.path);
-				const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
-				const deletedSkillSet = new Set(deletedSkills);
-				for (const { name: skillName, entry } of itemsForSource) {
-					if (deletedSkillSet.has(skillName)) continue;
-					const latestHash = getSkillFolderHashFromTree(tree, entry.skillPath);
-					if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
-						name: skillName,
-						source,
-						entry
-					});
-				}
-				continue;
+				console.log(`  ${DIM$1}GitHub API unavailable; checking via Git clone${RESET$1}`);
 			}
 			tempDir = await cloneRepo(sourceUrl, firstEntry.ref);
 			const discoveredPaths = (await discoverSkills(tempDir, void 0, { fullDepth: true })).map((skill) => {
 				return join(relative(tempDir, skill.path), "SKILL.md").split(sep).join("/");
 			});
-			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
+			const deletedSkills = await checkAndPromptForDeletions(source, Object.entries(lock.skills).filter(([_, entry]) => entry.source === source && entry.ref === firstEntry.ref).map(([name, _]) => name), lock.skills, true, options, discoveredPaths);
 			const deletedSkillSet = new Set(deletedSkills);
 			for (const { name: skillName, entry } of itemsForSource) {
 				if (deletedSkillSet.has(skillName)) continue;
 				const skillPath = entry.skillPath;
 				if (!discoveredPaths.includes(skillPath)) continue;
-				const latestHash = await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
+				const latestHash = isGitHubSource && /^[0-9a-f]{40}$/i.test(entry.skillFolderHash) ? await getGitTreeHash(tempDir, skillPath) : await computeSkillFolderHash(join(tempDir, dirname(skillPath)));
 				if (latestHash && latestHash !== entry.skillFolderHash) updates.push({
 					name: skillName,
 					source,
@@ -6686,10 +6887,10 @@ async function updateProjectSkills(options = {}) {
 	failCount += wkFailCount;
 	const bySource = /* @__PURE__ */ new Map();
 	for (const skill of updatable) {
-		const source = skill.entry.sourceUrl || skill.entry.source;
-		const existing = bySource.get(source) || [];
+		const key = `${skill.entry.sourceUrl || skill.entry.source}\n${skill.entry.ref ?? ""}`;
+		const existing = bySource.get(key) || [];
 		existing.push(skill);
-		bySource.set(source, existing);
+		bySource.set(key, existing);
 	}
 	const localLock = await readLocalLock();
 	const cliEntry = join(__dirname$1, "..", "bin", "cli.mjs");
@@ -6701,11 +6902,12 @@ async function updateProjectSkills(options = {}) {
 			foundCount: projectSkills.length
 		};
 	}
-	for (const [source, skillsForSource] of bySource) {
+	for (const [, skillsForSource] of bySource) {
 		const firstEntry = skillsForSource[0].entry;
+		const source = firstEntry.sourceUrl || firstEntry.source;
 		const cloneSource = buildLocalCloneSource(firstEntry);
 		const ref = firstEntry.ref;
-		const allLockedForSource = Object.entries(localLock.skills).filter(([_, entry]) => (entry.sourceUrl || entry.source) === source).map(([name, _]) => name);
+		const allLockedForSource = Object.entries(localLock.skills).filter(([_, entry]) => (entry.sourceUrl || entry.source) === source && entry.ref === ref).map(([name, _]) => name);
 		let tempDir = null;
 		let deletedSkills = [];
 		if (cloneSource === null) {
@@ -6852,7 +7054,6 @@ function parseUseOptions(args) {
 		if (!arg) continue;
 		if (arg === "--help" || arg === "-h") options.help = true;
 		else if (arg === "--full-depth") options.fullDepth = true;
-		else if (arg === "--dangerously-accept-openclaw-risks") options.dangerouslyAcceptOpenclawRisks = true;
 		else if (arg === "--skill" || arg === "-s") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) errors.push(`${arg} requires a skill name`);
@@ -6923,16 +7124,14 @@ async function runUse(sourceArgs, options = {}, parseErrors = []) {
 		if (useAgent && !USE_AGENT_CONFIGS[useAgent]) fail(formatUnsupportedAgentError(useAgent));
 		const source = sourceArgs[0];
 		const parsed = parseSource(source);
-		if (getOwnerRepo(parsed)?.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) fail([
-			"OpenClaw skills are unverified community submissions.",
-			"Skills run with full agent permissions and could be malicious.",
-			`If you understand the risks, re-run with: skills use ${source} --dangerously-accept-openclaw-risks`
-		].join("\n"));
 		const selector = resolveSelector(parsed.skillFilter, options.skill);
 		const includeInternal = selector !== void 0;
 		let selectedSkill;
 		if (parsed.type === "well-known") {
-			const skills = await wellKnownProvider.fetchAllSkills(parsed.url);
+			const skills = await wellKnownProvider.fetchAllSkills(parsed.url, { includeInternal }).catch((error) => {
+				if (error instanceof WellKnownScopeNotFoundError) fail(error.message);
+				return [];
+			});
 			if (skills.length > 0) selectedSkill = selectWellKnownSkill(skills, selector, source);
 			else {
 				const downloaded = await downloadSource(parsed.url);
@@ -7061,8 +7260,6 @@ Options:
   -s, --skill <skill>   Select the skill to use
   -a, --agent <agent>   Start one supported agent interactively (${SUPPORTED_USE_AGENTS.join(", ")})
   --full-depth          Search nested directories like skills add --full-depth
-  --dangerously-accept-openclaw-risks
-                         Allow unverified OpenClaw community skills
   -h, --help            Show this help message
 
 Examples:
@@ -7312,15 +7509,13 @@ ${BOLD}Use Options:${RESET}
   -s, --skill <skill>    Specify the skill to use
   -a, --agent <agent>    Start one supported agent interactively
   --full-depth           Search all subdirectories even when a root SKILL.md exists
-  --dangerously-accept-openclaw-risks
-                         Allow unverified OpenClaw community skills
 
 ${BOLD}Remove Options:${RESET}
   -g, --global           Remove from global scope
-  -a, --agent <agents>   Remove from specific agents (use '*' for all agents)
+  -a, --agent <agents>   Remove from specific agents (omit to clean all agent links)
   -s, --skill <skills>   Specify skills to remove (use '*' for all skills)
   -y, --yes              Skip confirmation prompts
-  --all                  Shorthand for --skill '*' --agent '*' -y
+  --all                  Remove every installed skill (-y implied). Do not combine with named skills.
   
 ${BOLD}Experimental Sync Options:${RESET}
   -a, --agent <agents>   Specify agents to install to (use '*' for all agents)
@@ -7376,10 +7571,10 @@ ${BOLD}Arguments:${RESET}
 
 ${BOLD}Options:${RESET}
   -g, --global       Remove from global scope (~/) instead of project scope
-  -a, --agent        Remove from specific agents (use '*' for all agents)
+  -a, --agent        Remove from specific agents (omit to clean all agent links)
   -s, --skill        Specify skills to remove (use '*' for all skills)
   -y, --yes          Skip confirmation prompts
-  --all              Shorthand for --skill '*' --agent '*' -y
+  --all              Remove every installed skill (-y implied). Do not combine with named skills.
 
 ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} skills remove                           ${DIM}# interactive selection${RESET}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skills",
-  "version": "1.5.22",
+  "version": "1.5.23",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -89,6 +89,7 @@
     "openhands",
     "ona",
     "pi",
+    "posit-assistant",
     "qoder",
     "qoder-cn",
     "qwen-code",