skillsauth 2.0.0 → 3.0.1

package/README.md

@@ -1,140 +1,307 @@
-# skillsauth
+<p align="center">
+  <img src="https://skillsauth.com/icon.svg" alt="SkillsAuth" width="80" />
+</p>
 
-Install verified AI agent skills from the [SkillsAuth](https://skillsauth.com) marketplace.
+<h1 align="center">skillsauth</h1>
 
-## Installation
+<p align="center">
+  <strong>Install verified AI agent skills from the <a href="https://skillsauth.com">SkillsAuth</a> marketplace.</strong>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/skillsauth"><img src="https://img.shields.io/npm/v/skillsauth?color=0ea5e9&label=npm" alt="npm" /></a>
+  <a href="https://www.npmjs.com/package/skillsauth"><img src="https://img.shields.io/npm/dm/skillsauth?color=6366f1" alt="downloads" /></a>
+  <a href="https://github.com/beinghimansh/skillsauth/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-22c55e" alt="license" /></a>
+  <a href="https://skillsauth.com"><img src="https://img.shields.io/badge/marketplace-skillsauth.com-f59e0b" alt="marketplace" /></a>
+</p>
+
+---
+
+## Quick Start
 
 ```bash
 npm install -g skillsauth
-# or
-npx skillsauth <command>
 ```
 
-## Quick Start
+```bash
+skillsauth search "react"                    # Search the marketplace
+skillsauth list anthropics/skills            # List skills in a verified repo
+skillsauth add anthropics/skills           # Install interactively
+skillsauth add huggingface/skills -y -g    # Install all, globally, no prompts
+skillsauth find                            # Interactive skill discovery
+```
+
+Examples below use **verified publishers** already on [SkillsAuth](https://skillsauth.com): [`anthropics/skills`](https://github.com/anthropics/skills), [`huggingface/skills`](https://github.com/huggingface/skills), and [`letta-ai/skills`](https://github.com/letta-ai/skills).
+
+---
+
+## Install a skill (`add` / `install` / `i`)
+
+### Source formats
+
+| Format | Example |
+|--------|---------|
+| GitHub shorthand | `skillsauth add anthropics/skills` |
+| Local path (plugin or `skills/` tree) | `skillsauth add ./my-plugin` |
+
+Remote installs use `owner/repo` only (no raw GitHub URL in the CLI today). Use **`list`** first to see exact skill names, then **`add owner/repo "Skill Name"`**.
+
+### Options
+
+| Option | Description |
+|--------|-------------|
+| `-g, --global` | Install under your home directory instead of the current project |
+| `-y, --yes` | Skip confirmation prompts (CI / scripts) |
+| `--agent <names...>` | Target specific agents (see [Supported agents](#supported-agents-38)) |
+| `--all` | Install every skill from the repo without selecting |
+| `--copy` | Copy files into each agent dir instead of symlinks |
+| `--json` | Machine-readable JSON output |
+
+### Examples (verified repos)
 
 ```bash
-# Search for skills
-skillsauth search "react"
+# List skills in a repo (no install)
+skillsauth list huggingface/skills
+skillsauth ls letta-ai/skills
+
+# Interactive install — pick skills, scope, and agents
+skillsauth add anthropics/skills
+
+# Install one named skill (use the name shown by `list`)
+skillsauth add anthropics/skills "skill-creator"
 
-# List skills in a repository
-skillsauth list facebook/react
+# Install all skills from a repo, project scope, no prompts
+skillsauth add huggingface/skills --yes --all
 
-# Install all skills from a repo
-skillsauth add facebook/react
+# Global install, Cursor + Claude only
+skillsauth add letta-ai/skills --global --yes --agent cursor claude-code
 
-# Install with auto-confirm
-skillsauth add facebook/react --yes
+# CI: JSON output
+skillsauth add huggingface/skills --json --yes --all
 
-# Install globally (all projects)
-skillsauth add facebook/react --global
+# Local plugin / folder with SKILL.md or plugin manifests
+skillsauth add ./my-plugin --all --yes
 ```
 
-## Commands
+### Installation scope
+
+| Scope | Flag | Lockfile | Use case |
+|-------|------|----------|----------|
+| **Project** | _(default)_ | `.skillsauth-lock.json` | Per-repo, team-shared |
+| **Global** | `-g` / `--global` | `~/.skillsauth/lock.json` | All projects on your machine |
+
+### Installation methods
+
+| Method | Description |
+|--------|-------------|
+| **Symlink** (default) | One canonical copy under `.agents/skills/<slug>/`, linked from each agent. Recommended. |
+| **Copy** | `--copy` — full copies per agent when symlinks are not allowed. |
+
+---
+
+## Other commands
 
-### `add <repo> [skill]`
-Install skills from a repository.
+Overview (same idea as [vercel-labs/skills](https://github.com/vercel-labs/skills#other-commands) — full detail and examples below):
+
+| Command | Alias | Description |
+|---------|-------|-------------|
+| `skillsauth list <repo>` | `ls` | List published skills in a GitHub repo on SkillsAuth |
+| `skillsauth search <query>` | | Search the whole marketplace |
+| `skillsauth find [query]` | | Interactive search + suggested `add` command |
+| `skillsauth installed` | `status` | Show what is installed (local or global) |
+| `skillsauth check` | | See if updates exist (does not install) |
+| `skillsauth update` | `upgrade` | Pull latest versions for lockfile entries |
+| `skillsauth remove <slug>` | `uninstall`, `rm` | Uninstall a skill by marketplace slug |
+| `skillsauth init` | | Scaffold `SKILL.md` or `--plugin` bundle |
+| `skillsauth agents` | | Print all supported agent IDs |
+
+### `skillsauth list` / `ls`
+
+Lists **verified, published** skills for an `owner/repo` that SkillsAuth has ingested.
 
 ```bash
-skillsauth add owner/repo              # Interactive install
-skillsauth add owner/repo --yes        # Auto-confirm
-skillsauth add owner/repo --global     # Install globally
-skillsauth add owner/repo skill-name   # Install specific skill
+skillsauth list anthropics/skills
+skillsauth ls huggingface/skills
+skillsauth ls letta-ai/skills
 ```
 
-Options:
-- `-g, --global` — Install to global directory (~/.claude/skills/)
-- `-y, --yes` — Skip all prompts
+Use the **name** column with `skillsauth add owner/repo "Exact Name"`.
 
-### `list <repo>`
-List all verified skills in a repository.
+### `skillsauth search`
+
+Keyword search across the marketplace (name, description, category, repo, trigger phrase).
 
 ```bash
-skillsauth list facebook/react
+skillsauth search "typescript"
+skillsauth search "gradio" --limit 15
 ```
 
-### `search <query>`
-Search the SkillsAuth marketplace.
+### `skillsauth find`
+
+Interactive picker after search; prints a ready-to-run `npx skillsauth add ...` line.
 
 ```bash
-skillsauth search "typescript"
-skillsauth search "api" --limit 20
+skillsauth find
+skillsauth find "docker"
+skillsauth find --json
 ```
 
-Options:
-- `-l, --limit <n>` — Max results (default: 10)
+### `skillsauth installed` / `status`
+
+Like `npm ls` for skills: slug, version, agents.
+
+```bash
+skillsauth installed
+skillsauth installed --global
+skillsauth installed --json
+```
 
-### `installed`
-Show installed skills.
+### `skillsauth check` / `skillsauth update`
 
 ```bash
-skillsauth installed            # Local installs
-skillsauth installed --global   # Global installs
+# Read-only: outdated vs latest, quarantine warnings
+skillsauth check
+skillsauth check --global --json
+
+# Apply updates from the marketplace
+skillsauth update
+skillsauth update --global
 ```
 
-Options:
-- `-g, --global` — Show global installs
+### `skillsauth remove` / `uninstall` / `rm`
 
-### `update`
-Update all installed skills to latest versions.
+Removes by **slug** from `installed` (e.g. `anthropics-skills-skills-skill-creator`), not by repo path.
 
 ```bash
-skillsauth update            # Update local
-skillsauth update --global   # Update global
+skillsauth installed   # copy the slug column from output
+
+skillsauth remove anthropics-skills-skills-skill-creator
+skillsauth rm anthropics-skills-skills-skill-creator --yes
+skillsauth remove your-skill-slug --global --yes
 ```
 
-Options:
-- `-g, --global` — Update global installs
+| Option | Description |
+|--------|-------------|
+| `-g, --global` | Use global lockfile / paths |
+| `-y, --yes` | Skip confirm |
 
-### `remove <slug>`
-Remove an installed skill.
+### `skillsauth init`
 
 ```bash
-skillsauth remove facebook-react-flow
-skillsauth remove facebook-react-flow --yes
-skillsauth remove facebook-react-flow --global
+skillsauth init                 # ./<name>/SKILL.md with YAML frontmatter
+skillsauth init --plugin        # Claude + Cursor plugin layout + skills/
 ```
 
-Options:
-- `-g, --global` — Remove from global install
-- `-y, --yes` — Skip confirmation
+### `skillsauth agents`
 
-## Supported AI Agents
+```bash
+skillsauth agents
+skillsauth agents --json
+```
 
-skillsauth automatically detects and installs to:
+---
+
+## Supported agents (38+)
+
+skillsauth auto-detects installed agents and installs skills to each tool’s expected location. Skills are stored in a **canonical directory** (`.agents/skills/<slug>/` for project scope, or under `~` for global) and symlinked into each agent path. Use `--copy` to write files directly instead.
+
+| # | Agent | ID | Install path |
+|---|-------|----|--------------|
+| 1 | Claude Code | `claude-code` | `.claude/skills/<slug>/` |
+| 2 | Cursor | `cursor` | `.cursor/skills/<slug>/` |
+| 3 | Windsurf | `windsurf` | `.windsurf/memories/<slug>.md` |
+| 4 | Codex | `codex` | `.codex/skills/<slug>/` |
+| 5 | GitHub Copilot | `copilot` | `.github/skills/<slug>/` |
+| 6 | Cline | `cline` | `.cline/skills/<slug>/` |
+| 7 | Roo Code | `roo` | `.roo/skills/<slug>/` |
+| 8 | Aider | `aider` | `.aider/skills/<slug>/` |
+| 9 | Continue | `continue` | `.continue/skills/<slug>/` |
+| 10 | Amp | `amp` | `.amp/skills/<slug>/` |
+| 11 | Zed | `zed` | `.zed/skills/<slug>/` |
+| 12 | Void | `void` | `.void/skills/<slug>/` |
+| 13 | PearAI | `pear` | `.pear/skills/<slug>/` |
+| 14 | Trae | `trae` | `.trae/skills/<slug>/` |
+| 15 | Aide | `aide` | `.aide/skills/<slug>/` |
+| 16 | Augment | `augment` | `.augment/skills/<slug>/` |
+| 17 | Supermaven | `supermaven` | `.supermaven/skills/<slug>/` |
+| 18 | Tabnine | `tabnine` | `.tabnine/skills/<slug>/` |
+| 19 | Sourcegraph Cody | `cody` | `.cody/skills/<slug>/` |
+| 20 | Qodo | `qodo` | `.qodo/skills/<slug>/` |
+| 21 | Bito | `bito` | `.bito/skills/<slug>/` |
+| 22 | Double | `double` | `.double/skills/<slug>/` |
+| 23 | CodeStory | `codestory` | `.codestory/skills/<slug>/` |
+| 24 | Mentat | `mentat` | `.mentat/skills/<slug>/` |
+| 25 | Goose | `goose` | `.goose/skills/<slug>/` |
+| 26 | Otto | `otto` | `.otto/skills/<slug>/` |
+| 27 | Sweep | `sweep` | `.sweep/skills/<slug>/` |
+| 28 | Devin | `devin` | `.devin/skills/<slug>/` |
+| 29 | Replit Agent | `replit` | `.replit/skills/<slug>/` |
+| 30 | Bolt | `bolt` | `.bolt/skills/<slug>/` |
+| 31 | v0 | `v0` | `.v0/skills/<slug>/` |
+| 32 | Lovable | `lovable` | `.lovable/skills/<slug>/` |
+| 33 | Same.dev | `same` | `.same/skills/<slug>/` |
+| 34 | Manus | `manus` | `.manus/skills/<slug>/` |
+| 35 | OpenCode | `opencode` | `.opencode/skills/<slug>/` |
+| 36 | Kilo Code | `kilo-code` | `.kilo-code/skills/<slug>/` |
+| 37 | Gemini CLI | `gemini-cli` | `.gemini/skills/<slug>/` |
+| 38 | Universal | `agents` | `.agents/skills/<slug>/` |
+
+Run `skillsauth agents` or `skillsauth agents --json` for scripting.
+
+---
+
+## Plugin authoring
+
+Create plugins that work across Claude Code, Cursor, and the same agent paths as above:
 
-| Agent | Local Path | Global Path |
-|-------|------------|-------------|
-| Claude Code | `.claude/skills/` | `~/.claude/skills/` |
-| Cursor | `.cursor/skills/` | `~/.cursor/skills/` |
-| Windsurf | `.windsurf/memories/` | `~/.windsurf/memories/` |
+```bash
+skillsauth init --plugin
+```
+
+```
+my-plugin/
+├── .claude-plugin/plugin.json   # Claude Code manifest
+├── .cursor-plugin/plugin.json   # Cursor manifest
+├── skills/
+│   └── my-skill/
+│       └── SKILL.md
+└── README.md
+```
+
+---
 
 ## Security
 
-All skills on SkillsAuth are:
-- ✓ Scanned with mcp-scan
-- ✓ Analyzed with Semgrep
-- ✓ Verified by VirusTotal
+All skills on SkillsAuth are verified before installation:
+
+- **mcp-scan** — prompt injection and tool poisoning checks
+- **Semgrep** — static analysis
+- **VirusTotal** — malware scanning
+- **More scanners** — integrated over time
+
+Skills that fail any scan are **quarantined** and cannot be installed. The CLI warns you if an installed skill becomes quarantined during `update` or `check`.
 
-Skills that fail security scans are quarantined and cannot be installed.
+---
 
-## Environment Variables
+## Environment variables
 
-| Variable | Description |
-|----------|-------------|
-| `SKILLSAUTH_API_URL` | API base URL (default: https://skillsauth.com/api/cli) |
-| `SKILLSAUTH_YES` | Set to `true` to skip all prompts |
-| `SKILLSAUTH_NO_ANALYTICS` | Set to `true` to disable download tracking |
-| `SKILLSAUTH_DEBUG` | Set to `true` for verbose output |
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `SKILLSAUTH_API_URL` | API base URL | `https://skillsauth.com/api/cli` |
+| `SKILLSAUTH_YES` | Skip all prompts | `false` |
+| `SKILLSAUTH_NO_ANALYTICS` | Disable download tracking | `false` |
+| `SKILLSAUTH_DEBUG` | Verbose HTTP logging | `false` |
 
-**Breaking change:** Older `SKILLSAI_*` environment variables are no longer read. Rename them to the `SKILLSAUTH_*` names above.
+---
 
 ## Lockfile
 
-skillsauth maintains a lockfile to track installed skills:
-- Local: `.skillsauth-lock.json` (in project root)
-- Global: `~/.skillsauth/lock.json`
+| Scope | Path |
+|-------|------|
+| Local | `.skillsauth-lock.json` |
+| Global | `~/.skillsauth/lock.json` |
 
-**Breaking change:** Previous paths (`.skillsai-lock.json`, `~/.skillsai/lock.json`) are not used. To keep existing lock state, copy or rename those files to the new locations; otherwise the CLI starts with an empty lock and you can reinstall skills as needed.
+---
 
 ## License
 

package/dist/__tests__/agents.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agents.test.d.ts.map

package/dist/__tests__/agents.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/agents.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/agents.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { AGENT_IDS } from '../types.js';
+import { AGENT_PATHS } from '../utils/constants.js';
+import { detectAgents, getDisplayName, getAgentMeta } from '../lib/agents.js';
+describe('Agent registry', () => {
+    it('AGENT_IDS contains at least 35 agents', () => {
+        expect(AGENT_IDS.length).toBeGreaterThanOrEqual(35);
+    });
+    it('every agent ID has a path definition', () => {
+        for (const id of AGENT_IDS) {
+            expect(AGENT_PATHS[id]).toBeDefined();
+            expect(typeof AGENT_PATHS[id].local).toBe('function');
+            expect(typeof AGENT_PATHS[id].global).toBe('function');
+        }
+    });
+    it('local paths start with a dot-directory', () => {
+        for (const id of AGENT_IDS) {
+            const p = AGENT_PATHS[id].local('test-slug');
+            expect(p).toMatch(/^\./);
+        }
+    });
+    it('global paths are absolute (contain homedir)', () => {
+        for (const id of AGENT_IDS) {
+            const p = AGENT_PATHS[id].global('test-slug');
+            expect(p.length).toBeGreaterThan(10);
+        }
+    });
+    it('every agent has a display name', () => {
+        for (const id of AGENT_IDS) {
+            expect(getDisplayName(id).length).toBeGreaterThan(0);
+        }
+    });
+    it('getAgentMeta returns id + dotDir + displayName', () => {
+        const meta = getAgentMeta('cursor');
+        expect(meta.id).toBe('cursor');
+        expect(meta.dotDir).toBe('.cursor');
+        expect(meta.displayName).toBe('Cursor');
+    });
+    it('detectAgents returns all agents', () => {
+        const agents = detectAgents('local', process.cwd());
+        expect(agents.length).toBe(AGENT_IDS.length);
+        agents.forEach((a) => {
+            expect(a.name.length).toBeGreaterThan(0);
+            expect(typeof a.detected).toBe('boolean');
+        });
+    });
+});
+//# sourceMappingURL=agents.test.js.map

package/dist/__tests__/agents.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.test.js","sourceRoot":"","sources":["../../src/__tests__/agents.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAE9E,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtD,MAAM,CAAC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACvD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACnB,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACzC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/installer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=installer.test.d.ts.map

package/dist/__tests__/installer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/installer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/installer.test.js

@@ -0,0 +1,126 @@
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdirSync, rmSync, existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { tmpdir } from 'os';
+import { installSkill, uninstallSkill, getInstallPath } from '../lib/installer.js';
+function makeTmpDir() {
+    const d = join(tmpdir(), `skillsauth-test-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+    mkdirSync(d, { recursive: true });
+    return d;
+}
+const fakeSkill = {
+    id: 'test-id',
+    slug: 'test-skill',
+    name: 'Test Skill',
+    description: 'A test skill',
+    version: '1.0.0',
+    sha: 'abc123',
+    repoOwner: 'test',
+    repoName: 'repo',
+    triggerPhrase: 'test',
+    category: 'test',
+    stars: 0,
+    scanStatus: 'clean',
+    scannedAt: null,
+    files: [
+        { path: 'SKILL.md', content: '# Test\nHello world' },
+        { path: 'scripts/run.sh', content: '#!/bin/bash\necho hello' },
+    ],
+};
+describe('installer', () => {
+    let tmpDir;
+    let origCwd;
+    beforeEach(() => {
+        tmpDir = makeTmpDir();
+        origCwd = process.cwd();
+        process.chdir(tmpDir);
+    });
+    afterEach(() => {
+        process.chdir(origCwd);
+        try {
+            rmSync(tmpDir, { recursive: true, force: true });
+        }
+        catch { /* */ }
+    });
+    it('getInstallPath returns valid path for all agents', () => {
+        const agents = ['claude-code', 'cursor', 'codex', 'agents'];
+        for (const agent of agents) {
+            const p = getInstallPath('my-skill', agent, 'local');
+            expect(p).toContain('my-skill');
+            expect(p).toContain('SKILL.md');
+        }
+    });
+    it('getInstallPath throws on invalid slug', () => {
+        expect(() => getInstallPath('../bad', 'cursor', 'local')).toThrow('Invalid skill slug');
+    });
+    describe('copy mode', () => {
+        it('installs all files to each agent directory', () => {
+            const results = installSkill(fakeSkill, ['cursor', 'claude-code'], 'local', false, true);
+            expect(results).toHaveLength(2);
+            for (const r of results) {
+                expect(r.status).toBe('installed');
+                const dir = join(tmpDir, r.path, '..');
+                expect(existsSync(join(dir, 'SKILL.md'))).toBe(true);
+                expect(readFileSync(join(dir, 'SKILL.md'), 'utf8')).toContain('# Test');
+            }
+        });
+        it('installs nested files (scripts/run.sh)', () => {
+            const results = installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            const dir = join(tmpDir, results[0].path, '..');
+            expect(existsSync(join(dir, 'scripts', 'run.sh'))).toBe(true);
+        });
+        it('skips when content unchanged', () => {
+            installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            const r2 = installSkill(fakeSkill, ['cursor'], 'local', false, true);
+            expect(r2[0].status).toBe('skipped');
+        });
+    });
+    describe('symlink mode', () => {
+        it('writes to canonical .agents/skills/ and creates link for other agents', () => {
+            const results = installSkill(fakeSkill, ['cursor', 'agents'], 'local');
+            expect(results).toHaveLength(2);
+            const canonicalDir = join(tmpDir, '.agents', 'skills', 'test-skill');
+            expect(existsSync(join(canonicalDir, 'SKILL.md'))).toBe(true);
+            const cursorResult = results.find((r) => r.agent === 'cursor');
+            expect(cursorResult.status).toBe('installed');
+        });
+    });
+    describe('path traversal prevention', () => {
+        it('skips files with .. in path', () => {
+            const malicious = {
+                ...fakeSkill,
+                files: [
+                    { path: '../../../etc/passwd', content: 'pwned' },
+                    { path: 'SKILL.md', content: '# Safe' },
+                ],
+            };
+            installSkill(malicious, ['cursor'], 'local', false, true);
+            expect(existsSync(join(tmpDir, '..', '..', '..', 'etc', 'passwd'))).toBe(false);
+        });
+        it('skips absolute paths', () => {
+            const malicious = {
+                ...fakeSkill,
+                files: [
+                    { path: '/etc/passwd', content: 'pwned' },
+                    { path: 'SKILL.md', content: '# Safe' },
+                ],
+            };
+            installSkill(malicious, ['cursor'], 'local', false, true);
+        });
+    });
+    describe('uninstall', () => {
+        it('removes skill directory for each agent', () => {
+            installSkill(fakeSkill, ['cursor', 'claude-code'], 'local', false, true);
+            uninstallSkill('test-skill', ['cursor', 'claude-code'], 'local');
+            expect(existsSync(join(tmpDir, '.cursor', 'skills', 'test-skill'))).toBe(false);
+            expect(existsSync(join(tmpDir, '.claude', 'skills', 'test-skill'))).toBe(false);
+        });
+        it('silently handles non-existent skill', () => {
+            expect(() => uninstallSkill('nonexistent', ['cursor'], 'local')).not.toThrow();
+        });
+        it('rejects unsafe slugs', () => {
+            expect(() => uninstallSkill('../bad', ['cursor'], 'local')).not.toThrow();
+        });
+    });
+});
+//# sourceMappingURL=installer.test.js.map

package/dist/__tests__/installer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.test.js","sourceRoot":"","sources":["../../src/__tests__/installer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAa,MAAM,IAAI,CAAC;AAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGnF,SAAS,UAAU;IACjB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACpG,SAAS,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,SAAS,GAAa;IAC1B,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,YAAY;IAClB,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,OAAO;IAChB,GAAG,EAAE,QAAQ;IACb,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,aAAa,EAAE,MAAM;IACrB,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE,CAAC;IACR,UAAU,EAAE,OAAO;IACnB,SAAS,EAAE,IAAI;IACf,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,EAAE;QACpD,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yBAAyB,EAAE;KAC/D;CACF,CAAC;AAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAe,CAAC;IAEpB,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,UAAU,EAAE,CAAC;QACtB,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvB,IAAI,CAAC;YAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAgB,CAAC,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,cAAc,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;YACpD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;YACtC,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,EAAE,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;YACvE,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAEhC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE9D,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAE,CAAC;YAChE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACzC,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;YACrC,MAAM,SAAS,GAAa;gBAC1B,GAAG,SAAS;gBACZ,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE;oBACjD,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;iBACxC;aACF,CAAC;YACF,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC1D,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,SAAS,GAAa;gBAC1B,GAAG,SAAS;gBACZ,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE;oBACzC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE;iBACxC;aACF,CAAC;YACF,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,YAAY,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACzE,cAAc,CAAC,YAAY,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC7C,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjF,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/lockfile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=lockfile.test.d.ts.map

package/dist/__tests__/lockfile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lockfile.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/lockfile.test.ts"],"names":[],"mappings":""}