wittyhub 0.0.2 → 0.0.4

package/dist/cli.mjs

@@ -11,14 +11,18 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { createHash } from "node:crypto";
-import { stripVTControlCharacters } from "node:util";
-import { homedir, platform, tmpdir } from "os";
+import { execFile } from "node:child_process";
+import { promisify, stripVTControlCharacters } from "node:util";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname as dirname$1, join as join$1, sep as sep$1 } from "node:path";
+import { homedir as homedir$1, platform, tmpdir as tmpdir$1 } from "os";
+import { parse } from "yaml";
 import * as readline from "readline";
 import { Writable } from "stream";
-import { promisify } from "util";
-import { execFile, execSync, spawn, spawnSync } from "child_process";
-import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
-import { parse } from "yaml";
+import { promisify as promisify$1 } from "util";
+import { execFile as execFile$1, execSync, spawn, spawnSync } from "child_process";
+import { access, cp, lstat, mkdir, mkdtemp as mkdtemp$1, readFile, readdir, readlink, realpath, rm as rm$1, stat, symlink, writeFile as writeFile$1 } from "fs/promises";
 import { createHash as createHash$1 } from "crypto";
 import { gunzipSync, inflateRawSync } from "node:zlib";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
@@ -251,6 +255,30 @@ function isWellKnownUrl(input) {
 		return false;
 	}
 }
+const CLI_CONFIG_PATH = join(homedir$1(), ".config", "wittyhub", "cli.yaml");
+function loadCliConfig() {
+	if (!existsSync(CLI_CONFIG_PATH)) return {};
+	try {
+		const parsed = parse(readFileSync(CLI_CONFIG_PATH, "utf-8"));
+		if (!parsed || typeof parsed !== "object") return {};
+		return parsed;
+	} catch {
+		return {};
+	}
+}
+const DEFAULT_API_URL = "https://skillhub.openeuler.org/api/v1";
+const DEFAULT_SEARCH_URL = "https://skillhub.openeuler.org/api/v1/index/search";
+const DEFAULT_TELEMETRY_URL = "https://skillhub.openeuler.org/api/v1/skills/telemetry";
+const DEFAULT_AUDIT_URL = "https://skillhub.openeuler.org/api/v1/skills/{skill_id}/audit";
+const DEFAULT_GET_URL = "https://skillhub.openeuler.org/api/v1/skills/{skill_id}";
+const DEFAULT_LIST_URL = "https://skillhub.openeuler.org/api/v1/skills/";
+const cliConfig = loadCliConfig();
+const DOWNLOAD_URL = `${typeof cliConfig.api_url === "string" && cliConfig.api_url.trim() ? cliConfig.api_url.trim() : process.env.SKILLS_API_URL ? `${process.env.SKILLS_API_URL.replace(/\/$/, "")}/api/v1` : DEFAULT_API_URL}/skills/{skill_id}/download`;
+const SEARCH_URL = typeof cliConfig.search_url === "string" && cliConfig.search_url.trim() ? cliConfig.search_url.trim() : process.env.SKILLS_API_URL ? `${process.env.SKILLS_API_URL.replace(/\/$/, "")}/api/v1/index/search` : DEFAULT_SEARCH_URL;
+const TELEMETRY_URL = typeof cliConfig.telemetry_url === "string" && cliConfig.telemetry_url.trim() ? cliConfig.telemetry_url.trim() : DEFAULT_TELEMETRY_URL;
+const AUDIT_URL = typeof cliConfig.audit_url === "string" && cliConfig.audit_url.trim() ? cliConfig.audit_url.trim() : DEFAULT_AUDIT_URL;
+const GET_URL = typeof cliConfig.get_url === "string" && cliConfig.get_url.trim() ? cliConfig.get_url.trim() : DEFAULT_GET_URL;
+const LIST_URL = typeof cliConfig.list_url === "string" && cliConfig.list_url.trim() ? cliConfig.list_url.trim() : GET_URL.replace(/\{skill_id\}[^/]*$/, "") || DEFAULT_LIST_URL;
 const CSI_RE = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]/g;
 const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
 const DCS_PM_APC_RE = /\x1b[P^_][\s\S]*?(?:\x1b\\)/g;
@@ -453,7 +481,7 @@ const CLONE_TIMEOUT_MS = (() => {
 	const parsed = Number.parseInt(raw, 10);
 	return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_CLONE_TIMEOUT_MS;
 })();
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify$1(execFile$1);
 var GitCloneError = class extends Error {
 	url;
 	isTimeout;
@@ -524,11 +552,12 @@ function createGitClient(extraEnv) {
 			"filter.lfs.smudge=",
 			"filter.lfs.clean=",
 			"filter.lfs.process="
-		]
+		],
+		unsafe: { allowUnsafeFilter: true }
 	});
 }
 async function resetTempDir(dir) {
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	}).catch(() => {});
@@ -537,7 +566,7 @@ async function resetTempDir(dir) {
 async function tryGhClone(repo, tempDir, ref) {
 	let cloneTarget = repo.slug;
 	try {
-		const { stdout, stderr } = await execFileAsync("gh", [
+		const { stdout, stderr } = await execFileAsync$1("gh", [
 			"auth",
 			"status",
 			"-h",
@@ -554,7 +583,7 @@ async function tryGhClone(repo, tempDir, ref) {
 	} catch {
 		return false;
 	}
-	await execFileAsync("gh", [
+	await execFileAsync$1("gh", [
 		"repo",
 		"clone",
 		cloneTarget,
@@ -580,7 +609,7 @@ function buildGitHubAuthError(url, repo, message) {
 	return `Authentication failed for ${url}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`;
 }
 async function cloneRepo(url, ref) {
-	const tempDir = await mkdtemp(join(tmpdir(), "skills-"));
+	const tempDir = await mkdtemp$1(join(tmpdir$1(), "skills-"));
 	const cloneOptions = ref ? [
 		"--depth",
 		"1",
@@ -596,7 +625,7 @@ async function cloneRepo(url, ref) {
 		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
 		const isAuthError = isAuthFailure(errorMessage);
 		if (isTimeout) {
-			await rm(tempDir, {
+			await rm$1(tempDir, {
 				recursive: true,
 				force: true
 			}).catch(() => {});
@@ -613,7 +642,7 @@ async function cloneRepo(url, ref) {
 				return tempDir;
 			} catch {}
 		}
-		await rm(tempDir, {
+		await rm$1(tempDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
@@ -623,9 +652,9 @@ async function cloneRepo(url, ref) {
 }
 async function cleanupTempDir(dir) {
 	const normalizedDir = normalize(resolve(dir));
-	const normalizedTmpDir = normalize(resolve(tmpdir()));
+	const normalizedTmpDir = normalize(resolve(tmpdir$1()));
 	if (!normalizedDir.startsWith(normalizedTmpDir + sep) && normalizedDir !== normalizedTmpDir) throw new Error("Attempted to clean up directory outside of temp directory");
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	});
@@ -731,7 +760,7 @@ async function writeLocalLock(lock, cwd) {
 		version: lock.version,
 		skills: sortedSkills
 	};
-	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
+	await writeFile$1(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
 }
 async function computeSkillFolderHash(skillDir) {
 	const files = [];
@@ -950,7 +979,7 @@ function filterSkills(skills, inputNames) {
 		return normalizedInputs.some((input) => input === name || input === displayName);
 	});
 }
-const home = homedir();
+const home = homedir$1();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
 const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
@@ -1679,7 +1708,7 @@ async function isDirEntryOrSymlinkToDir(entry, entryPath) {
 	}
 }
 function getCanonicalSkillsDir(global, cwd) {
-	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
+	return join(global ? homedir$1() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
 }
 function getEveSubagentSkillsDir(subagent, cwd) {
 	return join(cwd || process.cwd(), EVE_SUBAGENTS_DIR, sanitizeName(subagent), "skills");
@@ -1688,7 +1717,7 @@ function getAgentBaseDir(agentType, global, cwd, eveSubagent) {
 	if (isUniversalAgent(agentType)) return getCanonicalSkillsDir(global, cwd);
 	if (agentType === "eve" && eveSubagent) return getEveSubagentSkillsDir(eveSubagent, cwd);
 	const agent = agents[agentType];
-	const baseDir = global ? homedir() : cwd || process.cwd();
+	const baseDir = global ? homedir$1() : cwd || process.cwd();
 	if (global) {
 		if (agent.globalSkillsDir === void 0) return join(baseDir, agent.skillsDir);
 		return agent.globalSkillsDir;
@@ -1700,7 +1729,7 @@ function resolveSymlinkTarget(linkPath, linkTarget) {
 }
 async function cleanAndCreateDirectory(path) {
 	try {
-		await rm(path, {
+		await rm$1(path, {
 			recursive: true,
 			force: true
 		});
@@ -1727,11 +1756,11 @@ async function createSymlink(target, linkPath) {
 		try {
 			if ((await lstat(linkPath)).isSymbolicLink()) {
 				if (resolveSymlinkTarget(linkPath, await readlink(linkPath)) === resolvedTarget) return true;
-				await rm(linkPath);
-			} else await rm(linkPath, { recursive: true });
+				await rm$1(linkPath);
+			} else await rm$1(linkPath, { recursive: true });
 		} catch (err) {
 			if (err && typeof err === "object" && "code" in err && err.code === "ELOOP") try {
-				await rm(linkPath, { force: true });
+				await rm$1(linkPath, { force: true });
 			} catch {}
 		}
 		const linkDir = dirname(linkPath);
@@ -1872,7 +1901,7 @@ async function copyDirectory(src, dest, agentType) {
 		if (entry.isDirectory()) await copyDirectory(srcPath, destPath, agentType);
 		else try {
 			if (agentType === "eve" && entry.name.toLowerCase() === "skill.md") {
-				await writeFile(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
+				await writeFile$1(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
 				return;
 			}
 			await cp(srcPath, destPath, {
@@ -1927,88 +1956,6 @@ function getCanonicalPath(skillName, options = {}) {
 	if (!isPathSafe$1(canonicalBase, canonicalPath)) throw new Error("Invalid skill name: potential path traversal detected");
 	return canonicalPath;
 }
-async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
-	const agent = agents[agentType];
-	const isGlobal = options.global ?? false;
-	const cwd = options.cwd || process.cwd();
-	const installMode = options.mode ?? "symlink";
-	const eveSubagent = options.eveSubagent;
-	if (isGlobal && agent.globalSkillsDir === void 0) return {
-		success: false,
-		path: "",
-		mode: installMode,
-		error: `${agent.displayName} does not support global skill installation`
-	};
-	const skillName = sanitizeName(skill.installName);
-	const canonicalBase = agentType === "eve" && installMode === "symlink" ? getAgentBaseDir(agentType, isGlobal, cwd, eveSubagent) : getCanonicalSkillsDir(isGlobal, cwd);
-	const canonicalDir = join(canonicalBase, skillName);
-	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd, eveSubagent);
-	const agentDir = join(agentBase, skillName);
-	if (!isPathSafe$1(canonicalBase, canonicalDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	if (!isPathSafe$1(agentBase, agentDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	async function writeSkillFiles(targetDir) {
-		for (const [filePath, content] of skill.files) {
-			const fullPath = join(targetDir, filePath);
-			if (!isPathSafe$1(targetDir, fullPath)) continue;
-			const parentDir = dirname(fullPath);
-			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(filePath).toLowerCase() === "skill.md" && typeof content === "string" ? stripIgnoredEveFrontmatter(content) : content);
-		}
-	}
-	try {
-		if (installMode === "copy") {
-			await cleanAndCreateDirectory(agentDir);
-			await writeSkillFiles(agentDir);
-			return {
-				success: true,
-				path: agentDir,
-				mode: "copy"
-			};
-		}
-		await cleanAndCreateDirectory(canonicalDir);
-		await writeSkillFiles(canonicalDir);
-		if (isGlobal && isUniversalAgent(agentType)) return {
-			success: true,
-			path: canonicalDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-		if (!await createSymlink(canonicalDir, agentDir)) {
-			await cleanAndCreateDirectory(agentDir);
-			await writeSkillFiles(agentDir);
-			return {
-				success: true,
-				path: agentDir,
-				canonicalPath: canonicalDir,
-				mode: "symlink",
-				symlinkFailed: true
-			};
-		}
-		return {
-			success: true,
-			path: agentDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-	} catch (error) {
-		return {
-			success: false,
-			path: agentDir,
-			mode: installMode,
-			error: error instanceof Error ? error.message : "Unknown error"
-		};
-	}
-}
 async function installBlobSkillForAgent(skill, agentType, options = {}) {
 	const agent = agents[agentType];
 	const isGlobal = options.global ?? false;
@@ -2033,11 +1980,11 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 		};
 		try {
 			await mkdir(agentBase, { recursive: true });
-			await rm(flatSkillPath, {
+			await rm$1(flatSkillPath, {
 				recursive: true,
 				force: true
 			});
-			await writeFile(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
+			await writeFile$1(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
 			return {
 				success: true,
 				path: flatSkillPath,
@@ -2073,7 +2020,7 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 			if (!isPathSafe$1(targetDir, fullPath)) continue;
 			const parentDir = dirname(fullPath);
 			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
+			await writeFile$1(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
 		}
 	}
 	try {
@@ -2260,8 +2207,6 @@ async function listInstalledSkills(options = {}) {
 	} catch {}
 	return Array.from(skillsMap.values());
 }
-const TELEMETRY_URL = "https://add-skill.vercel.sh/t";
-const AUDIT_URL = "https://add-skill.vercel.sh/audit";
 let cliVersion = null;
 let detectedAgentName = null;
 function setDetectedAgent(agentName) {
@@ -2276,21 +2221,65 @@ function isEnabled() {
 function setVersion(version) {
 	cliVersion = version;
 }
-async function fetchAuditData(source, skillSlugs, timeoutMs = 3e3) {
+function slugifyTelemetryValue(value) {
+	const lowered = value.trim().toLowerCase();
+	if (!lowered) return "";
+	let normalized = lowered.replace(/[^a-z0-9._-]+/g, "-");
+	normalized = normalized.replace(/-{2,}/g, "-");
+	return normalized.replace(/^-|-$/g, "");
+}
+function buildSkillId(sourceType, ownerRepo, skillName, skillFiles) {
+	if (![
+		"github",
+		"gitcode",
+		"gitlab",
+		"gitee"
+	].includes(sourceType)) return null;
+	if (!ownerRepo) return null;
+	const slugifiedOwnerRepo = ownerRepo.split("/").map(slugifyTelemetryValue).join("/");
+	if (skillFiles) {
+		const relativePath = skillFiles[skillName];
+		if (relativePath) {
+			const normalizedPath = relativePath.trim().replace(/\\/g, "/").replace(/\/+$/, "");
+			if (normalizedPath === "SKILL.md") return `${sourceType}/${slugifiedOwnerRepo}/${slugifiedOwnerRepo.split("/").pop()}`;
+			if (normalizedPath.endsWith("/SKILL.md")) return `${sourceType}/${slugifiedOwnerRepo}/${normalizedPath.slice(0, -9)}`;
+		}
+	}
+	const skillPath = slugifyTelemetryValue(skillName);
+	if (!skillPath) return null;
+	return `${sourceType}/${slugifiedOwnerRepo}/${skillPath}`;
+}
+async function fetchAuditData(source, skillSlugs, sourceType = "github", skillFiles, timeoutMs = 15e3) {
 	if (skillSlugs.length === 0) return null;
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const params = new URLSearchParams({
-			source,
-			skills: skillSlugs.join(",")
+		const results = {};
+		const promises = skillSlugs.map(async (skillName) => {
+			const skillId = buildSkillId(sourceType, source, skillName, skillFiles);
+			if (!skillId) return;
+			try {
+				const response = await fetch(AUDIT_URL.replace("{skill_id}", skillId.split("/").map(encodeURIComponent).join("/")), { signal: controller.signal });
+				if (response.ok) {
+					const data = await response.json();
+					if (!data.error) {
+						const auditData = data.data || data;
+						results[skillName] = {
+							risk_level: auditData.risk_level ?? "unknown",
+							risk_score: auditData.risk_score ?? null,
+							risk_signals: auditData.risk_signals ?? [],
+							audited_at: auditData.audited_at ?? null
+						};
+					}
+				}
+			} catch {}
 		});
-		const controller = new AbortController();
-		const timeout = setTimeout(() => controller.abort(), timeoutMs);
-		const response = await fetch(`${AUDIT_URL}?${params.toString()}`, { signal: controller.signal });
-		clearTimeout(timeout);
-		if (!response.ok) return null;
-		return await response.json();
+		await Promise.all(promises);
+		return Object.keys(results).length > 0 ? results : null;
 	} catch {
 		return null;
+	} finally {
+		clearTimeout(timeout);
 	}
 }
 const pendingTelemetry = [];
@@ -2810,7 +2799,7 @@ const CURRENT_VERSION = 3;
 function getSkillLockPath() {
 	const xdgStateHome = process.env.XDG_STATE_HOME;
 	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
-	return join(homedir(), AGENTS_DIR, LOCK_FILE);
+	return join(homedir$1(), AGENTS_DIR, LOCK_FILE);
 }
 async function readSkillLock() {
 	const lockPath = getSkillLockPath();
@@ -2827,7 +2816,7 @@ async function readSkillLock() {
 async function writeSkillLock(lock) {
 	const lockPath = getSkillLockPath();
 	await mkdir(dirname(lockPath), { recursive: true });
-	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
+	await writeFile$1(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
 let _ghWarningShown = false;
 function getGitHubToken() {
@@ -3164,65 +3153,126 @@ async function tryBlobInstall(ownerRepo, options = {}) {
 		tree
 	};
 }
-var version$1 = "0.0.2";
+var version$1 = "0.0.4";
 const isCancelled$1 = (value) => typeof value === "symbol";
-async function isSourcePrivate(source) {
-	const ownerRepo = parseOwnerRepo(source);
-	if (!ownerRepo) return false;
-	return isRepoPrivate(ownerRepo.owner, ownerRepo.repo);
-}
 function getLockSource(parsedUrl, normalizedSource) {
 	return parsedUrl.startsWith("git@") || parsedUrl.startsWith("ssh://") ? parsedUrl : normalizedSource;
 }
 function initTelemetry(version) {
 	setVersion(version);
 }
-function riskLabel(risk) {
+const execFileAsync = promisify(execFile);
+function normalizeRepoRef(input) {
+	let s = input.trim().toLowerCase();
+	s = s.replace(/^(https?:\/\/|git:\/\/|ssh:\/\/)/, "");
+	s = s.replace(/^git@([^:]+):/, "$1/");
+	s = s.replace(/\.git$/, "");
+	s = s.replace(/\/+$/, "");
+	return s;
+}
+function looksLikeRepoSource(source) {
+	const s = source.trim();
+	if (s.startsWith("http://") || s.startsWith("https://")) return true;
+	if (s.startsWith("git@") || s.startsWith("ssh://") || s.startsWith("git://")) return true;
+	return (s.match(/\//g) || []).length <= 1 && !s.includes(":") && !/\s/.test(s);
+}
+async function resolveSkillId$1(source, skillName) {
+	if (!looksLikeRepoSource(source)) return source;
+	if (!skillName || !skillName.trim()) throw new Error(`源 "${source}" 看起来是仓库地址，需要同时传入 --skill <skill_name> 才能定位具体技能。`);
+	const searchUrl = `${SEARCH_URL}?${new URLSearchParams({
+		q: skillName.trim(),
+		limit: "20",
+		mode: "text",
+		scope: "summary"
+	}).toString()}`;
+	let res;
+	try {
+		res = await fetch(searchUrl);
+	} catch {
+		throw new Error(`无法连接搜索服务: ${SEARCH_URL}`);
+	}
+	if (!res.ok) throw new Error(`搜索服务返回 HTTP ${res.status}`);
+	const payload = await res.json();
+	const results = payload.data?.results ?? payload.results ?? [];
+	if (results.length === 0) throw new Error(`未找到名称匹配 "${skillName}" 的技能。`);
+	const wantedRef = normalizeRepoRef(source);
+	const match = results.find((r) => {
+		const ref = normalizeRepoRef(r.source_url);
+		return ref === wantedRef || ref.startsWith(`${wantedRef}/`);
+	}) ?? results[0];
+	if (!match) throw new Error(`未找到名称匹配 "${skillName}" 的技能。`);
+	return match.skill_id;
+}
+async function downloadAndExtractSkill(skillId) {
+	const downloadUrl = DOWNLOAD_URL.replace("{skill_id}", encodeURIComponent(skillId));
+	const response = await fetch(downloadUrl);
+	if (!response.ok) throw new Error(`HTTP ${response.status} ${response.statusText}`);
+	const tempDir = await mkdtemp(join$1(tmpdir(), "skills-"));
+	const zipPath = join$1(tempDir, ".skill.zip");
+	try {
+		await writeFile(zipPath, Buffer.from(await response.arrayBuffer()));
+		try {
+			await execFileAsync("unzip", [
+				"-q",
+				zipPath,
+				"-d",
+				tempDir
+			]);
+		} catch {
+			throw new Error("Failed to extract skill archive. Ensure the 'unzip' command is available on PATH.");
+		}
+	} finally {
+		await rm(zipPath, { force: true });
+	}
+	return tempDir;
+}
+function riskLabel$1(risk) {
 	switch (risk) {
-		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical Risk"));
-		case "high": return import_picocolors.default.red("High Risk");
-		case "medium": return import_picocolors.default.yellow("Med Risk");
-		case "low": return import_picocolors.default.green("Low Risk");
+		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical"));
+		case "high": return import_picocolors.default.red("High");
+		case "medium": return import_picocolors.default.yellow("Med");
+		case "low": return import_picocolors.default.green("Low");
 		case "safe": return import_picocolors.default.green("Safe");
-		default: return import_picocolors.default.dim("--");
+		default: return import_picocolors.default.dim("Unknown");
 	}
 }
-function socketLabel(audit) {
-	if (!audit) return import_picocolors.default.dim("--");
-	const count = audit.alerts ?? 0;
-	return count > 0 ? import_picocolors.default.red(`${count} alert${count !== 1 ? "s" : ""}`) : import_picocolors.default.green("0 alerts");
-}
 function padEnd(str, width) {
 	const visible = stripTerminalEscapes(str);
 	const pad = Math.max(0, width - visible.length);
 	return str + " ".repeat(pad);
 }
-function buildSecurityLines(auditData, skills, source) {
+function buildSecurityLines(auditData, skills) {
 	if (!auditData) return [];
-	if (!skills.some((s) => {
-		const data = auditData[s.slug];
-		return data && Object.keys(data).length > 0;
-	})) return [];
-	const nameWidth = Math.min(Math.max(...skills.map((s) => s.displayName.length)), 36);
+	const rows = skills.filter((s) => auditData[s.slug]);
+	if (rows.length === 0) return [];
+	const nameWidth = Math.min(Math.max(...rows.map((s) => s.displayName.length)), 36);
 	const lines = [];
-	const header = padEnd("", nameWidth + 2) + padEnd(import_picocolors.default.dim("Gen"), 18) + padEnd(import_picocolors.default.dim("Socket"), 18) + import_picocolors.default.dim("Snyk");
+	const header = padEnd("", nameWidth + 2) + padEnd(import_picocolors.default.dim("Risk"), 18) + padEnd(import_picocolors.default.dim("Score"), 8) + import_picocolors.default.dim("Signals");
 	lines.push(header);
-	for (const skill of skills) {
+	for (const skill of rows) {
 		const data = auditData[skill.slug];
 		const name = skill.displayName.length > nameWidth ? skill.displayName.slice(0, nameWidth - 1) + "…" : skill.displayName;
-		const ath = data?.ath ? riskLabel(data.ath.risk) : import_picocolors.default.dim("--");
-		const socket = data?.socket ? socketLabel(data.socket) : import_picocolors.default.dim("--");
-		const snyk = data?.snyk ? riskLabel(data.snyk.risk) : import_picocolors.default.dim("--");
-		lines.push(padEnd(import_picocolors.default.cyan(name), nameWidth + 2) + padEnd(ath, 18) + padEnd(socket, 18) + snyk);
+		const risk = riskLabel$1(data.risk_level);
+		const score = data.risk_score != null ? import_picocolors.default.dim(String(data.risk_score)) : import_picocolors.default.dim("--");
+		const signals = data.risk_signals.length > 0 ? import_picocolors.default.yellow(String(data.risk_signals.length)) : import_picocolors.default.dim("0");
+		lines.push(padEnd(import_picocolors.default.cyan(name), nameWidth + 2) + padEnd(risk, 18) + padEnd(score, 8) + signals);
 	}
-	lines.push("");
-	lines.push(`${import_picocolors.default.dim("Details:")} ${import_picocolors.default.dim(`https://skills.sh/${source}`)}`);
 	return lines;
 }
+function getHighRiskSkills(auditData, skills) {
+	if (!auditData) return [];
+	return skills.filter((s) => {
+		const data = auditData[s.slug];
+		return data && (data.risk_level === "high" || data.risk_level === "critical");
+	}).map((s) => ({
+		name: s.displayName,
+		riskLevel: auditData[s.slug].risk_level
+	}));
+}
 function shortenPath$2(fullPath, cwd) {
 	const home = homedir();
-	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
-	if (fullPath === cwd || fullPath.startsWith(cwd + sep)) return "." + fullPath.slice(cwd.length);
+	if (fullPath === home || fullPath.startsWith(home + sep$1)) return "~" + fullPath.slice(home.length);
+	if (fullPath === cwd || fullPath.startsWith(cwd + sep$1)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
 }
 function computeSingleFileSkillHash(contents) {
@@ -3237,6 +3287,13 @@ function formatList$1(items, maxShow = 5) {
 	const remaining = items.length - maxShow;
 	return `${shown.join(", ")} +${remaining} more`;
 }
+function buildSkillFiles(selectedSkills, tempDir, blobResult) {
+	const skillFiles = {};
+	for (const skill of selectedSkills) if (blobResult && "repoPath" in skill) skillFiles[skill.name] = skill.repoPath;
+	else if (tempDir && skill.path === tempDir) skillFiles[skill.name] = "SKILL.md";
+	else if (tempDir && skill.path.startsWith(tempDir + sep$1)) skillFiles[skill.name] = skill.path.slice(tempDir.length + 1).split(sep$1).join("/") + "/SKILL.md";
+	return skillFiles;
+}
 function splitAgentsByType(agentTypes) {
 	const universal = [];
 	const symlinked = [];
@@ -3247,18 +3304,6 @@ function splitAgentsByType(agentTypes) {
 		symlinked
 	};
 }
-function buildAgentSummaryLines(targetAgents, installMode) {
-	const lines = [];
-	const { universal, symlinked } = splitAgentsByType(targetAgents);
-	if (installMode === "symlink") {
-		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList$1(universal)}`);
-		if (symlinked.length > 0) lines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList$1(symlinked)}`);
-	} else {
-		const allNames = targetAgents.map((a) => agents[a].displayName);
-		lines.push(`  ${import_picocolors.default.dim("copy →")} ${formatList$1(allNames)}`);
-	}
-	return lines;
-}
 function targetDisplayName(target) {
 	const base = agents[target.agent].displayName;
 	return target.subagent ? `${base} (${target.subagent})` : base;
@@ -3386,285 +3431,6 @@ async function selectAgentsInteractive(options) {
 	return selected;
 }
 setVersion(version$1);
-async function handleWellKnownSkills(source, url, options, spinner) {
-	spinner.start("Discovering skills from well-known endpoint...");
-	const skills = await wellKnownProvider.fetchAllSkills(url);
-	if (skills.length === 0) {
-		spinner.stop(import_picocolors.default.red("No skills found"));
-		Se(import_picocolors.default.red("No skills found at this URL. Make sure the server has a /.well-known/agent-skills/index.json or /.well-known/skills/index.json file."));
-		process.exit(1);
-	}
-	spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
-	for (const skill of skills) {
-		M.info(`Skill: ${import_picocolors.default.cyan(skill.installName)}`);
-		M.message(import_picocolors.default.dim(skill.description));
-		if (skill.files.size > 1) M.message(import_picocolors.default.dim(`  Files: ${Array.from(skill.files.keys()).join(", ")}`));
-	}
-	if (options.list) {
-		console.log();
-		M.step(import_picocolors.default.bold("Available Skills"));
-		for (const skill of skills) {
-			M.message(`  ${import_picocolors.default.cyan(skill.installName)}`);
-			M.message(`    ${import_picocolors.default.dim(skill.description)}`);
-			if (skill.files.size > 1) M.message(`    ${import_picocolors.default.dim(`Files: ${skill.files.size}`)}`);
-		}
-		console.log();
-		Se("Run without --list to install");
-		process.exit(0);
-	}
-	let selectedSkills;
-	if (options.skill?.includes("*")) {
-		selectedSkills = skills;
-		M.info(`Installing all ${skills.length} skills`);
-	} else if (options.skill && options.skill.length > 0) {
-		selectedSkills = skills.filter((s) => options.skill.some((name) => s.installName.toLowerCase() === name.toLowerCase() || s.name.toLowerCase() === name.toLowerCase()));
-		if (selectedSkills.length === 0) {
-			M.error(`No matching skills found for: ${options.skill.join(", ")}`);
-			M.info("Available skills:");
-			for (const s of skills) M.message(`  - ${s.installName}`);
-			process.exit(1);
-		}
-	} else if (skills.length === 1) {
-		selectedSkills = skills;
-		const firstSkill = skills[0];
-		M.info(`Skill: ${import_picocolors.default.cyan(firstSkill.installName)}`);
-	} else if (options.yes) {
-		selectedSkills = skills;
-		M.info(`Installing all ${skills.length} skills`);
-	} else {
-		const selected = await multiselect({
-			message: "Select skills to install",
-			options: skills.map((s) => ({
-				value: s,
-				label: s.installName,
-				hint: s.description.length > 60 ? s.description.slice(0, 57) + "..." : s.description
-			})),
-			required: true
-		});
-		if (pD(selected)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		selectedSkills = selected;
-	}
-	let targetAgents;
-	const validAgents = Object.keys(agents);
-	if (options.agent?.includes("*")) {
-		targetAgents = validAgents;
-		M.info(`Installing to all ${targetAgents.length} agents`);
-	} else if (options.agent && options.agent.length > 0) {
-		const invalidAgents = options.agent.filter((a) => !validAgents.includes(a));
-		if (invalidAgents.length > 0) {
-			M.error(`Invalid agents: ${invalidAgents.join(", ")}`);
-			M.info(`Valid agents: ${validAgents.join(", ")}`);
-			process.exit(1);
-		}
-		targetAgents = options.agent;
-	} else {
-		spinner.start("Loading agents...");
-		const installedAgents = await detectInstalledAgents();
-		const totalAgents = Object.keys(agents).length;
-		spinner.stop(`${totalAgents} agents`);
-		if (installedAgents.length === 0) if (options.yes) {
-			targetAgents = validAgents;
-			M.info("Installing to all agents");
-		} else {
-			M.info("Select agents to install skills to");
-			const selected = await promptForAgents("Which agents do you want to install to?", Object.entries(agents).map(([key, config]) => ({
-				value: key,
-				label: config.displayName
-			})));
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-		else if (installedAgents.length === 1 || options.yes) {
-			targetAgents = ensureUniversalAgents(installedAgents);
-			if (installedAgents.length === 1) {
-				const firstAgent = installedAgents[0];
-				M.info(`Installing to: ${import_picocolors.default.cyan(agents[firstAgent].displayName)}`);
-			} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
-		} else {
-			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
-		}
-	}
-	let installGlobally = options.global ?? false;
-	const supportsGlobal = targetAgents.some((a) => agents[a].globalSkillsDir !== void 0);
-	if (options.global === void 0 && !options.yes && supportsGlobal) {
-		const scope = await ve({
-			message: "Installation scope",
-			options: [{
-				value: false,
-				label: "Project",
-				hint: "Install in current directory (committed with your project)"
-			}, {
-				value: true,
-				label: "Global",
-				hint: "Install in home directory (available across all projects)"
-			}]
-		});
-		if (pD(scope)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installGlobally = scope;
-	}
-	let installMode = options.copy ? "copy" : "symlink";
-	const uniqueDirs = new Set(targetAgents.map((a) => agents[a].skillsDir));
-	if (!options.copy && !options.yes && uniqueDirs.size > 1) {
-		const modeChoice = await ve({
-			message: "Installation method",
-			options: [{
-				value: "symlink",
-				label: "Symlink (Recommended)",
-				hint: "Single source of truth, easy updates"
-			}, {
-				value: "copy",
-				label: "Copy to all agents",
-				hint: "Independent copies for each agent"
-			}]
-		});
-		if (pD(modeChoice)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installMode = modeChoice;
-	} else if (uniqueDirs.size <= 1) installMode = "copy";
-	const cwd = process.cwd();
-	const summaryLines = [];
-	targetAgents.map((a) => agents[a].displayName);
-	const overwriteChecks = await Promise.all(selectedSkills.flatMap((skill) => targetAgents.map(async (agent) => ({
-		skillName: skill.installName,
-		agent,
-		installed: await isSkillInstalled(skill.installName, agent, { global: installGlobally })
-	}))));
-	const overwriteStatus = /* @__PURE__ */ new Map();
-	for (const { skillName, agent, installed } of overwriteChecks) {
-		if (!overwriteStatus.has(skillName)) overwriteStatus.set(skillName, /* @__PURE__ */ new Map());
-		overwriteStatus.get(skillName).set(agent, installed);
-	}
-	for (const skill of selectedSkills) {
-		if (summaryLines.length > 0) summaryLines.push("");
-		const shortCanonical = shortenPath$2(getCanonicalPath(skill.installName, { global: installGlobally }), cwd);
-		summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-		summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
-		if (skill.files.size > 1) summaryLines.push(`  ${import_picocolors.default.dim("files:")} ${skill.files.size}`);
-		const skillOverwrites = overwriteStatus.get(skill.installName);
-		const overwriteAgents = targetAgents.filter((a) => skillOverwrites?.get(a)).map((a) => agents[a].displayName);
-		if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
-	}
-	console.log();
-	Me(summaryLines.join("\n"), "Installation Summary");
-	if (!options.yes) {
-		const confirmed = await ye({ message: "Proceed with installation?" });
-		if (pD(confirmed) || !confirmed) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-	}
-	const sourceIdentifier = wellKnownProvider.getSourceIdentifier(url);
-	const wellKnownPrivacyPromise = isSourcePrivate(sourceIdentifier).catch(() => null);
-	spinner.start("Installing skills...");
-	const results = [];
-	for (const skill of selectedSkills) for (const agent of targetAgents) {
-		const result = await installWellKnownSkillForAgent(skill, agent, {
-			global: installGlobally,
-			mode: installMode
-		});
-		results.push({
-			skill: skill.installName,
-			agent: agents[agent].displayName,
-			...result
-		});
-	}
-	spinner.stop("Installation complete");
-	console.log();
-	const successful = results.filter((r) => r.success);
-	const failed = results.filter((r) => !r.success);
-	const skillFiles = {};
-	for (const skill of selectedSkills) skillFiles[skill.installName] = skill.sourceUrl;
-	if (await wellKnownPrivacyPromise !== true) track({
-		event: "install",
-		source: sourceIdentifier,
-		skills: selectedSkills.map((s) => s.installName).join(","),
-		agents: targetAgents.join(","),
-		...installGlobally && { global: "1" },
-		skillFiles: JSON.stringify(skillFiles),
-		sourceType: "well-known"
-	});
-	if (successful.length > 0 && installGlobally) {
-		const successfulSkillNames = new Set(successful.map((r) => r.skill));
-		for (const skill of selectedSkills) if (successfulSkillNames.has(skill.installName)) try {
-			await addSkillToLock(skill.installName, {
-				source: sourceIdentifier,
-				sourceType: "well-known",
-				sourceUrl: skill.sourceUrl,
-				skillFolderHash: ""
-			});
-		} catch {}
-	}
-	if (successful.length > 0 && !installGlobally) {
-		const successfulSkillNames = new Set(successful.map((r) => r.skill));
-		for (const skill of selectedSkills) if (successfulSkillNames.has(skill.installName)) try {
-			const matchingResult = successful.find((r) => r.skill === skill.installName);
-			const installDir = matchingResult?.canonicalPath || matchingResult?.path;
-			if (installDir) {
-				const computedHash = await computeSkillFolderHash(installDir);
-				await addSkillToLocalLock(skill.installName, {
-					source: sourceIdentifier,
-					sourceType: "well-known",
-					computedHash
-				}, cwd);
-			}
-		} catch {}
-	}
-	if (successful.length > 0) {
-		const bySkill = /* @__PURE__ */ new Map();
-		for (const r of successful) {
-			const skillResults = bySkill.get(r.skill) || [];
-			skillResults.push(r);
-			bySkill.set(r.skill, skillResults);
-		}
-		const skillCount = bySkill.size;
-		const symlinkFailures = successful.filter((r) => r.mode === "symlink" && r.symlinkFailed);
-		const copiedAgents = symlinkFailures.map((r) => r.agent);
-		const resultLines = [];
-		for (const [skillName, skillResults] of bySkill) {
-			const firstResult = skillResults[0];
-			if (firstResult.mode === "copy") {
-				resultLines.push(`${import_picocolors.default.green("✓")} ${skillName} ${import_picocolors.default.dim("(copied)")}`);
-				resultLines.push(...buildCopyResultLines(skillResults, cwd));
-			} else {
-				if (firstResult.canonicalPath) {
-					const shortPath = shortenPath$2(firstResult.canonicalPath, cwd);
-					resultLines.push(`${import_picocolors.default.green("✓")} ${shortPath}`);
-				} else resultLines.push(`${import_picocolors.default.green("✓")} ${skillName}`);
-				resultLines.push(...buildResultLines(skillResults, targetAgents));
-			}
-		}
-		const title = import_picocolors.default.green(`Installed ${skillCount} skill${skillCount !== 1 ? "s" : ""}`);
-		Me(resultLines.join("\n"), title);
-		if (symlinkFailures.length > 0) {
-			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgents)}`));
-			M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
-		}
-	}
-	if (failed.length > 0) {
-		console.log();
-		M.error(import_picocolors.default.red(`Failed to install ${failed.length}`));
-		for (const r of failed) M.message(`  ${import_picocolors.default.red("✗")} ${r.skill} → ${r.agent}: ${import_picocolors.default.dim(r.error)}`);
-	}
-	console.log();
-	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
-	await promptForFindSkills(options, targetAgents);
-}
 async function runAdd(args, options = {}) {
 	const source = args[0];
 	let installTipShown = false;
@@ -3705,17 +3471,31 @@ async function runAdd(args, options = {}) {
 	let tempDir = null;
 	try {
 		const spinner = Y();
-		spinner.start("Parsing source...");
-		const parsed = parseSource(source);
-		spinner.stop(`Source: ${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
-		const ownerRepoRaw = getOwnerRepo(parsed);
-		const repoPrivacyPromise = (() => {
-			if (!ownerRepoRaw || parsed.type !== "github") return Promise.resolve(null);
-			const ownerRepo = parseOwnerRepo(ownerRepoRaw);
-			if (!ownerRepo) return Promise.resolve(null);
-			return isRepoPrivate(ownerRepo.owner, ownerRepo.repo).catch(() => null);
-		})();
-		if (ownerRepoRaw?.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) {
+		const skillNameForLookup = options.skill?.[0];
+		let skillId;
+		try {
+			skillId = await resolveSkillId$1(source, skillNameForLookup);
+		} catch (e) {
+			const message = e instanceof Error ? e.message : String(e);
+			Se(import_picocolors.default.red(message));
+			process.exit(1);
+		}
+		spinner.start(`Downloading skill ${import_picocolors.default.cyan(skillId)} from API...`);
+		try {
+			tempDir = await downloadAndExtractSkill(skillId);
+		} catch (e) {
+			spinner.stop(import_picocolors.default.red("Download failed"));
+			const message = e instanceof Error ? e.message : String(e);
+			Se(import_picocolors.default.red(`Failed to download skill "${skillId}": ${message}`));
+			process.exit(1);
+		}
+		spinner.stop(`Skill archive downloaded from ${import_picocolors.default.cyan("API")}`);
+		const parsed = {
+			type: "git",
+			url: skillId
+		};
+		const repoPrivacyPromise = Promise.resolve(null);
+		if (source.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) {
 			console.log();
 			M.warn(import_picocolors.default.yellow(import_picocolors.default.bold("⚠ OpenClaw skills are unverified community submissions.")));
 			M.message(import_picocolors.default.yellow("This source contains user-submitted skills that have not been reviewed for safety or quality."));
@@ -3725,80 +3505,21 @@ async function runAdd(args, options = {}) {
 			Se(import_picocolors.default.red("Installation blocked"));
 			process.exit(1);
 		}
-		if (parsed.type === "well-known") {
-			await handleWellKnownSkills(source, parsed.url, options, spinner);
-			return;
-		}
-		if (parsed.skillFilter) {
-			options.skill = options.skill || [];
-			if (!options.skill.includes(parsed.skillFilter)) options.skill.push(parsed.skillFilter);
-		}
 		const includeInternal = !!(options.skill && options.skill.length > 0);
 		let skills;
 		let blobResult = null;
-		if (parsed.type === "local") {
-			spinner.start("Validating local path...");
-			if (!existsSync(parsed.localPath)) {
-				spinner.stop(import_picocolors.default.red("Path not found"));
-				Se(import_picocolors.default.red(`Local path does not exist: ${parsed.localPath}`));
-				process.exit(1);
-			}
-			spinner.stop("Local path validated");
-			spinner.start("Discovering skills...");
-			skills = await discoverSkills(parsed.localPath, parsed.subpath, {
-				includeInternal,
-				fullDepth: options.fullDepth
-			});
-		} else if (parsed.type === "github" && !options.fullDepth) {
-			const BLOB_ALLOWED_OWNERS = [
-				"vercel",
-				"vercel-labs",
-				"heygen-com"
-			];
-			const ownerRepo = getOwnerRepo(parsed);
-			const owner = ownerRepo?.split("/")[0]?.toLowerCase();
-			const isSelfHostedRepo = !!ownerRepo && Object.hasOwn(BLOB_ALLOWED_REPOS, ownerRepo.toLowerCase());
-			if (ownerRepo && owner && (isSelfHostedRepo || BLOB_ALLOWED_OWNERS.includes(owner))) {
-				spinner.start("Fetching skills...");
-				blobResult = await tryBlobInstall(ownerRepo, {
-					subpath: parsed.subpath,
-					skillFilter: parsed.skillFilter,
-					ref: parsed.ref,
-					getToken: getGitHubToken,
-					includeInternal
-				});
-				if (!blobResult) spinner.stop(import_picocolors.default.dim("Falling back to clone..."));
-			}
-			if (blobResult) {
-				skills = blobResult.skills;
-				spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
-			} else {
-				spinner.start("Cloning repository...");
-				tempDir = await cloneRepo(parsed.url, parsed.ref);
-				spinner.stop("Repository cloned");
-				spinner.start("Discovering skills...");
-				skills = await discoverSkills(tempDir, parsed.subpath, {
-					includeInternal,
-					fullDepth: options.fullDepth
-				});
-			}
-		} else {
-			spinner.start("Cloning repository...");
-			tempDir = await cloneRepo(parsed.url, parsed.ref);
-			spinner.stop("Repository cloned");
-			spinner.start("Discovering skills...");
-			skills = await discoverSkills(tempDir, parsed.subpath, {
-				includeInternal,
-				fullDepth: options.fullDepth
-			});
-		}
+		spinner.start("Discovering skills...");
+		skills = await discoverSkills(tempDir, void 0, {
+			includeInternal,
+			fullDepth: options.fullDepth
+		});
 		if (skills.length === 0) {
 			spinner.stop(import_picocolors.default.red("No skills found"));
 			Se(import_picocolors.default.red("No valid skills found. Skills require a SKILL.md with name and description."));
 			await cleanup(tempDir);
 			process.exit(1);
 		}
-		if (!blobResult) spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
+		spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
 		if (options.list) {
 			console.log();
 			M.step(import_picocolors.default.bold("Available Skills"));
@@ -3896,7 +3617,8 @@ async function runAdd(args, options = {}) {
 			selectedSkills = selected;
 		}
 		const ownerRepoForAudit = getOwnerRepo(parsed);
-		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => getSkillDisplayName(s))) : Promise.resolve(null);
+		const auditSkillFiles = buildSkillFiles(selectedSkills, tempDir, blobResult);
+		const auditPromise = ownerRepoForAudit ? fetchAuditData(ownerRepoForAudit, selectedSkills.map((s) => s.name), parsed.type, auditSkillFiles) : Promise.resolve(null);
 		let targetAgents;
 		const validAgents = Object.keys(agents);
 		if (options.agent?.includes("*")) {
@@ -4097,18 +3819,28 @@ async function runAdd(args, options = {}) {
 		}
 		console.log();
 		Me(summaryLines.join("\n"), "Installation Summary");
+		const auditSkills = selectedSkills.map((s) => ({
+			slug: getSkillDisplayName(s),
+			displayName: getSkillDisplayName(s)
+		}));
+		let auditData = null;
 		try {
-			const auditData = await auditPromise;
+			auditData = await auditPromise;
 			if (auditData && ownerRepoForAudit) {
-				const securityLines = buildSecurityLines(auditData, selectedSkills.map((s) => ({
-					slug: getSkillDisplayName(s),
-					displayName: getSkillDisplayName(s)
-				})), ownerRepoForAudit);
+				const securityLines = buildSecurityLines(auditData, auditSkills);
 				if (securityLines.length > 0) Me(securityLines.join("\n"), "Security Risk Assessments");
 			}
 		} catch {}
+		const highRiskSkills = getHighRiskSkills(auditData, auditSkills);
+		if (highRiskSkills.length > 0) {
+			const list = highRiskSkills.map((s) => `${s.name} 经安全审计标记为 ${s.riskLevel} 风险`).join("，");
+			M.warn(`${import_picocolors.default.red(import_picocolors.default.bold("⚠ 高风险警告："))} ${list}，请谨慎安装。`);
+		}
 		if (!options.yes) {
-			const confirmed = await ye({ message: "Proceed with installation?" });
+			const confirmed = await ye({
+				message: highRiskSkills.length > 0 ? `检测到以下技能存在安全风险：${highRiskSkills.map((s) => `${s.name} (${s.riskLevel})`).join(", ")}。仍要继续安装？` : "Proceed with installation?",
+				initialValue: highRiskSkills.length === 0
+			});
 			if (pD(confirmed) || !confirmed) {
 				xe("Installation cancelled");
 				await cleanup(tempDir);
@@ -4120,17 +3852,7 @@ async function runAdd(args, options = {}) {
 		for (const skill of selectedSkills) for (const target of installTargets) {
 			const { agent, subagent } = target;
 			let result;
-			if (blobResult && "files" in skill) {
-				const blobSkill = skill;
-				result = await installBlobSkillForAgent({
-					installName: blobSkill.name,
-					files: blobSkill.files
-				}, agent, {
-					global: installGlobally,
-					mode: installMode,
-					eveSubagent: subagent
-				});
-			} else if (tempDir && skill.path === tempDir && skill.rawContent) result = await installBlobSkillForAgent({
+			if (tempDir && skill.path === tempDir && skill.rawContent) result = await installBlobSkillForAgent({
 				installName: skill.name,
 				files: [{
 					path: "SKILL.md",
@@ -4156,48 +3878,60 @@ async function runAdd(args, options = {}) {
 		console.log();
 		const successful = results.filter((r) => r.success);
 		const failed = results.filter((r) => !r.success);
-		const skillFiles = {};
-		for (const skill of selectedSkills) if (blobResult && "repoPath" in skill) skillFiles[skill.name] = skill.repoPath;
-		else if (tempDir && skill.path === tempDir) skillFiles[skill.name] = "SKILL.md";
-		else if (tempDir && skill.path.startsWith(tempDir + sep)) skillFiles[skill.name] = skill.path.slice(tempDir.length + 1).split(sep).join("/") + "/SKILL.md";
-		else continue;
+		const skillFiles = buildSkillFiles(selectedSkills, tempDir, blobResult);
 		const normalizedSource = getOwnerRepo(parsed);
 		const lockSource = getLockSource(parsed.url, normalizedSource);
 		if (normalizedSource) if (parseOwnerRepo(normalizedSource)) {
 			const isPrivate = await repoPrivacyPromise;
-			if (isPrivate === false || isPrivate === null && parsed.type !== "github") track({
+			if (isPrivate === false || isPrivate === null && parsed.type !== "github") {
+				console.log("[telemetry-debug-1]", JSON.stringify({
+					isPrivate,
+					parsedType: parsed.type,
+					normalizedSource,
+					sourceType: parsed.type,
+					skillFiles: JSON.stringify(skillFiles)
+				}));
+				track({
+					event: "install",
+					source: normalizedSource,
+					skills: selectedSkills.map((s) => s.name).join(","),
+					agents: targetAgents.join(","),
+					...installGlobally && { global: "1" },
+					skillFiles: JSON.stringify(skillFiles),
+					sourceType: parsed.type
+				});
+			}
+		} else {
+			console.log("[telemetry-debug-2]", JSON.stringify({
+				parsedType: parsed.type,
+				normalizedSource,
+				sourceType: parsed.type,
+				skillFiles: JSON.stringify(skillFiles)
+			}));
+			track({
 				event: "install",
 				source: normalizedSource,
 				skills: selectedSkills.map((s) => s.name).join(","),
 				agents: targetAgents.join(","),
 				...installGlobally && { global: "1" },
-				skillFiles: JSON.stringify(skillFiles)
+				skillFiles: JSON.stringify(skillFiles),
+				sourceType: parsed.type
 			});
-		} else track({
-			event: "install",
-			source: normalizedSource,
-			skills: selectedSkills.map((s) => s.name).join(","),
-			agents: targetAgents.join(","),
-			...installGlobally && { global: "1" },
-			skillFiles: JSON.stringify(skillFiles)
-		});
+		}
 		if (successful.length > 0 && installGlobally && normalizedSource) {
 			const successfulSkillNames = new Set(successful.map((r) => r.skill));
 			let cachedTree;
-			if (parsed.type === "github" && !blobResult) cachedTree = await fetchRepoTree(normalizedSource, parsed.ref, getGitHubToken);
+			if (parsed.type === "github" && true) cachedTree = await fetchRepoTree(normalizedSource, parsed.ref, getGitHubToken);
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
 					let skillFolderHash = "";
 					const skillPathValue = skillFiles[skill.name];
-					if (blobResult && skillPathValue) {
-						const hash = getSkillFolderHashFromTree(blobResult.tree, skillPathValue);
-						if (hash) skillFolderHash = hash;
-					} else if (parsed.type === "github" && skillPathValue && cachedTree) {
+					if (parsed.type === "github" && skillPathValue && cachedTree) {
 						const hash = getSkillFolderHashFromTree(cachedTree, skillPathValue);
 						if (hash) skillFolderHash = hash;
 					} else if (skillPathValue && tempDir) {
-						const hash = await computeSkillFolderHash(join(tempDir, dirname(skillPathValue)));
+						const hash = await computeSkillFolderHash(join$1(tempDir, dirname$1(skillPathValue)));
 						if (hash) skillFolderHash = hash;
 					}
 					await addSkillToLock(skill.name, {
@@ -4219,7 +3953,7 @@ async function runAdd(args, options = {}) {
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					const computedHash = blobResult && "snapshotHash" in skill ? skill.snapshotHash : tempDir && skill.path === tempDir && skill.rawContent ? computeSingleFileSkillHash(skill.rawContent) : await computeSkillFolderHash(skill.path);
+					const computedHash = tempDir && skill.path === tempDir && skill.rawContent ? computeSingleFileSkillHash(skill.rawContent) : await computeSkillFolderHash(skill.path);
 					const skillPathValue = skillFiles[skill.name];
 					await addSkillToLocalLock(skill.name, {
 						source: lockSource || parsed.url,
@@ -4400,18 +4134,300 @@ function parseAddOptions(args) {
 		options
 	};
 }
+const SOURCE_TYPE_PREFIXES = [
+	"github",
+	"gitcode",
+	"gitlab",
+	"gitee"
+];
+function normalizeSkillId(input) {
+	const trimmed = input.trim();
+	const first = trimmed.split("/")[0];
+	if (first && SOURCE_TYPE_PREFIXES.includes(first.toLowerCase())) return trimmed;
+	return `github/${trimmed}`;
+}
+function buildSkillIdFromSource(source, skillName) {
+	const parsed = parseSource(source);
+	if (!SOURCE_TYPE_PREFIXES.includes(parsed.type)) return null;
+	const ownerRepo = getOwnerRepo(parsed);
+	if (!ownerRepo) return null;
+	const slugifiedOwnerRepo = ownerRepo.split("/").map(slugifyTelemetryValue).join("/");
+	const skillPath = slugifyTelemetryValue(skillName);
+	if (!skillPath) return null;
+	return `${parsed.type}/${slugifiedOwnerRepo}/${skillPath}`;
+}
+async function listSkillsByRepo(source) {
+	const parsed = parseSource(source);
+	if (!SOURCE_TYPE_PREFIXES.includes(parsed.type)) return [];
+	const ownerRepo = getOwnerRepo(parsed);
+	if (!ownerRepo) return [];
+	const slugifiedOwnerRepo = ownerRepo.split("/").map(slugifyTelemetryValue).join("/");
+	if (!slugifiedOwnerRepo || slugifiedOwnerRepo.split("/").length < 2) return [];
+	const url = `${LIST_URL}?${new URLSearchParams({
+		source_type: parsed.type,
+		repo: slugifiedOwnerRepo,
+		limit: "100"
+	}).toString()}`;
+	try {
+		const res = await fetch(url);
+		if (!res.ok) return [];
+		const raw = await res.json();
+		return ((raw.data || raw).skills ?? []).filter((skill) => skill && typeof skill.skill_id === "string" && skill.skill_id).map((skill) => ({
+			skill_id: skill.skill_id,
+			name: skill.name ?? "",
+			source_url: skill.source_url ?? ""
+		}));
+	} catch {
+		return [];
+	}
+}
+async function resolveBySearch(source, skillName) {
+	let results = [];
+	try {
+		const params = new URLSearchParams({
+			q: skillName,
+			limit: "10",
+			mode: "text"
+		});
+		const res = await fetch(`${SEARCH_URL}?${params.toString()}`);
+		if (res.ok) {
+			const raw = await res.json();
+			results = (raw.data || raw).results ?? [];
+		}
+	} catch {
+		return null;
+	}
+	const sourceLower = source.trim().toLowerCase();
+	const matches = results.filter((skill) => {
+		const url = (skill.source_url || "").toLowerCase();
+		if (!url) return false;
+		if (url.startsWith(sourceLower)) return true;
+		if (!sourceLower.includes("://") && sourceLower.split("/").length === 2) return url.includes(`/${sourceLower}/`);
+		return false;
+	});
+	const exact = matches.find((skill) => skill.name.toLowerCase() === skillName.trim().toLowerCase());
+	return exact ? exact.skill_id : matches.length > 0 ? matches[0].skill_id : null;
+}
+async function resolveSkillIdBySourceAndName(source, skillName) {
+	const repoSkills = await listSkillsByRepo(source);
+	if (repoSkills.length > 0) {
+		const nameLower = skillName.trim().toLowerCase();
+		const exact = repoSkills.find((skill) => skill.name.toLowerCase() === nameLower);
+		if (exact) return exact.skill_id;
+		const slug = slugifyTelemetryValue(skillName);
+		if (slug) {
+			const bySlug = repoSkills.find((skill) => {
+				return (skill.skill_id.split("/").pop() ?? "").toLowerCase() === slug;
+			});
+			if (bySlug) return bySlug.skill_id;
+		}
+		return null;
+	}
+	return resolveBySearch(source, skillName);
+}
+async function resolveSkillId(source, skillName) {
+	if (!skillName) return {
+		skillId: normalizeSkillId(source),
+		derived: false
+	};
+	const resolved = await resolveSkillIdBySourceAndName(source, skillName);
+	if (resolved) return {
+		skillId: resolved,
+		derived: false
+	};
+	const derived = buildSkillIdFromSource(source, skillName);
+	if (derived) return {
+		skillId: derived,
+		derived: true
+	};
+	return {
+		skillId: null,
+		derived: false
+	};
+}
+function parseAuditOptions(args) {
+	let source = "";
+	let skill = "";
+	const errors = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "-s" || arg === "--skill") {
+			i++;
+			skill = args[i]?.trim() ?? "";
+		} else if (arg && !arg.startsWith("-")) source = arg.trim();
+	}
+	if (!source) errors.push("Missing source or skill id");
+	return {
+		source,
+		skill,
+		errors
+	};
+}
+async function fetchSkillAudit(skillId, timeoutMs = 15e3) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const url = AUDIT_URL.replace("{skill_id}", skillId.split("/").map(encodeURIComponent).join("/"));
+		let response;
+		try {
+			response = await fetch(url, { signal: controller.signal });
+		} catch {
+			return {
+				status: "error",
+				message: `无法连接审计服务: ${AUDIT_URL}`
+			};
+		}
+		if (response.status === 404) return { status: "not_found" };
+		if (!response.ok) return {
+			status: "error",
+			message: `审计服务返回 HTTP ${response.status}`
+		};
+		let data;
+		try {
+			data = await response.json();
+		} catch {
+			return {
+				status: "error",
+				message: "审计服务响应格式无效"
+			};
+		}
+		if (data.error) return {
+			status: "no_audit",
+			message: String(data.error)
+		};
+		const auditData = data.data || data;
+		return {
+			status: "ok",
+			data: {
+				risk_level: auditData.risk_level ?? "unknown",
+				risk_score: auditData.risk_score ?? null,
+				risk_signals: auditData.risk_signals ?? [],
+				audited_at: auditData.audited_at ?? null,
+				audit_type: auditData.audit_type ?? null,
+				details: auditData.details ?? null
+			}
+		};
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+function riskColor(level) {
+	switch (level) {
+		case "critical":
+		case "high": return import_picocolors.default.red;
+		case "medium": return import_picocolors.default.yellow;
+		case "low":
+		case "safe": return import_picocolors.default.green;
+		default: return import_picocolors.default.dim;
+	}
+}
+const RISK_LABELS = {
+	critical: "Critical",
+	high: "High",
+	medium: "Medium",
+	low: "Low",
+	safe: "Safe"
+};
+function riskLabel(level) {
+	const color = riskColor(level);
+	const label = RISK_LABELS[level] || level || "Unknown";
+	return level === "critical" ? color(import_picocolors.default.bold(label)) : color(label);
+}
+function severityColor(severity) {
+	const s = severity.toLowerCase();
+	if (s === "critical" || s === "high") return import_picocolors.default.red(severity);
+	if (s === "medium") return import_picocolors.default.yellow(severity);
+	if (s === "low") return import_picocolors.default.green(severity);
+	return import_picocolors.default.dim(severity);
+}
+function buildAuditOutput(skillId, data) {
+	const lines = [];
+	lines.push(`${import_picocolors.default.bold("Skill:")} ${import_picocolors.default.cyan(skillId)}`);
+	const color = riskColor(data.risk_level);
+	const score = data.risk_score != null ? color(`(score ${data.risk_score})`) : color("(score --)");
+	lines.push(`${import_picocolors.default.bold("Risk:")} ${riskLabel(data.risk_level)} ${score}`);
+	if (data.audited_at) lines.push(`${import_picocolors.default.bold("Audited at:")} ${import_picocolors.default.dim(data.audited_at)}`);
+	lines.push("");
+	if (data.risk_signals.length === 0) {
+		lines.push(import_picocolors.default.green("No risk signals detected."));
+		return lines;
+	}
+	lines.push(import_picocolors.default.bold("Risk signals:"));
+	for (const signal of data.risk_signals) {
+		const severity = severityColor(signal.severity || "unknown");
+		lines.push(`  ${import_picocolors.default.bold(signal.name)}  ${import_picocolors.default.dim(`[${severity}]`)}`);
+		if (signal.description) lines.push(`    ${import_picocolors.default.dim(signal.description)}`);
+	}
+	return lines;
+}
+async function runAudit(args) {
+	const { source, skill, errors } = parseAuditOptions(args);
+	if (errors.length > 0) {
+		for (const error of errors) console.error(import_picocolors.default.red(error));
+		console.error("Usage: wittyhub audit <source> --skill <skill>");
+		console.error("       wittyhub audit <skill_id>");
+		return;
+	}
+	const { skillId, derived } = await resolveSkillId(source, skill || void 0);
+	if (!skillId) {
+		console.error(import_picocolors.default.red(`Unable to resolve skill id from source: ${source}`));
+		console.error("Usage: wittyhub audit <source> --skill <skill>");
+		return;
+	}
+	if (derived) console.error(import_picocolors.default.yellow(`Could not locate skill in repo; trying derived id: ${skillId}`));
+	const result = await fetchSkillAudit(skillId);
+	track({
+		event: "audit",
+		skillId,
+		found: result.status === "ok" ? "1" : "0"
+	});
+	switch (result.status) {
+		case "ok":
+			for (const line of buildAuditOutput(skillId, result.data)) console.log(line);
+			break;
+		case "no_audit":
+			console.log(`${import_picocolors.default.yellow("No audit result yet.")} ${import_picocolors.default.dim(result.message)}`);
+			break;
+		case "not_found":
+			console.error(import_picocolors.default.red(`Skill not found: ${skillId}`));
+			break;
+		case "error":
+			console.error(import_picocolors.default.red(result.message));
+			break;
+	}
+}
 const RESET$3 = "\x1B[0m";
 const BOLD$3 = "\x1B[1m";
 const DIM$3 = "\x1B[38;5;102m";
 const TEXT$2 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
-const SEARCH_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
-function formatInstalls(count) {
-	if (!count || count <= 0) return "";
+const MAGENTA = "\x1B[35m";
+const YELLOW$1 = "\x1B[33m";
+const RED = "\x1B[31m";
+const GREEN = "\x1B[32m";
+function formatInstalls$1(count) {
+	if (count === void 0 || count === null || Number.isNaN(count)) return "";
+	if (count <= 0) return "0 installs";
 	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
 	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K installs`;
 	return `${count} install${count === 1 ? "" : "s"}`;
 }
+function formatRiskLevel$1(riskScore) {
+	if (riskScore === void 0 || riskScore === null) return "";
+	if (riskScore <= 20) return `${GREEN}safe risk${RESET$3}`;
+	if (riskScore <= 50) return `${GREEN}low risk${RESET$3}`;
+	if (riskScore <= 80) return `${YELLOW$1}medium risk${RESET$3}`;
+	return `${RED}high risk${RESET$3}`;
+}
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function highlightMatches(text, query) {
+	if (!text || !query) return text;
+	const terms = query.trim().split(/\s+/).filter(Boolean).map(escapeRegExp);
+	if (terms.length === 0) return text;
+	return text.replace(new RegExp(`(${terms.join("|")})`, "gi"), `${MAGENTA}$1${RESET$3}`);
+}
 const GITHUB_OWNER_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,38})$/i;
 function parseFindOptions(args) {
 	const queryParts = [];
@@ -4424,7 +4440,7 @@ function parseFindOptions(args) {
 		if (arg === "--owner") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) {
-				errors.push("--owner requires a GitHub owner");
+				errors.push("--owner requires an owner");
 				continue;
 			}
 			ownerValue = value;
@@ -4432,7 +4448,7 @@ function parseFindOptions(args) {
 		} else if (arg.startsWith("--owner=")) {
 			ownerValue = arg.slice(8);
 			if (!ownerValue) {
-				errors.push("--owner requires a GitHub owner");
+				errors.push("--owner requires an owner");
 				continue;
 			}
 		} else {
@@ -4441,7 +4457,7 @@ function parseFindOptions(args) {
 		}
 		const owner = ownerValue.trim().toLowerCase();
 		if (!GITHUB_OWNER_PATTERN.test(owner)) {
-			errors.push("--owner must be a valid GitHub owner");
+			errors.push("--owner must be a valid owner");
 			continue;
 		}
 		options.owner = owner;
@@ -4453,24 +4469,52 @@ function parseFindOptions(args) {
 	};
 }
 async function searchSkillsAPI(query, owner) {
+	const url = `${SEARCH_URL}?${new URLSearchParams({
+		q: query,
+		limit: "10",
+		mode: "text"
+	}).toString()}`;
+	let res;
 	try {
-		const params = new URLSearchParams({
-			q: query,
-			limit: "10"
-		});
-		if (owner) params.set("owner", owner);
-		const url = `${SEARCH_API_BASE}/api/search?${params.toString()}`;
-		const res = await fetch(url);
-		if (!res.ok) return [];
-		return (await res.json()).skills.map((skill) => ({
-			name: sanitizeMetadata(skill.name),
-			slug: sanitizeMetadata(skill.id),
-			source: sanitizeMetadata(skill.source || ""),
-			installs: skill.installs
-		})).sort((a, b) => (b.installs || 0) - (a.installs || 0));
+		res = await fetch(url);
 	} catch {
-		return [];
+		return {
+			skills: [],
+			error: `无法连接搜索服务: ${SEARCH_URL}`
+		};
+	}
+	if (!res.ok) return {
+		skills: [],
+		error: `搜索服务返回 HTTP ${res.status}`
+	};
+	let data;
+	try {
+		data = await res.json();
+	} catch {
+		return {
+			skills: [],
+			error: "搜索服务响应格式无效"
+		};
 	}
+	let skills = (data.data?.results ?? data.results ?? []).map((skill) => ({
+		name: sanitizeMetadata(skill.name),
+		slug: sanitizeMetadata(skill.skill_id),
+		source: sanitizeMetadata(skill.source || ""),
+		installs: skill.download_count || 0,
+		description: skill.description ? sanitizeMetadata(skill.description) : void 0,
+		riskScore: skill.risk_score ?? void 0,
+		sourceUrl: skill.source_url ? sanitizeMetadata(skill.source_url) : void 0
+	}));
+	if (owner) {
+		const ownerLower = owner.toLowerCase();
+		skills = skills.filter((skill) => {
+			if (skill.sourceUrl) try {
+				if (new URL(skill.sourceUrl).pathname.split("/").filter(Boolean)[0]?.toLowerCase() === ownerLower) return true;
+			} catch {}
+			return skill.slug.toLowerCase().includes(`/${ownerLower}/`);
+		});
+	}
+	return { skills: skills.sort((a, b) => (b.installs || 0) - (a.installs || 0)) };
 }
 const HIDE_CURSOR = "\x1B[?25l";
 const SHOW_CURSOR = "\x1B[?25h";
@@ -4482,6 +4526,7 @@ async function runSearchPrompt(initialQuery = "", owner) {
 	let selectedIndex = 0;
 	let query = initialQuery;
 	let loading = false;
+	let searchError = null;
 	let debounceTimer = null;
 	let lastRenderedLines = 0;
 	if (process.stdin.isTTY) process.stdin.setRawMode(true);
@@ -4497,6 +4542,7 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		lines.push("");
 		if (!query || query.length < 2) lines.push(`${DIM$3}Start typing to search (min 2 chars)${RESET$3}`);
 		else if (results.length === 0 && loading) lines.push(`${DIM$3}Searching...${RESET$3}`);
+		else if (results.length === 0 && searchError) lines.push(`${RED}${searchError}${RESET$3}`);
 		else if (results.length === 0) lines.push(`${DIM$3}No skills found${RESET$3}`);
 		else {
 			const visible = results.slice(0, 8);
@@ -4504,12 +4550,23 @@ async function runSearchPrompt(initialQuery = "", owner) {
 				const skill = visible[i];
 				const isSelected = i === selectedIndex;
 				const arrow = isSelected ? `${BOLD$3}>${RESET$3}` : " ";
-				const name = isSelected ? `${BOLD$3}${skill.name}${RESET$3}` : `${TEXT$2}${skill.name}${RESET$3}`;
+				const hlName = highlightMatches(skill.name, query);
+				const name = isSelected ? `${BOLD$3}${hlName}${RESET$3}` : `${TEXT$2}${hlName}${RESET$3}`;
 				const source = skill.source ? ` ${DIM$3}${skill.source}${RESET$3}` : "";
-				const installs = formatInstalls(skill.installs);
+				const installs = formatInstalls$1(skill.installs);
 				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$3}` : "";
+				const risk = formatRiskLevel$1(skill.riskScore);
+				const riskBadge = risk ? ` ${risk}` : "";
 				const loadingIndicator = loading && i === 0 ? ` ${DIM$3}...${RESET$3}` : "";
-				lines.push(`  ${arrow} ${name}${source}${installsBadge}${loadingIndicator}`);
+				lines.push(`  ${arrow} ${name}${source}${loadingIndicator}`);
+				if (installsBadge || riskBadge) {
+					const meta = [installsBadge.trimStart(), riskBadge.trimStart()].filter(Boolean).join(" ");
+					lines.push(`    ${meta}`);
+				}
+				if (skill.description) {
+					const descPlain = skill.description.length > 80 ? `${skill.description.slice(0, 77)}...` : skill.description;
+					lines.push(`    ${DIM$3}${highlightMatches(descPlain, query)}${RESET$3}`);
+				}
 			}
 		}
 		lines.push("");
@@ -4525,6 +4582,7 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		loading = false;
 		if (!q || q.length < 2) {
 			results = [];
+			searchError = null;
 			selectedIndex = 0;
 			render();
 			return;
@@ -4534,10 +4592,13 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		const debounceMs = Math.max(150, 350 - q.length * 50);
 		debounceTimer = setTimeout(async () => {
 			try {
-				results = await searchSkillsAPI(q, owner);
+				const result = await searchSkillsAPI(q, owner);
+				results = result.skills;
+				searchError = result.error ?? null;
 				selectedIndex = 0;
 			} catch {
 				results = [];
+				searchError = null;
 			} finally {
 				loading = false;
 				debounceTimer = null;
@@ -4596,10 +4657,26 @@ async function runSearchPrompt(initialQuery = "", owner) {
 }
 function getOwnerRepoFromString(pkg) {
 	const atIndex = pkg.lastIndexOf("@");
-	const match = (atIndex > 0 ? pkg.slice(0, atIndex) : pkg).match(/^([^/]+)\/([^/]+)$/);
-	if (match) return {
-		owner: match[1],
-		repo: match[2]
+	const repoPath = atIndex > 0 ? pkg.slice(0, atIndex) : pkg;
+	const urlMatch = repoPath.match(/^https?:\/\/[^/]+\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+	if (urlMatch) return {
+		owner: urlMatch[1],
+		repo: urlMatch[2]
+	};
+	const blobMatch = repoPath.match(/^https?:\/\/[^/]+\/([^/]+)\/([^/]+?)\/blob\//);
+	if (blobMatch) return {
+		owner: blobMatch[1],
+		repo: blobMatch[2]
+	};
+	const shorthandMatch = repoPath.match(/^([^/]+)\/([^/]+)$/);
+	if (shorthandMatch) return {
+		owner: shorthandMatch[1],
+		repo: shorthandMatch[2]
+	};
+	const slugMatch = repoPath.match(/^[^/]+\/([^/]+)\/([^/]+)/);
+	if (slugMatch) return {
+		owner: slugMatch[1],
+		repo: slugMatch[2]
 	};
 	return null;
 }
@@ -4619,24 +4696,41 @@ ${DIM$3}  2) npx wittyhub add <owner/repo@skill>${RESET$3}`;
 		return;
 	}
 	if (query) {
-		const results = await searchSkillsAPI(query, owner);
+		const { skills: results, error: searchError } = await searchSkillsAPI(query, owner);
 		track({
 			event: "find",
 			query,
 			resultCount: String(results.length)
 		});
+		if (searchError) {
+			console.error(`${RED}${searchError}${RESET$3}`);
+			return;
+		}
 		if (results.length === 0) {
 			const ownerSuffix = owner ? ` from owner "${owner}"` : "";
 			console.log(`${DIM$3}No skills found for "${query}"${ownerSuffix}${RESET$3}`);
 			return;
 		}
-		console.log(`${DIM$3}Install with${RESET$3} npx wittyhub add <owner/repo@skill>`);
+		console.log(`${DIM$3}Install with${RESET$3} npx wittyhub add <repo-url> --skill <skill>`);
 		console.log();
 		for (const skill of results.slice(0, 6)) {
-			const pkg = skill.source || skill.slug;
-			const installs = formatInstalls(skill.installs);
-			console.log(`${TEXT$2}${pkg}@${skill.name}${RESET$3}${installs ? ` ${CYAN$1}${installs}${RESET$3}` : ""}`);
-			console.log(`${DIM$3}└ https://skills.sh/${skill.slug}${RESET$3}`);
+			const raw = skill.sourceUrl || skill.source || skill.slug;
+			const hlName = highlightMatches(skill.name, query);
+			const installTarget = skill.sourceUrl ? `${skill.sourceUrl} --skill ${hlName}` : `${raw}@${hlName}`;
+			const installs = formatInstalls$1(skill.installs);
+			const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$3}` : "";
+			const risk = formatRiskLevel$1(skill.riskScore);
+			const riskBadge = risk ? ` ${risk}` : "";
+			console.log(`${TEXT$2}${installTarget}${RESET$3}`);
+			if (installsBadge || riskBadge) {
+				const meta = [installsBadge.trimStart(), riskBadge.trimStart()].filter(Boolean).join(" ");
+				console.log(`  ${meta}`);
+			}
+			if (skill.description) {
+				const descPlain = skill.description.length > 100 ? `${skill.description.slice(0, 97)}...` : skill.description;
+				console.log(`${DIM$3}  ${highlightMatches(descPlain, query)}${RESET$3}`);
+			}
+			console.log(`${DIM$3}└ ${skill.sourceUrl || `https://skills.sh/${skill.slug}`}${RESET$3}`);
 			console.log();
 		}
 		return;
@@ -4659,7 +4753,7 @@ ${DIM$3}  2) npx wittyhub add <owner/repo@skill>${RESET$3}`;
 		console.log();
 		return;
 	}
-	const pkg = selected.source || selected.slug;
+	const pkg = selected.sourceUrl || selected.source || selected.slug;
 	const skillName = selected.name;
 	console.log();
 	console.log(`${TEXT$2}Installing ${BOLD$3}${skillName}${RESET$3} from ${DIM$3}${pkg}${RESET$3}...`);
@@ -4676,9 +4770,156 @@ ${DIM$3}  2) npx wittyhub add <owner/repo@skill>${RESET$3}`;
 	else console.log(`${DIM$3}Discover more skills at${RESET$3} ${TEXT$2}https://skills.sh${RESET$3}`);
 	console.log();
 }
+function parseGetOptions(args) {
+	let source = "";
+	let skill = "";
+	const errors = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "-s" || arg === "--skill") {
+			i++;
+			skill = args[i]?.trim() ?? "";
+		} else if (arg && !arg.startsWith("-")) source = arg.trim();
+	}
+	if (!source) errors.push("Missing source or skill id");
+	return {
+		source,
+		skill,
+		errors
+	};
+}
+async function fetchSkillDetail(skillId, timeoutMs = 15e3) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const url = GET_URL.replace("{skill_id}", skillId.split("/").map(encodeURIComponent).join("/"));
+		let response;
+		try {
+			response = await fetch(url, { signal: controller.signal });
+		} catch {
+			return {
+				status: "error",
+				message: `无法连接详情服务: ${GET_URL}`
+			};
+		}
+		if (response.status === 404) return { status: "not_found" };
+		if (!response.ok) return {
+			status: "error",
+			message: `详情服务返回 HTTP ${response.status}`
+		};
+		let data;
+		try {
+			data = await response.json();
+		} catch {
+			return {
+				status: "error",
+				message: "详情服务响应格式无效"
+			};
+		}
+		if (data.error) return {
+			status: "error",
+			message: String(data.error)
+		};
+		const skillData = data.data || data;
+		return {
+			status: "ok",
+			data: {
+				skill_id: skillData.skill_id ?? skillId,
+				name: skillData.name ?? "",
+				description: skillData.description ?? null,
+				version: skillData.version ?? null,
+				commit_id: skillData.commit_id ?? null,
+				author: skillData.author ?? null,
+				source: skillData.source ?? "",
+				source_url: skillData.source_url ?? "",
+				repo_url: skillData.repo_url ?? null,
+				category: skillData.category ?? null,
+				tags: Array.isArray(skillData.tags) ? skillData.tags : null,
+				platform: skillData.platform ?? null,
+				metadata: skillData.metadata ?? null,
+				risk_score: skillData.risk_score ?? null,
+				download_count: skillData.download_count ?? 0,
+				period_downloads: skillData.period_downloads ?? null,
+				rating: skillData.rating ?? null,
+				created_at: skillData.created_at ?? null,
+				updated_at: skillData.updated_at ?? null,
+				last_indexed_at: skillData.last_indexed_at ?? null
+			}
+		};
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+function formatInstalls(count) {
+	if (count === void 0 || count === null || Number.isNaN(count)) return "0 installs";
+	if (count <= 0) return "0 installs";
+	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
+	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K installs`;
+	return `${count} install${count === 1 ? "" : "s"}`;
+}
+function formatRiskLevel(riskScore) {
+	if (riskScore === void 0 || riskScore === null) return import_picocolors.default.dim("unknown risk");
+	if (riskScore <= 20) return import_picocolors.default.green("safe risk");
+	if (riskScore <= 50) return import_picocolors.default.green("low risk");
+	if (riskScore <= 80) return import_picocolors.default.yellow("medium risk");
+	return import_picocolors.default.red("high risk");
+}
+function buildGetOutput(data) {
+	const lines = [];
+	lines.push(`${import_picocolors.default.bold("Skill:")} ${import_picocolors.default.cyan(data.skill_id)}`);
+	if (data.name) lines.push(`${import_picocolors.default.bold("Name:")} ${data.name}`);
+	if (data.description) lines.push(`${import_picocolors.default.bold("Description:")} ${data.description}`);
+	if (data.author) lines.push(`${import_picocolors.default.bold("Author:")} ${data.author}`);
+	if (data.category) lines.push(`${import_picocolors.default.bold("Category:")} ${data.category}`);
+	if (data.version) lines.push(`${import_picocolors.default.bold("Version:")} ${data.version}`);
+	if (data.tags && data.tags.length > 0) lines.push(`${import_picocolors.default.bold("Tags:")} ${data.tags.join(", ")}`);
+	if (data.platform) lines.push(`${import_picocolors.default.bold("Platform:")} ${data.platform}`);
+	if (data.source) lines.push(`${import_picocolors.default.bold("Source:")} ${data.source}`);
+	if (data.source_url) lines.push(`${import_picocolors.default.bold("Source URL:")} ${import_picocolors.default.dim(data.source_url)}`);
+	if (data.repo_url) lines.push(`${import_picocolors.default.bold("Repo URL:")} ${import_picocolors.default.dim(data.repo_url)}`);
+	lines.push(`${import_picocolors.default.bold("Installs:")} ${import_picocolors.default.cyan(formatInstalls(data.download_count))}`);
+	const riskLabel = formatRiskLevel(data.risk_score);
+	const score = data.risk_score === void 0 || data.risk_score === null ? "" : import_picocolors.default.dim(` (score ${data.risk_score})`);
+	lines.push(`${import_picocolors.default.bold("Risk:")} ${riskLabel}${score}`);
+	if (data.updated_at) lines.push(`${import_picocolors.default.bold("Updated at:")} ${import_picocolors.default.dim(data.updated_at)}`);
+	return lines;
+}
+async function runGet(args) {
+	const { source, skill, errors } = parseGetOptions(args);
+	if (errors.length > 0) {
+		for (const error of errors) console.error(import_picocolors.default.red(error));
+		console.error("Usage: wittyhub get <source> --skill <skill>");
+		console.error("       wittyhub get <skill_id>");
+		return;
+	}
+	const { skillId, derived } = await resolveSkillId(source, skill || void 0);
+	if (!skillId) {
+		console.error(import_picocolors.default.red(`Unable to resolve skill id from source: ${source}`));
+		console.error("Usage: wittyhub get <source> --skill <skill>");
+		return;
+	}
+	if (derived) console.error(import_picocolors.default.yellow(`Could not locate skill in repo; trying derived id: ${skillId}`));
+	const result = await fetchSkillDetail(skillId);
+	track({
+		event: "get",
+		skillId,
+		found: result.status === "ok" ? "1" : "0"
+	});
+	switch (result.status) {
+		case "ok":
+			for (const line of buildGetOutput(result.data)) console.log(line);
+			break;
+		case "not_found":
+			console.error(import_picocolors.default.red(`Skill not found: ${skillId}`));
+			break;
+		case "error":
+			console.error(import_picocolors.default.red(result.message));
+			break;
+	}
+}
 const isCancelled = (value) => typeof value === "symbol";
 function shortenPath$1(fullPath, cwd) {
-	const home = homedir();
+	const home = homedir$1();
 	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
 	if (fullPath === cwd || fullPath.startsWith(cwd + sep)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
@@ -5033,7 +5274,7 @@ const DIM$2 = "\x1B[38;5;102m";
 const CYAN = "\x1B[36m";
 const YELLOW = "\x1B[33m";
 function shortenPath(fullPath, cwd) {
-	const home = homedir();
+	const home = homedir$1();
 	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
 	if (fullPath.startsWith(cwd)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
@@ -5270,7 +5511,7 @@ async function removeCommand(skillNames, options) {
 			for (const pathToCleanup of pathsToCleanup) {
 				if (pathToCleanup === canonicalPath) continue;
 				try {
-					if (await lstat(pathToCleanup).catch(() => null)) await rm(pathToCleanup, {
+					if (await lstat(pathToCleanup).catch(() => null)) await rm$1(pathToCleanup, {
 						recursive: true,
 						force: true
 					});
@@ -5288,7 +5529,7 @@ async function removeCommand(skillNames, options) {
 			isStillUsed = true;
 			break;
 		}
-		if (!isStillUsed) await rm(canonicalPath, {
+		if (!isStillUsed) await rm$1(canonicalPath, {
 			recursive: true,
 			force: true
 		});
@@ -5936,7 +6177,7 @@ function buildUsePrompt(input) {
 	return sections.join("\n\n") + "\n";
 }
 async function materializeUseSkill(skill) {
-	const tempRoot = await mkdtemp(join(tmpdir(), "skills-use-"));
+	const tempRoot = await mkdtemp$1(join(tmpdir$1(), "skills-use-"));
 	const skillDir = join(tempRoot, sanitizeName(skill.directoryName || skill.name));
 	if (!isPathSafe(tempRoot, skillDir)) throw new Error("Invalid skill name: potential path traversal detected");
 	await mkdir(skillDir, { recursive: true });
@@ -6163,8 +6404,8 @@ async function writeSafeFile(targetDir, filePath, contents) {
 	const fullPath = join(targetDir, filePath);
 	if (!isPathSafe(targetDir, fullPath)) return;
 	await mkdir(dirname(fullPath), { recursive: true });
-	if (typeof contents === "string") await writeFile(fullPath, contents, "utf-8");
-	else await writeFile(fullPath, contents);
+	if (typeof contents === "string") await writeFile$1(fullPath, contents, "utf-8");
+	else await writeFile$1(fullPath, contents);
 }
 async function copySkillDirectory(src, dest) {
 	await mkdir(dest, { recursive: true });
@@ -6224,6 +6465,308 @@ function fail(message) {
 	process.exit(1);
 }
 var UseCommandError = class extends Error {};
+const CANONICAL_CATEGORIES = new Set([
+	"Research and Design",
+	"Development and Build",
+	"Engineering and Compilation",
+	"Quality and Validation",
+	"Release and Deployment",
+	"Monitoring and Operations",
+	"Performance Optimization",
+	"Security Hardening",
+	"others"
+]);
+const NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[\w.]+)?(?:\+[\w.]+)?$/;
+function parseValidateOptions(args) {
+	let path = "";
+	const options = {};
+	const errors = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--json") options.json = true;
+		else if (arg === "-h" || arg === "--help") {} else if (arg && !arg.startsWith("-")) if (!path) path = arg.trim();
+		else errors.push(`Unexpected argument: ${arg}`);
+		else if (arg) errors.push(`Unknown option: ${arg}`);
+	}
+	if (!path) errors.push("Missing required argument: <path>");
+	return {
+		path,
+		options,
+		errors
+	};
+}
+async function runValidate(args) {
+	const { path, options, errors } = parseValidateOptions(args);
+	if (errors.length > 0) {
+		for (const e of errors) console.error(import_picocolors.default.red(`error: ${e}`));
+		console.error(`\nRun ${import_picocolors.default.cyan("wittyhub validate --help")} for usage.\n`);
+		return null;
+	}
+	const result = await validateSkill(resolve(path));
+	if (options.json) console.log(JSON.stringify(result, null, 2));
+	else printResult(result);
+	return result;
+}
+async function validateSkill(absPath) {
+	const errors = [];
+	const warnings = [];
+	let skillDir = absPath;
+	let skillMdPath = null;
+	let stats;
+	try {
+		stats = await stat(absPath);
+	} catch {
+		errors.push({
+			id: "path-not-found",
+			severity: "error",
+			message: `Path does not exist: ${absPath}`,
+			hint: "Pass the skill directory (e.g. ./my-skill) or the SKILL.md file path."
+		});
+		return {
+			path: absPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	if (stats.isFile()) {
+		const filename = basename(absPath);
+		if (filename !== "SKILL.md") {
+			errors.push({
+				id: "filename-must-be-skill-md",
+				severity: "error",
+				message: `File must be named "SKILL.md" (got "${filename}")`,
+				hint: "Rename the file to SKILL.md (uppercase). The agent skill spec requires this exact filename."
+			});
+			return {
+				path: absPath,
+				errors,
+				warnings,
+				ok: false
+			};
+		}
+		skillMdPath = absPath;
+		skillDir = dirname(absPath);
+	} else if (stats.isDirectory()) {
+		const expected = join(absPath, "SKILL.md");
+		try {
+			await stat(expected);
+			skillMdPath = expected;
+		} catch {
+			errors.push({
+				id: "missing-skill-md",
+				severity: "error",
+				message: `No SKILL.md found in directory: ${absPath}`,
+				hint: "Create one with `wittyhub init <name>` or rename an existing markdown file to SKILL.md (uppercase)."
+			});
+			return {
+				path: absPath,
+				errors,
+				warnings,
+				ok: false
+			};
+		}
+	} else {
+		errors.push({
+			id: "path-invalid-type",
+			severity: "error",
+			message: `Path is neither a file nor a directory: ${absPath}`
+		});
+		return {
+			path: absPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	try {
+		const lowerMdFile = (await readdir(skillDir)).find((e) => e.toLowerCase() === "skill.md" && e !== "SKILL.md");
+		if (lowerMdFile) warnings.push({
+			id: "case-variant-found",
+			severity: "warning",
+			message: `Found a case-variant file "${lowerMdFile}" alongside SKILL.md`,
+			hint: "Only \"SKILL.md\" (all uppercase) is recognized by the agent spec. Remove the variant to avoid confusion."
+		});
+	} catch {}
+	const content = await readFile(skillMdPath, "utf-8");
+	const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+	if (!match) {
+		errors.push({
+			id: "frontmatter-missing",
+			severity: "error",
+			message: "SKILL.md must start with a YAML frontmatter block delimited by \"---\"",
+			hint: "Add a frontmatter block at the top:\n\n  ---\n  name: my-skill\n  description: what it does\n  ---"
+		});
+		return {
+			path: skillMdPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	match[1];
+	const body = match[2] ?? "";
+	const { data: fm } = parseFrontmatter(content);
+	if (!fm || typeof fm !== "object" || Array.isArray(fm)) {
+		errors.push({
+			id: "frontmatter-not-object",
+			severity: "error",
+			message: "Frontmatter must be a YAML mapping (key-value pairs), not a scalar or list."
+		});
+		return {
+			path: skillMdPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	if (fm.name === void 0 || fm.name === null || fm.name === "") errors.push({
+		id: "name-required",
+		severity: "error",
+		message: "Missing required frontmatter field: name",
+		hint: "Add `name: <skill-name>` to the frontmatter."
+	});
+	else if (typeof fm.name !== "string") errors.push({
+		id: "name-not-string",
+		severity: "error",
+		message: `Frontmatter field "name" must be a string (got ${typeof fm.name})`,
+		hint: "Wrap the value in quotes if it contains special characters."
+	});
+	else {
+		if (!NAME_PATTERN.test(fm.name)) warnings.push({
+			id: "name-not-kebab",
+			severity: "warning",
+			message: `Skill name "${fm.name}" is not in kebab-case (lowercase letters, digits, hyphens)`,
+			hint: "Use a name like \"add-or-fix-type-checking\" for best compatibility."
+		});
+		if (basename(skillDir) !== fm.name) warnings.push({
+			id: "name-dirname-mismatch",
+			severity: "warning",
+			message: `Skill name "${fm.name}" does not match directory name "${basename(skillDir)}"`,
+			hint: "For consistency, the directory name and `name` field should match."
+		});
+	}
+	if (fm.description === void 0 || fm.description === null || fm.description === "") errors.push({
+		id: "description-required",
+		severity: "error",
+		message: "Missing required frontmatter field: description",
+		hint: "Add `description: <one-line summary>` to the frontmatter."
+	});
+	else if (typeof fm.description !== "string") errors.push({
+		id: "description-not-string",
+		severity: "error",
+		message: `Frontmatter field "description" must be a string (got ${typeof fm.description})`
+	});
+	else {
+		const desc = fm.description.trim();
+		if (desc.length < 10) warnings.push({
+			id: "description-too-short",
+			severity: "warning",
+			message: `Description is very short (${desc.length} chars): "${desc}"`,
+			hint: "Aim for at least 10-20 characters so users can quickly understand the skill."
+		});
+		if (desc.length > 200) warnings.push({
+			id: "description-too-long",
+			severity: "warning",
+			message: `Description is very long (${desc.length} chars)`,
+			hint: "Keep it under 200 characters for readability in listings."
+		});
+	}
+	if (fm.category !== void 0 && fm.category !== null) {
+		if (typeof fm.category !== "string") warnings.push({
+			id: "category-not-string",
+			severity: "warning",
+			message: `Frontmatter field "category" should be a string (got ${typeof fm.category})`
+		});
+		else if (!CANONICAL_CATEGORIES.has(fm.category)) warnings.push({
+			id: "category-not-canonical",
+			severity: "warning",
+			message: `Category "${fm.category}" is not in the canonical list`,
+			hint: `Valid values: ${[...CANONICAL_CATEGORIES].join(", ")}. See https://gitcode.com/openeuler/openEuler-skills.`
+		});
+	}
+	if (fm.version !== void 0 && fm.version !== null && fm.version !== "") {
+		if (typeof fm.version !== "string") warnings.push({
+			id: "version-not-string",
+			severity: "warning",
+			message: `Frontmatter field "version" should be a string (got ${typeof fm.version})`,
+			hint: "Quote the value, e.g. `version: \"1.0.0\"`."
+		});
+		else if (!SEMVER_PATTERN.test(fm.version.trim())) warnings.push({
+			id: "version-not-semver",
+			severity: "warning",
+			message: `Version "${fm.version}" is not a valid semver`,
+			hint: "Use the form X.Y.Z (e.g. 1.0.0, 0.2.1-beta)."
+		});
+	}
+	if (fm.metadata !== void 0 && (typeof fm.metadata !== "object" || Array.isArray(fm.metadata))) warnings.push({
+		id: "metadata-not-object",
+		severity: "warning",
+		message: `Frontmatter field "metadata" should be a mapping (got ${Array.isArray(fm.metadata) ? "array" : typeof fm.metadata})`
+	});
+	if (body.trim().length === 0) warnings.push({
+		id: "body-empty",
+		severity: "warning",
+		message: "SKILL.md has no body content after the frontmatter",
+		hint: "Add at least a heading and a few instructions for the agent to follow."
+	});
+	else if (!/^#{1,6}\s+\S/m.test(body)) warnings.push({
+		id: "body-no-heading",
+		severity: "warning",
+		message: "Body content has no Markdown headings",
+		hint: "Structure the instructions with headings like `## When to use`, `## Instructions`."
+	});
+	const knownKeys = new Set([
+		"name",
+		"description",
+		"version",
+		"category",
+		"metadata"
+	]);
+	const unknownKeys = Object.keys(fm).filter((k) => !knownKeys.has(k));
+	if (unknownKeys.length > 0) warnings.push({
+		id: "unknown-frontmatter-keys",
+		severity: "warning",
+		message: `Unknown frontmatter keys: ${unknownKeys.join(", ")}`,
+		hint: `Recognized keys: ${[...knownKeys].join(", ")}.`
+	});
+	return {
+		path: skillMdPath,
+		errors,
+		warnings,
+		ok: errors.length === 0
+	};
+}
+function printResult(result) {
+	const { path, errors, warnings, ok } = result;
+	console.log(`${import_picocolors.default.cyan("Path:")} ${path}`);
+	console.log();
+	if (errors.length === 0 && warnings.length === 0) {
+		console.log(import_picocolors.default.green("  All checks passed."));
+		console.log();
+		return;
+	}
+	if (errors.length > 0) {
+		console.log(import_picocolors.default.red(`${errors.length} error(s):`));
+		for (const rule of errors) {
+			console.log(`  ${import_picocolors.default.red("✗")} [${rule.id}] ${rule.message}`);
+			if (rule.hint) console.log(`    ${import_picocolors.default.dim(rule.hint)}`);
+		}
+		console.log();
+	}
+	if (warnings.length > 0) {
+		console.log(import_picocolors.default.yellow(`${warnings.length} warning(s):`));
+		for (const rule of warnings) {
+			console.log(`  ${import_picocolors.default.yellow("!")} [${rule.id}] ${rule.message}`);
+			if (rule.hint) console.log(`    ${import_picocolors.default.dim(rule.hint)}`);
+		}
+		console.log();
+	}
+	if (ok) console.log(import_picocolors.default.green("  Skill is valid.") + import_picocolors.default.yellow(warnings.length > 0 ? ` (with ${warnings.length} warning${warnings.length > 1 ? "s" : ""})` : ""));
+	else console.log(import_picocolors.default.red("  Skill is NOT valid. Fix the errors above."));
+	console.log();
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
 	try {
@@ -6276,11 +6819,12 @@ function showBanner() {
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub experimental_install${RESET} ${DIM}Restore from skills-lock.json${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub init ${DIM}[name]${RESET}          ${DIM}Create a new skill${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub validate ${DIM}<path>${RESET}   ${DIM}Validate a local skill${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub experimental_sync${RESET}    ${DIM}Sync skills from node_modules${RESET}`);
 	console.log();
 	console.log(`${DIM}try:${RESET} npx wittyhub add vercel-labs/agent-skills`);
 	console.log();
-	console.log(`Discover more skills at ${TEXT}https://skills.sh/${RESET}`);
+	console.log(`Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}`);
 	console.log();
 }
 function showHelp() {
@@ -6296,6 +6840,14 @@ ${BOLD}Manage Skills:${RESET}
   remove [skills]      Remove installed skills
   list, ls             List installed skills
   find [query]         Search for skills interactively
+  audit <source> --skill <skill>
+                       Show security audit result (risk level + risk signals)
+                       e.g. audit https://github.com/huggingface/transformers --skill add-or-fix-type-checking
+  get <source> --skill <skill>
+                       View skill details (author/category/version/description/tags)
+                       e.g. get https://github.com/huggingface/transformers --skill add-or-fix-type-checking
+  validate <path>     Validate a local skill for spec compliance (SKILL.md filename,
+                       frontmatter, required fields name/description, etc.)
 
 ${BOLD}Find Options:${RESET}
   --owner <owner>        Search only repositories from a GitHub owner
@@ -6310,7 +6862,7 @@ ${BOLD}Update Options:${RESET}
 
 ${BOLD}Project:${RESET}
   experimental_install Restore skills from skills-lock.json
-  init [name]          Initialize a skill (creates <name>/SKILL.md or ./SKILL.md)
+  init [name]          Initialize a skill (creates <name>/SKILL.md; defaults to my-skill/)
   experimental_sync    Sync skills from node_modules into agent directories
 
 ${BOLD}Add Options:${RESET}
@@ -6352,12 +6904,9 @@ ${BOLD}Options:${RESET}
   --version, -v     Show version number
 
 ${BOLD}Examples:${RESET}
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills
-  ${DIM}$${RESET} wittyhub use vercel-labs/agent-skills@vercel-optimize | claude
-  ${DIM}$${RESET} wittyhub use vercel-labs/agent-skills --skill vercel-optimize --agent claude-code
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills -g
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills --agent claude-code cursor
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills --skill pr-review commit
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis -g
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis --agent claude-code cursor
   ${DIM}$${RESET} wittyhub remove                        ${DIM}# interactive remove${RESET}
   ${DIM}$${RESET} wittyhub remove web-design             ${DIM}# remove by name${RESET}
   ${DIM}$${RESET} wittyhub rm --global frontend-design
@@ -6376,7 +6925,45 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} wittyhub experimental_sync              ${DIM}# sync from node_modules${RESET}
   ${DIM}$${RESET} wittyhub experimental_sync -y           ${DIM}# sync without prompts${RESET}
 
-Discover more skills at ${TEXT}https://skills.sh/${RESET}
+Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}
+`);
+}
+function showInitHelp() {
+	console.log(`
+${BOLD}Usage:${RESET} wittyhub init [name]
+
+${BOLD}Description:${RESET}
+  Initialize a new skill by creating a SKILL.md template.
+
+${BOLD}Arguments:${RESET}
+  name              Optional skill name. Creates <name>/SKILL.md.
+                    If omitted, defaults to my-skill/ (never the cwd itself).
+
+${BOLD}Examples:${RESET}
+  ${DIM}$${RESET} wittyhub init                    ${DIM}# creates my-skill/SKILL.md${RESET}
+  ${DIM}$${RESET} wittyhub init my-skill           ${DIM}# creates my-skill/SKILL.md${RESET}
+  ${DIM}$${RESET} wittyhub init code-reviewer      ${DIM}# creates code-reviewer/SKILL.md${RESET}
+`);
+}
+function showValidateHelp() {
+	console.log(`
+${BOLD}Usage:${RESET} wittyhub validate <path> [options]
+
+${BOLD}Description:${RESET}
+  Validate a local skill for spec compliance (SKILL.md filename, frontmatter,
+  required fields, etc.). Reports errors (must-fix) and warnings (recommended).
+
+${BOLD}Arguments:${RESET}
+  path               Path to the skill directory or SKILL.md file.
+
+${BOLD}Options:${RESET}
+  --json             Output result as JSON (no ANSI colors).
+  -h, --help         Show this help message.
+
+${BOLD}Examples:${RESET}
+  ${DIM}$${RESET} wittyhub validate ./my-skill
+  ${DIM}$${RESET} wittyhub validate ./my-skill/SKILL.md
+  ${DIM}$${RESET} wittyhub validate ./my-skill --json
 `);
 }
 function showRemoveHelp() {
@@ -6406,24 +6993,25 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} wittyhub remove --all                      ${DIM}# remove all skills${RESET}
   ${DIM}$${RESET} wittyhub remove --skill '*' -a cursor      ${DIM}# remove all skills from cursor${RESET}
 
-Discover more skills at ${TEXT}https://skills.sh/${RESET}
+Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}
 `);
 }
 function runInit(args) {
 	const cwd = process.cwd();
-	const skillName = args[0] || basename(cwd);
-	const hasName = args[0] !== void 0;
-	const skillDir = hasName ? join(cwd, skillName) : cwd;
+	const skillName = args[0] ?? "my-skill";
+	const skillDir = join(cwd, skillName);
 	const skillFile = join(skillDir, "SKILL.md");
-	const displayPath = hasName ? `${skillName}/SKILL.md` : "SKILL.md";
+	const displayPath = `${skillName}/SKILL.md`;
 	if (existsSync(skillFile)) {
 		console.log(`${TEXT}Skill already exists at ${DIM}${displayPath}${RESET}`);
 		return;
 	}
-	if (hasName) mkdirSync(skillDir, { recursive: true });
+	mkdirSync(skillDir, { recursive: true });
 	writeFileSync(skillFile, `---
 name: ${skillName}
 description: A brief description of what this skill does
+version: 0.1.0  # optional; increment as needed
+category: others  # optional;change if needed — full list at https://gitcode.com/openeuler/openEuler-skills
 ---
 
 # ${skillName}
@@ -6448,12 +7036,12 @@ Describe when this skill should be used.
 	console.log(`${DIM}Next steps:${RESET}`);
 	console.log(`  1. Edit ${TEXT}${displayPath}${RESET} to define your skill instructions`);
 	console.log(`  2. Update the ${TEXT}name${RESET} and ${TEXT}description${RESET} in the frontmatter`);
+	console.log(`  3. Optionally set ${TEXT}version${RESET} and ${TEXT}category${RESET} (see the comment in ${TEXT}${displayPath}${RESET} for the full list of categories)`);
 	console.log();
 	console.log(`${DIM}Publishing:${RESET}`);
-	console.log(`  ${DIM}GitHub:${RESET}  Push to a repo, then ${TEXT}npx wittyhub add <owner>/<repo>${RESET}`);
-	console.log(`  ${DIM}URL:${RESET}     Host the file, then ${TEXT}npx wittyhub add https://example.com/${displayPath}${RESET}`);
+	console.log(`  Submit your skill to ${TEXT}https://gitcode.com/openeuler/openEuler-skills${RESET}`);
 	console.log();
-	console.log(`Browse existing skills for inspiration at ${TEXT}https://skills.sh/${RESET}`);
+	console.log(`Browse existing skills for inspiration at ${TEXT}https://skillhub.openeuler.org/${RESET}`);
 	console.log();
 }
 async function main() {
@@ -6475,6 +7063,10 @@ async function main() {
 			await runFind(restArgs);
 			break;
 		case "init":
+			if (restArgs.includes("--help") || restArgs.includes("-h")) {
+				showInitHelp();
+				break;
+			}
 			if (!inAgent) showLogo();
 			console.log();
 			runInit(restArgs);
@@ -6517,6 +7109,24 @@ async function main() {
 		case "ls":
 			await runList(restArgs);
 			break;
+		case "audit":
+			if (!inAgent) showLogo();
+			await runAudit(restArgs);
+			break;
+		case "get":
+			if (!inAgent) showLogo();
+			await runGet(restArgs);
+			break;
+		case "validate":
+		case "check-skill":
+			if (restArgs.includes("--help") || restArgs.includes("-h")) {
+				showValidateHelp();
+				break;
+			}
+			if (!inAgent) showLogo();
+			console.log();
+			await runValidate(restArgs);
+			break;
 		case "check":
 		case "update":
 		case "upgrade":