wittyhub 0.0.3 → 0.0.5

package/dist/cli.mjs

@@ -11,14 +11,19 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from
 import { basename, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "path";
 import { fileURLToPath } from "url";
 import { createHash } from "node:crypto";
-import { stripVTControlCharacters } from "node:util";
-import { homedir, platform, tmpdir } from "os";
+import { execFile } from "node:child_process";
+import { promisify, stripVTControlCharacters } from "node:util";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { existsSync as existsSync$1, statSync } from "node:fs";
+import { homedir, tmpdir } from "node:os";
+import { dirname as dirname$1, isAbsolute as isAbsolute$1, join as join$1, resolve as resolve$1, sep as sep$1 } from "node:path";
+import { homedir as homedir$1, platform, tmpdir as tmpdir$1 } from "os";
+import { parse } from "yaml";
 import * as readline from "readline";
 import { Writable } from "stream";
-import { promisify } from "util";
-import { execFile, execSync, spawn, spawnSync } from "child_process";
-import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises";
-import { parse } from "yaml";
+import { promisify as promisify$1 } from "util";
+import { execFile as execFile$1, execSync, spawn, spawnSync } from "child_process";
+import { access, cp, lstat, mkdir, mkdtemp as mkdtemp$1, readFile, readdir, readlink, realpath, rm as rm$1, stat, symlink, writeFile as writeFile$1 } from "fs/promises";
 import { createHash as createHash$1 } from "crypto";
 import { gunzipSync, inflateRawSync } from "node:zlib";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
@@ -55,15 +60,6 @@ function parseOwnerRepo(ownerRepo) {
 	};
 	return null;
 }
-async function isRepoPrivate(owner, repo) {
-	try {
-		const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`);
-		if (!res.ok) return null;
-		return (await res.json()).private === true;
-	} catch {
-		return null;
-	}
-}
 function sanitizeSubpath(subpath) {
 	const segments = subpath.replace(/\\/g, "/").split("/");
 	for (const segment of segments) if (segment === "..") throw new Error(`Unsafe subpath: "${subpath}" contains path traversal segments. Subpaths must not contain ".." components.`);
@@ -251,6 +247,156 @@ function isWellKnownUrl(input) {
 		return false;
 	}
 }
+const CLI_CONFIG_PATH = join(homedir$1(), ".config", "wittyhub", "cli.yaml");
+function loadCliConfig() {
+	if (!existsSync(CLI_CONFIG_PATH)) return {};
+	try {
+		const parsed = parse(readFileSync(CLI_CONFIG_PATH, "utf-8"));
+		if (!parsed || typeof parsed !== "object") return {};
+		return parsed;
+	} catch {
+		return {};
+	}
+}
+const cliConfig = loadCliConfig();
+const API_URL = typeof cliConfig.api_url === "string" && cliConfig.api_url.trim() ? cliConfig.api_url.trim().replace(/\/$/, "") : process.env.SKILLS_API_URL ? `${process.env.SKILLS_API_URL.replace(/\/$/, "")}/api/v1` : "https://skillhub.openeuler.org/api/v1";
+const SEARCH_URL = `${API_URL}/index/search`;
+const TELEMETRY_URL = `${API_URL}/skills/telemetry`;
+const AUDIT_URL = `${API_URL}/skills/{skill_id}/audit`;
+const GET_URL = `${API_URL}/skills/{skill_id}`;
+const LIST_URL = `${API_URL}/skills/`;
+const DOWNLOAD_URL = `${API_URL}/skills/{skill_id}/download`;
+let cliVersion = null;
+let detectedAgentName = null;
+function setDetectedAgent(agentName) {
+	detectedAgentName = agentName;
+}
+function isCI() {
+	return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI || process.env.TRAVIS || process.env.BUILDKITE || process.env.JENKINS_URL || process.env.TEAMCITY_VERSION);
+}
+function isEnabled() {
+	return !process.env.DISABLE_TELEMETRY && !process.env.DO_NOT_TRACK;
+}
+function setVersion(version) {
+	cliVersion = version;
+}
+function slugifyTelemetryValue(value) {
+	const lowered = value.trim().toLowerCase();
+	if (!lowered) return "";
+	let normalized = lowered.replace(/[^a-z0-9._-]+/g, "-");
+	normalized = normalized.replace(/-{2,}/g, "-");
+	return normalized.replace(/^-|-$/g, "");
+}
+async function fetchAuditBySkillId(skillId, timeoutMs = 15e3) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const response = await fetch(AUDIT_URL.replace("{skill_id}", skillId), { signal: controller.signal });
+		if (response.ok) {
+			const data = await response.json();
+			if (!data.error) {
+				const auditData = data.data || data;
+				return { [skillId.split("/").pop() || skillId]: {
+					risk_level: auditData.risk_level ?? "unknown",
+					risk_score: auditData.risk_score ?? null,
+					risk_signals: auditData.risk_signals ?? [],
+					audited_at: auditData.audited_at ?? null
+				} };
+			}
+		}
+		return null;
+	} catch {
+		return null;
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+const pendingTelemetry = [];
+function track(data) {
+	if (!isEnabled()) return;
+	try {
+		const params = new URLSearchParams();
+		if (cliVersion) params.set("v", cliVersion);
+		if (isCI()) params.set("ci", "1");
+		if (detectedAgentName) params.set("agent", detectedAgentName);
+		for (const [key, value] of Object.entries(data)) if (value !== void 0 && value !== null) params.set(key, String(value));
+		const p = fetch(`${TELEMETRY_URL}?${params.toString()}`).catch(() => {}).then(() => {});
+		pendingTelemetry.push(p);
+	} catch {}
+}
+async function flushTelemetry(timeoutMs = 5e3) {
+	if (pendingTelemetry.length === 0) return;
+	const timeout = new Promise((resolve) => setTimeout(resolve, timeoutMs));
+	await Promise.race([Promise.all(pendingTelemetry), timeout]);
+}
+const SOURCE_TYPE_PREFIXES = [
+	"github",
+	"gitcode",
+	"gitlab",
+	"gitee"
+];
+function normalizeSkillId(input) {
+	const trimmed = input.trim();
+	const colonIdx = trimmed.indexOf(":");
+	if (colonIdx > 0) {
+		const prefix = trimmed.slice(0, colonIdx).toLowerCase();
+		if (SOURCE_TYPE_PREFIXES.includes(prefix)) return trimmed;
+	}
+	return `github:${trimmed}`;
+}
+function isRepoLevelRef(input) {
+	const trimmed = input.trim();
+	const colonIdx = trimmed.indexOf(":");
+	if (colonIdx <= 0) return false;
+	const prefix = trimmed.slice(0, colonIdx).toLowerCase();
+	if (!SOURCE_TYPE_PREFIXES.includes(prefix)) return false;
+	return trimmed.slice(colonIdx + 1).split("/").length === 2;
+}
+const HOST_TO_SOURCE_TYPE = {
+	"github.com": "github",
+	"gitcode.com": "gitcode",
+	"gitlab.com": "gitlab",
+	"gitee.com": "gitee"
+};
+function repoUrlToRef(input) {
+	const trimmed = input.trim().replace(/\.git$/, "");
+	if (!trimmed) return null;
+	const scpLike = trimmed.match(/^git@([^:]+):(.+)$/);
+	if (scpLike) return refFromHostAndPath(scpLike[1], scpLike[2]);
+	const sshLike = trimmed.match(/^ssh:\/\/[^@]+@([^/]+)\/(.+)$/);
+	if (sshLike) return refFromHostAndPath(sshLike[1], sshLike[2]);
+	const urlLike = trimmed.match(/^[a-z][a-z0-9+.-]*:\/\/([^/]+)\/(.+)$/i);
+	if (urlLike) return refFromHostAndPath(urlLike[1], urlLike[2]);
+	return null;
+}
+function refFromHostAndPath(host, path) {
+	const sourceType = HOST_TO_SOURCE_TYPE[host.toLowerCase()];
+	if (!sourceType) return null;
+	const parts = path.replace(/\/+$/, "").split("/");
+	if (parts.length !== 2 || parts.some((p) => !p)) return null;
+	return `${sourceType}:${parts.join("/")}`;
+}
+async function listSkillsByRepo(sourceType, ownerRepo) {
+	const slugifiedOwnerRepo = ownerRepo.split("/").map(slugifyTelemetryValue).join("/");
+	const url = `${LIST_URL}?${new URLSearchParams({
+		source_type: sourceType,
+		repo: slugifiedOwnerRepo,
+		limit: "100"
+	}).toString()}`;
+	try {
+		const res = await fetch(url);
+		if (!res.ok) return [];
+		const raw = await res.json();
+		return ((raw.data || raw).skills ?? []).filter((skill) => skill && typeof skill.skill_id === "string" && skill.skill_id).map((skill) => ({
+			skill_id: skill.skill_id,
+			name: skill.name ?? "",
+			description: skill.description ?? "",
+			source_url: skill.source_url ?? ""
+		}));
+	} catch {
+		return [];
+	}
+}
 const CSI_RE = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]/g;
 const OSC_RE = /\x1b\][\s\S]*?(?:\x07|\x1b\\)/g;
 const DCS_PM_APC_RE = /\x1b[P^_][\s\S]*?(?:\x1b\\)/g;
@@ -453,7 +599,7 @@ const CLONE_TIMEOUT_MS = (() => {
 	const parsed = Number.parseInt(raw, 10);
 	return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_CLONE_TIMEOUT_MS;
 })();
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify$1(execFile$1);
 var GitCloneError = class extends Error {
 	url;
 	isTimeout;
@@ -513,22 +659,22 @@ function isAuthFailure(message) {
 function createGitClient(extraEnv) {
 	return esm_default({
 		timeout: { block: CLONE_TIMEOUT_MS },
-		env: {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0",
-			GIT_LFS_SKIP_SMUDGE: "1",
-			...extraEnv
-		},
 		config: [
 			"filter.lfs.required=false",
 			"filter.lfs.smudge=",
 			"filter.lfs.clean=",
 			"filter.lfs.process="
-		]
+		],
+		unsafe: { allowUnsafeFilter: true }
+	}).env({
+		...process.env,
+		GIT_TERMINAL_PROMPT: "0",
+		GIT_LFS_SKIP_SMUDGE: "1",
+		...extraEnv
 	});
 }
 async function resetTempDir(dir) {
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	}).catch(() => {});
@@ -537,7 +683,7 @@ async function resetTempDir(dir) {
 async function tryGhClone(repo, tempDir, ref) {
 	let cloneTarget = repo.slug;
 	try {
-		const { stdout, stderr } = await execFileAsync("gh", [
+		const { stdout, stderr } = await execFileAsync$1("gh", [
 			"auth",
 			"status",
 			"-h",
@@ -554,7 +700,7 @@ async function tryGhClone(repo, tempDir, ref) {
 	} catch {
 		return false;
 	}
-	await execFileAsync("gh", [
+	await execFileAsync$1("gh", [
 		"repo",
 		"clone",
 		cloneTarget,
@@ -580,7 +726,7 @@ function buildGitHubAuthError(url, repo, message) {
 	return `Authentication failed for ${url}.\n  - For private repos, ensure you have access\n  - For SSH: Check your keys with 'ssh -T git@github.com'\n  - For HTTPS: Run 'gh auth login' or configure git credentials`;
 }
 async function cloneRepo(url, ref) {
-	const tempDir = await mkdtemp(join(tmpdir(), "skills-"));
+	const tempDir = await mkdtemp$1(join(tmpdir$1(), "skills-"));
 	const cloneOptions = ref ? [
 		"--depth",
 		"1",
@@ -596,7 +742,7 @@ async function cloneRepo(url, ref) {
 		const isTimeout = errorMessage.includes("block timeout") || errorMessage.includes("timed out");
 		const isAuthError = isAuthFailure(errorMessage);
 		if (isTimeout) {
-			await rm(tempDir, {
+			await rm$1(tempDir, {
 				recursive: true,
 				force: true
 			}).catch(() => {});
@@ -613,7 +759,7 @@ async function cloneRepo(url, ref) {
 				return tempDir;
 			} catch {}
 		}
-		await rm(tempDir, {
+		await rm$1(tempDir, {
 			recursive: true,
 			force: true
 		}).catch(() => {});
@@ -623,9 +769,9 @@ async function cloneRepo(url, ref) {
 }
 async function cleanupTempDir(dir) {
 	const normalizedDir = normalize(resolve(dir));
-	const normalizedTmpDir = normalize(resolve(tmpdir()));
+	const normalizedTmpDir = normalize(resolve(tmpdir$1()));
 	if (!normalizedDir.startsWith(normalizedTmpDir + sep) && normalizedDir !== normalizedTmpDir) throw new Error("Attempted to clean up directory outside of temp directory");
-	await rm(dir, {
+	await rm$1(dir, {
 		recursive: true,
 		force: true
 	});
@@ -731,7 +877,7 @@ async function writeLocalLock(lock, cwd) {
 		version: lock.version,
 		skills: sortedSkills
 	};
-	await writeFile(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
+	await writeFile$1(lockPath, JSON.stringify(sorted, null, 2) + "\n", "utf-8");
 }
 async function computeSkillFolderHash(skillDir) {
 	const files = [];
@@ -827,13 +973,14 @@ async function parseSkillMd(skillMdPath, options) {
 		const { data } = parseFrontmatter(content);
 		if (!data.name || !data.description) return null;
 		if (typeof data.name !== "string" || typeof data.description !== "string") return null;
-		if (data.metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) return null;
+		const metadata = typeof data.metadata === "object" && data.metadata !== null ? data.metadata : void 0;
+		if (metadata?.internal === true && !shouldInstallInternalSkills() && !options?.includeInternal) return null;
 		return {
 			name: sanitizeMetadata(data.name),
 			description: sanitizeMetadata(data.description),
 			path: dirname(skillMdPath),
 			rawContent: content,
-			metadata: data.metadata
+			metadata
 		};
 	} catch {
 		return null;
@@ -950,7 +1097,7 @@ function filterSkills(skills, inputNames) {
 		return normalizedInputs.some((input) => input === name || input === displayName);
 	});
 }
-const home = homedir();
+const home = homedir$1();
 const configHome = xdgConfig ?? join(home, ".config");
 const codexHome = process.env.CODEX_HOME?.trim() || join(home, ".codex");
 const claudeHome = process.env.CLAUDE_CONFIG_DIR?.trim() || join(home, ".claude");
@@ -1679,7 +1826,7 @@ async function isDirEntryOrSymlinkToDir(entry, entryPath) {
 	}
 }
 function getCanonicalSkillsDir(global, cwd) {
-	return join(global ? homedir() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
+	return join(global ? homedir$1() : cwd || process.cwd(), AGENTS_DIR$1, SKILLS_SUBDIR);
 }
 function getEveSubagentSkillsDir(subagent, cwd) {
 	return join(cwd || process.cwd(), EVE_SUBAGENTS_DIR, sanitizeName(subagent), "skills");
@@ -1688,7 +1835,7 @@ function getAgentBaseDir(agentType, global, cwd, eveSubagent) {
 	if (isUniversalAgent(agentType)) return getCanonicalSkillsDir(global, cwd);
 	if (agentType === "eve" && eveSubagent) return getEveSubagentSkillsDir(eveSubagent, cwd);
 	const agent = agents[agentType];
-	const baseDir = global ? homedir() : cwd || process.cwd();
+	const baseDir = global ? homedir$1() : cwd || process.cwd();
 	if (global) {
 		if (agent.globalSkillsDir === void 0) return join(baseDir, agent.skillsDir);
 		return agent.globalSkillsDir;
@@ -1700,7 +1847,7 @@ function resolveSymlinkTarget(linkPath, linkTarget) {
 }
 async function cleanAndCreateDirectory(path) {
 	try {
-		await rm(path, {
+		await rm$1(path, {
 			recursive: true,
 			force: true
 		});
@@ -1727,11 +1874,11 @@ async function createSymlink(target, linkPath) {
 		try {
 			if ((await lstat(linkPath)).isSymbolicLink()) {
 				if (resolveSymlinkTarget(linkPath, await readlink(linkPath)) === resolvedTarget) return true;
-				await rm(linkPath);
-			} else await rm(linkPath, { recursive: true });
+				await rm$1(linkPath);
+			} else await rm$1(linkPath, { recursive: true });
 		} catch (err) {
 			if (err && typeof err === "object" && "code" in err && err.code === "ELOOP") try {
-				await rm(linkPath, { force: true });
+				await rm$1(linkPath, { force: true });
 			} catch {}
 		}
 		const linkDir = dirname(linkPath);
@@ -1872,7 +2019,7 @@ async function copyDirectory(src, dest, agentType) {
 		if (entry.isDirectory()) await copyDirectory(srcPath, destPath, agentType);
 		else try {
 			if (agentType === "eve" && entry.name.toLowerCase() === "skill.md") {
-				await writeFile(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
+				await writeFile$1(destPath, stripIgnoredEveFrontmatter(await readFile(srcPath, "utf-8")));
 				return;
 			}
 			await cp(srcPath, destPath, {
@@ -1927,88 +2074,6 @@ function getCanonicalPath(skillName, options = {}) {
 	if (!isPathSafe$1(canonicalBase, canonicalPath)) throw new Error("Invalid skill name: potential path traversal detected");
 	return canonicalPath;
 }
-async function installWellKnownSkillForAgent(skill, agentType, options = {}) {
-	const agent = agents[agentType];
-	const isGlobal = options.global ?? false;
-	const cwd = options.cwd || process.cwd();
-	const installMode = options.mode ?? "symlink";
-	const eveSubagent = options.eveSubagent;
-	if (isGlobal && agent.globalSkillsDir === void 0) return {
-		success: false,
-		path: "",
-		mode: installMode,
-		error: `${agent.displayName} does not support global skill installation`
-	};
-	const skillName = sanitizeName(skill.installName);
-	const canonicalBase = agentType === "eve" && installMode === "symlink" ? getAgentBaseDir(agentType, isGlobal, cwd, eveSubagent) : getCanonicalSkillsDir(isGlobal, cwd);
-	const canonicalDir = join(canonicalBase, skillName);
-	const agentBase = getAgentBaseDir(agentType, isGlobal, cwd, eveSubagent);
-	const agentDir = join(agentBase, skillName);
-	if (!isPathSafe$1(canonicalBase, canonicalDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	if (!isPathSafe$1(agentBase, agentDir)) return {
-		success: false,
-		path: agentDir,
-		mode: installMode,
-		error: "Invalid skill name: potential path traversal detected"
-	};
-	async function writeSkillFiles(targetDir) {
-		for (const [filePath, content] of skill.files) {
-			const fullPath = join(targetDir, filePath);
-			if (!isPathSafe$1(targetDir, fullPath)) continue;
-			const parentDir = dirname(fullPath);
-			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(filePath).toLowerCase() === "skill.md" && typeof content === "string" ? stripIgnoredEveFrontmatter(content) : content);
-		}
-	}
-	try {
-		if (installMode === "copy") {
-			await cleanAndCreateDirectory(agentDir);
-			await writeSkillFiles(agentDir);
-			return {
-				success: true,
-				path: agentDir,
-				mode: "copy"
-			};
-		}
-		await cleanAndCreateDirectory(canonicalDir);
-		await writeSkillFiles(canonicalDir);
-		if (isGlobal && isUniversalAgent(agentType)) return {
-			success: true,
-			path: canonicalDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-		if (!await createSymlink(canonicalDir, agentDir)) {
-			await cleanAndCreateDirectory(agentDir);
-			await writeSkillFiles(agentDir);
-			return {
-				success: true,
-				path: agentDir,
-				canonicalPath: canonicalDir,
-				mode: "symlink",
-				symlinkFailed: true
-			};
-		}
-		return {
-			success: true,
-			path: agentDir,
-			canonicalPath: canonicalDir,
-			mode: "symlink"
-		};
-	} catch (error) {
-		return {
-			success: false,
-			path: agentDir,
-			mode: installMode,
-			error: error instanceof Error ? error.message : "Unknown error"
-		};
-	}
-}
 async function installBlobSkillForAgent(skill, agentType, options = {}) {
 	const agent = agents[agentType];
 	const isGlobal = options.global ?? false;
@@ -2033,11 +2098,11 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 		};
 		try {
 			await mkdir(agentBase, { recursive: true });
-			await rm(flatSkillPath, {
+			await rm$1(flatSkillPath, {
 				recursive: true,
 				force: true
 			});
-			await writeFile(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
+			await writeFile$1(flatSkillPath, getEveFlatSkillMarkdown(skill.files), "utf-8");
 			return {
 				success: true,
 				path: flatSkillPath,
@@ -2073,7 +2138,7 @@ async function installBlobSkillForAgent(skill, agentType, options = {}) {
 			if (!isPathSafe$1(targetDir, fullPath)) continue;
 			const parentDir = dirname(fullPath);
 			if (parentDir !== targetDir) await mkdir(parentDir, { recursive: true });
-			await writeFile(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
+			await writeFile$1(fullPath, agentType === "eve" && basename(file.path).toLowerCase() === "skill.md" ? stripIgnoredEveFrontmatter(file.contents) : file.contents, "utf-8");
 		}
 	}
 	try {
@@ -2260,53 +2325,6 @@ async function listInstalledSkills(options = {}) {
 	} catch {}
 	return Array.from(skillsMap.values());
 }
-const CLI_CONFIG_PATH = join(homedir(), ".config", "wittyhub", "cli.yaml");
-function loadCliConfig() {
-	if (!existsSync(CLI_CONFIG_PATH)) return {};
-	try {
-		const parsed = parse(readFileSync(CLI_CONFIG_PATH, "utf-8"));
-		if (!parsed || typeof parsed !== "object") return {};
-		return parsed;
-	} catch {
-		return {};
-	}
-}
-const DEFAULT_TELEMETRY_URL = "http://localhost:8080/api/v1/skills/telemetry";
-const cliConfig = loadCliConfig();
-const TELEMETRY_URL = typeof cliConfig.telemetry_url === "string" && cliConfig.telemetry_url.trim() ? cliConfig.telemetry_url.trim() : DEFAULT_TELEMETRY_URL;
-typeof cliConfig.audit_url === "string" && cliConfig.audit_url.trim() && cliConfig.audit_url.trim();
-let cliVersion = null;
-let detectedAgentName = null;
-function setDetectedAgent(agentName) {
-	detectedAgentName = agentName;
-}
-function isCI() {
-	return !!(process.env.CI || process.env.GITHUB_ACTIONS || process.env.GITLAB_CI || process.env.CIRCLECI || process.env.TRAVIS || process.env.BUILDKITE || process.env.JENKINS_URL || process.env.TEAMCITY_VERSION);
-}
-function isEnabled() {
-	return !process.env.DISABLE_TELEMETRY && !process.env.DO_NOT_TRACK;
-}
-function setVersion(version) {
-	cliVersion = version;
-}
-const pendingTelemetry = [];
-function track(data) {
-	if (!isEnabled()) return;
-	try {
-		const params = new URLSearchParams();
-		if (cliVersion) params.set("v", cliVersion);
-		if (isCI()) params.set("ci", "1");
-		if (detectedAgentName) params.set("agent", detectedAgentName);
-		for (const [key, value] of Object.entries(data)) if (value !== void 0 && value !== null) params.set(key, String(value));
-		const p = fetch(`${TELEMETRY_URL}?${params.toString()}`).catch(() => {}).then(() => {});
-		pendingTelemetry.push(p);
-	} catch {}
-}
-async function flushTelemetry(timeoutMs = 5e3) {
-	if (pendingTelemetry.length === 0) return;
-	const timeout = new Promise((resolve) => setTimeout(resolve, timeoutMs));
-	await Promise.race([Promise.all(pendingTelemetry), timeout]);
-}
 var import_dist = require_dist();
 let cachedResult = null;
 const agentNameToType = {
@@ -2806,7 +2824,7 @@ const CURRENT_VERSION = 3;
 function getSkillLockPath() {
 	const xdgStateHome = process.env.XDG_STATE_HOME;
 	if (xdgStateHome) return join(xdgStateHome, "skills", LOCK_FILE);
-	return join(homedir(), AGENTS_DIR, LOCK_FILE);
+	return join(homedir$1(), AGENTS_DIR, LOCK_FILE);
 }
 async function readSkillLock() {
 	const lockPath = getSkillLockPath();
@@ -2823,7 +2841,7 @@ async function readSkillLock() {
 async function writeSkillLock(lock) {
 	const lockPath = getSkillLockPath();
 	await mkdir(dirname(lockPath), { recursive: true });
-	await writeFile(lockPath, JSON.stringify(lock, null, 2), "utf-8");
+	await writeFile$1(lockPath, JSON.stringify(lock, null, 2), "utf-8");
 }
 let _ghWarningShown = false;
 function getGitHubToken() {
@@ -3160,65 +3178,153 @@ async function tryBlobInstall(ownerRepo, options = {}) {
 		tree
 	};
 }
-var version$1 = "0.0.3";
+var version$1 = "0.0.5";
 const isCancelled$1 = (value) => typeof value === "symbol";
-async function isSourcePrivate(source) {
-	const ownerRepo = parseOwnerRepo(source);
-	if (!ownerRepo) return false;
-	return isRepoPrivate(ownerRepo.owner, ownerRepo.repo);
-}
 function getLockSource(parsedUrl, normalizedSource) {
 	return parsedUrl.startsWith("git@") || parsedUrl.startsWith("ssh://") ? parsedUrl : normalizedSource;
 }
 function initTelemetry(version) {
 	setVersion(version);
 }
-function riskLabel(risk) {
+const execFileAsync = promisify(execFile);
+function normalizeRepoRef(input) {
+	let s = input.trim().toLowerCase();
+	s = s.replace(/^(https?:\/\/|git:\/\/|ssh:\/\/)/, "");
+	s = s.replace(/^git@([^:]+):/, "$1/");
+	s = s.replace(/\.git$/, "");
+	s = s.replace(/\/+$/, "");
+	return s;
+}
+function looksLikeLocalPath(source) {
+	const s = source.trim();
+	if (!s) return false;
+	if (isAbsolute$1(s)) return true;
+	if (s.startsWith("./") || s.startsWith("../") || s === "." || s === "..") return true;
+	if (s.startsWith("~/")) return true;
+	if (!s.includes(":") && !s.includes("/") && existsSync$1(resolve$1(process.cwd(), s))) return statSync(resolve$1(process.cwd(), s)).isDirectory();
+	return false;
+}
+function expandLocalPath(source) {
+	const s = source.trim();
+	if (s.startsWith("~/")) return join$1(homedir(), s.slice(2));
+	return resolve$1(process.cwd(), s);
+}
+function isDirectory(path) {
+	return statSync(path).isDirectory();
+}
+function looksLikeRepoSource(source) {
+	const s = source.trim();
+	if (s.startsWith("http://") || s.startsWith("https://")) return true;
+	if (s.startsWith("git@") || s.startsWith("ssh://") || s.startsWith("git://")) return true;
+	return (s.match(/\//g) || []).length <= 1 && !s.includes(":") && !/\s/.test(s);
+}
+async function resolveSkillId(source, skillName) {
+	if (isRepoLevelRef(source)) {
+		const [sourceType, ownerRepo] = source.split(":", 2);
+		const skills = await listSkillsByRepo(sourceType, ownerRepo);
+		if (skills.length === 0) throw new Error(`仓库 "${source}" 下未找到已收录的技能。`);
+		return skills.map((s) => s.skill_id);
+	}
+	if (!looksLikeRepoSource(source)) return normalizeSkillId(source);
+	if (!skillName || !skillName.trim()) throw new Error(`源 "${source}" 看起来是仓库地址，需要同时传入 --skill <skill_name> 才能定位具体技能。`);
+	const searchUrl = `${SEARCH_URL}?${new URLSearchParams({
+		q: skillName.trim(),
+		limit: "20",
+		mode: "text",
+		scope: "summary"
+	}).toString()}`;
+	let res;
+	try {
+		res = await fetch(searchUrl);
+	} catch {
+		throw new Error(`无法连接搜索服务: ${SEARCH_URL}`);
+	}
+	if (!res.ok) throw new Error(`搜索服务返回 HTTP ${res.status}`);
+	const payload = await res.json();
+	const results = payload.data?.results ?? payload.results ?? [];
+	if (results.length === 0) throw new Error(`未找到名称匹配 "${skillName}" 的技能。`);
+	const wantedRef = normalizeRepoRef(source);
+	const match = results.find((r) => {
+		const ref = normalizeRepoRef(r.source_url);
+		return ref === wantedRef || ref.startsWith(`${wantedRef}/`);
+	}) ?? results[0];
+	if (!match) throw new Error(`未找到名称匹配 "${skillName}" 的技能。`);
+	return match.skill_id;
+}
+async function downloadAndExtractSkill(skillId, targetDir, version) {
+	let downloadUrl = DOWNLOAD_URL.replace("{skill_id}", skillId);
+	if (version) downloadUrl += `?version=${encodeURIComponent(version)}`;
+	const response = await fetch(downloadUrl);
+	if (!response.ok) {
+		const detail = await response.json().then((data) => typeof data?.detail === "string" && data.detail ? `: ${data.detail}` : "").catch(() => "");
+		throw new Error(`HTTP ${response.status} ${response.statusText}${detail}`);
+	}
+	const tempDir = targetDir ?? await mkdtemp(join$1(tmpdir(), "skills-"));
+	const zipPath = join$1(tempDir, ".skill.zip");
+	try {
+		await writeFile(zipPath, Buffer.from(await response.arrayBuffer()));
+		try {
+			await execFileAsync("unzip", [
+				"-q",
+				zipPath,
+				"-d",
+				tempDir
+			]);
+		} catch {
+			throw new Error("Failed to extract skill archive. Ensure the 'unzip' command is available on PATH.");
+		}
+	} finally {
+		await rm(zipPath, { force: true });
+	}
+	return tempDir;
+}
+function riskLabel$1(risk) {
 	switch (risk) {
-		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical Risk"));
-		case "high": return import_picocolors.default.red("High Risk");
-		case "medium": return import_picocolors.default.yellow("Med Risk");
-		case "low": return import_picocolors.default.green("Low Risk");
+		case "critical": return import_picocolors.default.red(import_picocolors.default.bold("Critical"));
+		case "high": return import_picocolors.default.red("High");
+		case "medium": return import_picocolors.default.yellow("Med");
+		case "low": return import_picocolors.default.green("Low");
 		case "safe": return import_picocolors.default.green("Safe");
-		default: return import_picocolors.default.dim("--");
+		default: return import_picocolors.default.dim("Unknown");
 	}
 }
-function socketLabel(audit) {
-	if (!audit) return import_picocolors.default.dim("--");
-	const count = audit.alerts ?? 0;
-	return count > 0 ? import_picocolors.default.red(`${count} alert${count !== 1 ? "s" : ""}`) : import_picocolors.default.green("0 alerts");
-}
 function padEnd(str, width) {
 	const visible = stripTerminalEscapes(str);
 	const pad = Math.max(0, width - visible.length);
 	return str + " ".repeat(pad);
 }
-function buildSecurityLines(auditData, skills, source) {
+function buildSecurityLines(auditData, skills) {
 	if (!auditData) return [];
-	if (!skills.some((s) => {
-		const data = auditData[s.slug];
-		return data && Object.keys(data).length > 0;
-	})) return [];
-	const nameWidth = Math.min(Math.max(...skills.map((s) => s.displayName.length)), 36);
+	const rows = skills.filter((s) => auditData[s.slug]);
+	if (rows.length === 0) return [];
+	const nameWidth = Math.min(Math.max(...rows.map((s) => s.displayName.length)), 36);
 	const lines = [];
-	const header = padEnd("", nameWidth + 2) + padEnd(import_picocolors.default.dim("Gen"), 18) + padEnd(import_picocolors.default.dim("Socket"), 18) + import_picocolors.default.dim("Snyk");
+	const header = padEnd("", nameWidth + 2) + padEnd(import_picocolors.default.dim("Risk"), 18) + padEnd(import_picocolors.default.dim("Score"), 8) + import_picocolors.default.dim("Signals");
 	lines.push(header);
-	for (const skill of skills) {
+	for (const skill of rows) {
 		const data = auditData[skill.slug];
 		const name = skill.displayName.length > nameWidth ? skill.displayName.slice(0, nameWidth - 1) + "…" : skill.displayName;
-		const ath = data?.ath ? riskLabel(data.ath.risk) : import_picocolors.default.dim("--");
-		const socket = data?.socket ? socketLabel(data.socket) : import_picocolors.default.dim("--");
-		const snyk = data?.snyk ? riskLabel(data.snyk.risk) : import_picocolors.default.dim("--");
-		lines.push(padEnd(import_picocolors.default.cyan(name), nameWidth + 2) + padEnd(ath, 18) + padEnd(socket, 18) + snyk);
+		const risk = riskLabel$1(data.risk_level);
+		const score = data.risk_score != null ? import_picocolors.default.dim(String(data.risk_score)) : import_picocolors.default.dim("--");
+		const signals = data.risk_signals.length > 0 ? import_picocolors.default.yellow(String(data.risk_signals.length)) : import_picocolors.default.dim("0");
+		lines.push(padEnd(import_picocolors.default.cyan(name), nameWidth + 2) + padEnd(risk, 18) + padEnd(score, 8) + signals);
 	}
-	lines.push("");
-	lines.push(`${import_picocolors.default.dim("Details:")} ${import_picocolors.default.dim(`https://skills.sh/${source}`)}`);
 	return lines;
 }
+function getHighRiskSkills(auditData, skills) {
+	if (!auditData) return [];
+	return skills.filter((s) => {
+		const data = auditData[s.slug];
+		return data && (data.risk_level === "high" || data.risk_level === "critical");
+	}).map((s) => ({
+		name: s.displayName,
+		riskLevel: auditData[s.slug].risk_level
+	}));
+}
 function shortenPath$2(fullPath, cwd) {
 	const home = homedir();
-	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
-	if (fullPath === cwd || fullPath.startsWith(cwd + sep)) return "." + fullPath.slice(cwd.length);
+	if (fullPath === home || fullPath.startsWith(home + sep$1)) return "~" + fullPath.slice(home.length);
+	if (fullPath === cwd || fullPath.startsWith(cwd + sep$1)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
 }
 function computeSingleFileSkillHash(contents) {
@@ -3233,6 +3339,13 @@ function formatList$1(items, maxShow = 5) {
 	const remaining = items.length - maxShow;
 	return `${shown.join(", ")} +${remaining} more`;
 }
+function buildSkillFiles(selectedSkills, tempDir, blobResult) {
+	const skillFiles = {};
+	for (const skill of selectedSkills) if (blobResult && "repoPath" in skill) skillFiles[skill.name] = skill.repoPath;
+	else if (tempDir && skill.path === tempDir) skillFiles[skill.name] = "SKILL.md";
+	else if (tempDir && skill.path.startsWith(tempDir + sep$1)) skillFiles[skill.name] = skill.path.slice(tempDir.length + 1).split(sep$1).join("/") + "/SKILL.md";
+	return skillFiles;
+}
 function splitAgentsByType(agentTypes) {
 	const universal = [];
 	const symlinked = [];
@@ -3243,18 +3356,6 @@ function splitAgentsByType(agentTypes) {
 		symlinked
 	};
 }
-function buildAgentSummaryLines(targetAgents, installMode) {
-	const lines = [];
-	const { universal, symlinked } = splitAgentsByType(targetAgents);
-	if (installMode === "symlink") {
-		if (universal.length > 0) lines.push(`  ${import_picocolors.default.green("universal:")} ${formatList$1(universal)}`);
-		if (symlinked.length > 0) lines.push(`  ${import_picocolors.default.dim("symlink →")} ${formatList$1(symlinked)}`);
-	} else {
-		const allNames = targetAgents.map((a) => agents[a].displayName);
-		lines.push(`  ${import_picocolors.default.dim("copy →")} ${formatList$1(allNames)}`);
-	}
-	return lines;
-}
 function targetDisplayName(target) {
 	const base = agents[target.agent].displayName;
 	return target.subagent ? `${base} (${target.subagent})` : base;
@@ -3316,12 +3417,28 @@ function buildCopyResultLines(results, cwd) {
 	}
 	return lines;
 }
+function withQuitOnQ(promise) {
+	const handler = (_str, key) => {
+		if (key?.name !== "q" || key.ctrl || key.meta) return;
+		process.stdin.removeListener("keypress", handler);
+		if (process.stdin.isTTY) try {
+			process.stdin.setRawMode(false);
+		} catch {}
+		process.stdout.write("\n");
+		xe("Cancelled");
+		process.exit(0);
+	};
+	process.stdin.on("keypress", handler);
+	return promise.finally(() => {
+		process.stdin.removeListener("keypress", handler);
+	});
+}
 function multiselect(opts) {
-	return fe({
+	return withQuitOnQ(fe({
 		...opts,
 		options: opts.options,
-		message: `${opts.message} ${import_picocolors.default.dim("(space to toggle)")}`
-	});
+		message: `${opts.message} ${import_picocolors.default.dim("(space to toggle, q to quit)")}`
+	}));
 }
 async function promptForAgents(message, choices) {
 	let lastSelected;
@@ -3382,57 +3499,44 @@ async function selectAgentsInteractive(options) {
 	return selected;
 }
 setVersion(version$1);
-async function handleWellKnownSkills(source, url, options, spinner) {
-	spinner.start("Discovering skills from well-known endpoint...");
-	const skills = await wellKnownProvider.fetchAllSkills(url);
-	if (skills.length === 0) {
-		spinner.stop(import_picocolors.default.red("No skills found"));
-		Se(import_picocolors.default.red("No skills found at this URL. Make sure the server has a /.well-known/agent-skills/index.json or /.well-known/skills/index.json file."));
-		process.exit(1);
-	}
-	spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
-	for (const skill of skills) {
-		M.info(`Skill: ${import_picocolors.default.cyan(skill.installName)}`);
-		M.message(import_picocolors.default.dim(skill.description));
-		if (skill.files.size > 1) M.message(import_picocolors.default.dim(`  Files: ${Array.from(skill.files.keys()).join(", ")}`));
-	}
+async function installLocalSkills(source, localDir, skills, options, agentResult) {
+	const spinner = Y();
 	if (options.list) {
 		console.log();
 		M.step(import_picocolors.default.bold("Available Skills"));
 		for (const skill of skills) {
-			M.message(`  ${import_picocolors.default.cyan(skill.installName)}`);
+			M.message(`  ${import_picocolors.default.cyan(getSkillDisplayName(skill))}`);
 			M.message(`    ${import_picocolors.default.dim(skill.description)}`);
-			if (skill.files.size > 1) M.message(`    ${import_picocolors.default.dim(`Files: ${skill.files.size}`)}`);
 		}
 		console.log();
-		Se("Run without --list to install");
-		process.exit(0);
+		Se("Use --skill <name> to install specific skills");
+		return;
 	}
 	let selectedSkills;
 	if (options.skill?.includes("*")) {
 		selectedSkills = skills;
 		M.info(`Installing all ${skills.length} skills`);
 	} else if (options.skill && options.skill.length > 0) {
-		selectedSkills = skills.filter((s) => options.skill.some((name) => s.installName.toLowerCase() === name.toLowerCase() || s.name.toLowerCase() === name.toLowerCase()));
+		selectedSkills = filterSkills(skills, options.skill);
 		if (selectedSkills.length === 0) {
 			M.error(`No matching skills found for: ${options.skill.join(", ")}`);
 			M.info("Available skills:");
-			for (const s of skills) M.message(`  - ${s.installName}`);
+			for (const s of skills) M.message(`  - ${getSkillDisplayName(s)}`);
 			process.exit(1);
 		}
-	} else if (skills.length === 1) {
-		selectedSkills = skills;
-		const firstSkill = skills[0];
-		M.info(`Skill: ${import_picocolors.default.cyan(firstSkill.installName)}`);
-	} else if (options.yes) {
+		M.info(`Selected ${selectedSkills.length} skill${selectedSkills.length !== 1 ? "s" : ""}: ${selectedSkills.map((s) => import_picocolors.default.cyan(getSkillDisplayName(s))).join(", ")}`);
+	} else if (skills.length === 1 || options.yes) {
 		selectedSkills = skills;
-		M.info(`Installing all ${skills.length} skills`);
+		if (skills.length === 1) {
+			M.info(`Skill: ${import_picocolors.default.cyan(getSkillDisplayName(skills[0]))}`);
+			M.message(import_picocolors.default.dim(skills[0].description));
+		} else M.info(`Installing all ${skills.length} skills`);
 	} else {
 		const selected = await multiselect({
 			message: "Select skills to install",
-			options: skills.map((s) => ({
+			options: [...skills].sort((a, b) => getSkillDisplayName(a).localeCompare(getSkillDisplayName(b))).map((s) => ({
 				value: s,
-				label: s.installName,
+				label: getSkillDisplayName(s),
 				hint: s.description.length > 60 ? s.description.slice(0, 57) + "..." : s.description
 			})),
 			required: true
@@ -3466,7 +3570,7 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			M.info("Installing to all agents");
 		} else {
 			M.info("Select agents to install skills to");
-			const selected = await promptForAgents("Which agents do you want to install to?", Object.entries(agents).map(([key, config]) => ({
+			const selected = await promptForAgents("Which agents do you want to install to?", Object.entries(agents).filter(([key]) => key !== "eve").map(([key, config]) => ({
 				value: key,
 				label: config.displayName
 			})));
@@ -3476,24 +3580,14 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 			}
 			targetAgents = selected;
 		}
-		else if (installedAgents.length === 1 || options.yes) {
+		else {
 			targetAgents = ensureUniversalAgents(installedAgents);
-			if (installedAgents.length === 1) {
-				const firstAgent = installedAgents[0];
-				M.info(`Installing to: ${import_picocolors.default.cyan(agents[firstAgent].displayName)}`);
-			} else M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
-		} else {
-			const selected = await selectAgentsInteractive({ global: options.global });
-			if (pD(selected)) {
-				xe("Installation cancelled");
-				process.exit(0);
-			}
-			targetAgents = selected;
+			M.info(`Installing to: ${installedAgents.map((a) => import_picocolors.default.cyan(agents[a].displayName)).join(", ")}`);
 		}
 	}
+	const installTargets = buildInstallTargets(targetAgents, [void 0]);
 	let installGlobally = options.global ?? false;
-	const supportsGlobal = targetAgents.some((a) => agents[a].globalSkillsDir !== void 0);
-	if (options.global === void 0 && !options.yes && supportsGlobal) {
+	if (options.global === void 0 && !options.yes) {
 		const scope = await ve({
 			message: "Installation scope",
 			options: [{
@@ -3512,71 +3606,27 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 		}
 		installGlobally = scope;
 	}
-	let installMode = options.copy ? "copy" : "symlink";
-	const uniqueDirs = new Set(targetAgents.map((a) => agents[a].skillsDir));
-	if (!options.copy && !options.yes && uniqueDirs.size > 1) {
-		const modeChoice = await ve({
-			message: "Installation method",
-			options: [{
-				value: "symlink",
-				label: "Symlink (Recommended)",
-				hint: "Single source of truth, easy updates"
-			}, {
-				value: "copy",
-				label: "Copy to all agents",
-				hint: "Independent copies for each agent"
-			}]
-		});
-		if (pD(modeChoice)) {
-			xe("Installation cancelled");
-			process.exit(0);
-		}
-		installMode = modeChoice;
-	} else if (uniqueDirs.size <= 1) installMode = "copy";
-	const cwd = process.cwd();
-	const summaryLines = [];
-	targetAgents.map((a) => agents[a].displayName);
-	const overwriteChecks = await Promise.all(selectedSkills.flatMap((skill) => targetAgents.map(async (agent) => ({
-		skillName: skill.installName,
-		agent,
-		installed: await isSkillInstalled(skill.installName, agent, { global: installGlobally })
-	}))));
-	const overwriteStatus = /* @__PURE__ */ new Map();
-	for (const { skillName, agent, installed } of overwriteChecks) {
-		if (!overwriteStatus.has(skillName)) overwriteStatus.set(skillName, /* @__PURE__ */ new Map());
-		overwriteStatus.get(skillName).set(agent, installed);
-	}
-	for (const skill of selectedSkills) {
-		if (summaryLines.length > 0) summaryLines.push("");
-		const shortCanonical = shortenPath$2(getCanonicalPath(skill.installName, { global: installGlobally }), cwd);
-		summaryLines.push(`${import_picocolors.default.cyan(shortCanonical)}`);
-		summaryLines.push(...buildAgentSummaryLines(targetAgents, installMode));
-		if (skill.files.size > 1) summaryLines.push(`  ${import_picocolors.default.dim("files:")} ${skill.files.size}`);
-		const skillOverwrites = overwriteStatus.get(skill.installName);
-		const overwriteAgents = targetAgents.filter((a) => skillOverwrites?.get(a)).map((a) => agents[a].displayName);
-		if (overwriteAgents.length > 0) summaryLines.push(`  ${import_picocolors.default.yellow("overwrites:")} ${formatList$1(overwriteAgents)}`);
-	}
-	console.log();
-	Me(summaryLines.join("\n"), "Installation Summary");
 	if (!options.yes) {
-		const confirmed = await ye({ message: "Proceed with installation?" });
+		const confirmed = await ye({
+			message: "Proceed with installation?",
+			initialValue: true
+		});
 		if (pD(confirmed) || !confirmed) {
 			xe("Installation cancelled");
 			process.exit(0);
 		}
 	}
-	const sourceIdentifier = wellKnownProvider.getSourceIdentifier(url);
-	const wellKnownPrivacyPromise = isSourcePrivate(sourceIdentifier).catch(() => null);
 	spinner.start("Installing skills...");
 	const results = [];
-	for (const skill of selectedSkills) for (const agent of targetAgents) {
-		const result = await installWellKnownSkillForAgent(skill, agent, {
+	for (const skill of selectedSkills) for (const target of installTargets) {
+		const result = await installSkillForAgent(skill, target.agent, {
 			global: installGlobally,
-			mode: installMode
+			mode: "copy",
+			eveSubagent: target.subagent
 		});
 		results.push({
-			skill: skill.installName,
-			agent: agents[agent].displayName,
+			skill: getSkillDisplayName(skill),
+			agent: targetDisplayName(target),
 			...result
 		});
 	}
@@ -3584,73 +3634,18 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 	console.log();
 	const successful = results.filter((r) => r.success);
 	const failed = results.filter((r) => !r.success);
-	const skillFiles = {};
-	for (const skill of selectedSkills) skillFiles[skill.installName] = skill.sourceUrl;
-	if (await wellKnownPrivacyPromise !== true) track({
-		event: "install",
-		source: sourceIdentifier,
-		skills: selectedSkills.map((s) => s.installName).join(","),
-		agents: targetAgents.join(","),
-		...installGlobally && { global: "1" },
-		skillFiles: JSON.stringify(skillFiles),
-		sourceType: "well-known"
-	});
-	if (successful.length > 0 && installGlobally) {
-		const successfulSkillNames = new Set(successful.map((r) => r.skill));
-		for (const skill of selectedSkills) if (successfulSkillNames.has(skill.installName)) try {
-			await addSkillToLock(skill.installName, {
-				source: sourceIdentifier,
-				sourceType: "well-known",
-				sourceUrl: skill.sourceUrl,
-				skillFolderHash: ""
-			});
-		} catch {}
-	}
-	if (successful.length > 0 && !installGlobally) {
-		const successfulSkillNames = new Set(successful.map((r) => r.skill));
-		for (const skill of selectedSkills) if (successfulSkillNames.has(skill.installName)) try {
-			const matchingResult = successful.find((r) => r.skill === skill.installName);
-			const installDir = matchingResult?.canonicalPath || matchingResult?.path;
-			if (installDir) {
-				const computedHash = await computeSkillFolderHash(installDir);
-				await addSkillToLocalLock(skill.installName, {
-					source: sourceIdentifier,
-					sourceType: "well-known",
-					computedHash
-				}, cwd);
-			}
-		} catch {}
-	}
 	if (successful.length > 0) {
 		const bySkill = /* @__PURE__ */ new Map();
 		for (const r of successful) {
-			const skillResults = bySkill.get(r.skill) || [];
-			skillResults.push(r);
-			bySkill.set(r.skill, skillResults);
+			if (!bySkill.has(r.skill)) bySkill.set(r.skill, []);
+			bySkill.get(r.skill).push(r);
 		}
-		const skillCount = bySkill.size;
-		const symlinkFailures = successful.filter((r) => r.mode === "symlink" && r.symlinkFailed);
-		const copiedAgents = symlinkFailures.map((r) => r.agent);
 		const resultLines = [];
 		for (const [skillName, skillResults] of bySkill) {
-			const firstResult = skillResults[0];
-			if (firstResult.mode === "copy") {
-				resultLines.push(`${import_picocolors.default.green("✓")} ${skillName} ${import_picocolors.default.dim("(copied)")}`);
-				resultLines.push(...buildCopyResultLines(skillResults, cwd));
-			} else {
-				if (firstResult.canonicalPath) {
-					const shortPath = shortenPath$2(firstResult.canonicalPath, cwd);
-					resultLines.push(`${import_picocolors.default.green("✓")} ${shortPath}`);
-				} else resultLines.push(`${import_picocolors.default.green("✓")} ${skillName}`);
-				resultLines.push(...buildResultLines(skillResults, targetAgents));
-			}
-		}
-		const title = import_picocolors.default.green(`Installed ${skillCount} skill${skillCount !== 1 ? "s" : ""}`);
-		Me(resultLines.join("\n"), title);
-		if (symlinkFailures.length > 0) {
-			M.warn(import_picocolors.default.yellow(`Symlinks failed for: ${formatList$1(copiedAgents)}`));
-			M.message(import_picocolors.default.dim("  Files were copied instead. On Windows, enable Developer Mode for symlink support."));
+			resultLines.push(`${import_picocolors.default.green("✓")} ${skillName} ${import_picocolors.default.dim("(copied)")}`);
+			resultLines.push(...buildCopyResultLines(skillResults, process.cwd()));
 		}
+		Me(resultLines.join("\n"), import_picocolors.default.green(`Installed ${bySkill.size} skill${bySkill.size !== 1 ? "s" : ""}`));
 	}
 	if (failed.length > 0) {
 		console.log();
@@ -3659,6 +3654,14 @@ async function handleWellKnownSkills(source, url, options, spinner) {
 	}
 	console.log();
 	Se(import_picocolors.default.green("Done!") + import_picocolors.default.dim("  Review skills before use; they run with full agent permissions."));
+	if (successful.length > 0 && !installGlobally) for (const skill of selectedSkills) try {
+		const computedHash = await computeSkillFolderHash(skill.path);
+		await addSkillToLocalLock(skill.name, {
+			source,
+			sourceType: "local",
+			computedHash
+		}, process.cwd());
+	} catch {}
 	await promptForFindSkills(options, targetAgents);
 }
 async function runAdd(args, options = {}) {
@@ -3699,102 +3702,139 @@ async function runAdd(args, options = {}) {
 	if (agentResult.isAgent) M.info(import_picocolors.default.bgCyan(import_picocolors.default.black(import_picocolors.default.bold(` ${agentResult.agent.name} `))) + " Agent detected — installing non-interactively");
 	else if (!process.stdin.isTTY) showInstallTip();
 	let tempDir = null;
+	if (source.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) {
+		console.log();
+		M.warn(import_picocolors.default.yellow(import_picocolors.default.bold("⚠ OpenClaw skills are unverified community submissions.")));
+		M.message(import_picocolors.default.yellow("This source contains user-submitted skills that have not been reviewed for safety or quality."));
+		M.message(import_picocolors.default.yellow("Skills run with full agent permissions and could be malicious."));
+		console.log();
+		M.message(`If you understand the risks, re-run with:\n\n  ${import_picocolors.default.cyan(`npx wittyhub add ${source} --dangerously-accept-openclaw-risks`)}\n`);
+		Se(import_picocolors.default.red("Installation blocked"));
+		process.exit(1);
+	}
 	try {
 		const spinner = Y();
-		spinner.start("Parsing source...");
-		const parsed = parseSource(source);
-		spinner.stop(`Source: ${parsed.type === "local" ? parsed.localPath : parsed.url}${parsed.ref ? ` @ ${import_picocolors.default.yellow(parsed.ref)}` : ""}${parsed.subpath ? ` (${parsed.subpath})` : ""}${parsed.skillFilter ? ` ${import_picocolors.default.dim("@")}${import_picocolors.default.cyan(parsed.skillFilter)}` : ""}`);
-		const ownerRepoRaw = getOwnerRepo(parsed);
-		const repoPrivacyPromise = (() => {
-			if (!ownerRepoRaw || parsed.type !== "github") return Promise.resolve(null);
-			const ownerRepo = parseOwnerRepo(ownerRepoRaw);
-			if (!ownerRepo) return Promise.resolve(null);
-			return isRepoPrivate(ownerRepo.owner, ownerRepo.repo).catch(() => null);
-		})();
-		if (ownerRepoRaw?.split("/")[0]?.toLowerCase() === "openclaw" && !options.dangerouslyAcceptOpenclawRisks) {
-			console.log();
-			M.warn(import_picocolors.default.yellow(import_picocolors.default.bold("⚠ OpenClaw skills are unverified community submissions.")));
-			M.message(import_picocolors.default.yellow("This source contains user-submitted skills that have not been reviewed for safety or quality."));
-			M.message(import_picocolors.default.yellow("Skills run with full agent permissions and could be malicious."));
-			console.log();
-			M.message(`If you understand the risks, re-run with:\n\n  ${import_picocolors.default.cyan(`npx wittyhub add ${source} --dangerously-accept-openclaw-risks`)}\n`);
-			Se(import_picocolors.default.red("Installation blocked"));
-			process.exit(1);
-		}
-		if (parsed.type === "well-known") {
-			await handleWellKnownSkills(source, parsed.url, options, spinner);
-			return;
-		}
-		if (parsed.skillFilter) {
-			options.skill = options.skill || [];
-			if (!options.skill.includes(parsed.skillFilter)) options.skill.push(parsed.skillFilter);
-		}
-		const includeInternal = !!(options.skill && options.skill.length > 0);
-		let skills;
-		let blobResult = null;
-		if (parsed.type === "local") {
-			spinner.start("Validating local path...");
-			if (!existsSync(parsed.localPath)) {
-				spinner.stop(import_picocolors.default.red("Path not found"));
-				Se(import_picocolors.default.red(`Local path does not exist: ${parsed.localPath}`));
+		if (looksLikeLocalPath(source)) {
+			const expanded = expandLocalPath(source);
+			if (!existsSync$1(expanded)) {
+				Se(import_picocolors.default.red(`Local path does not exist: ${expanded}`));
 				process.exit(1);
 			}
-			spinner.stop("Local path validated");
-			spinner.start("Discovering skills...");
-			skills = await discoverSkills(parsed.localPath, parsed.subpath, {
-				includeInternal,
-				fullDepth: options.fullDepth
-			});
-		} else if (parsed.type === "github" && !options.fullDepth) {
-			const BLOB_ALLOWED_OWNERS = [
-				"vercel",
-				"vercel-labs",
-				"heygen-com"
-			];
-			const ownerRepo = getOwnerRepo(parsed);
-			const owner = ownerRepo?.split("/")[0]?.toLowerCase();
-			const isSelfHostedRepo = !!ownerRepo && Object.hasOwn(BLOB_ALLOWED_REPOS, ownerRepo.toLowerCase());
-			if (ownerRepo && owner && (isSelfHostedRepo || BLOB_ALLOWED_OWNERS.includes(owner))) {
-				spinner.start("Fetching skills...");
-				blobResult = await tryBlobInstall(ownerRepo, {
-					subpath: parsed.subpath,
-					skillFilter: parsed.skillFilter,
-					ref: parsed.ref,
-					getToken: getGitHubToken,
-					includeInternal
-				});
-				if (!blobResult) spinner.stop(import_picocolors.default.dim("Falling back to clone..."));
+			if (!isDirectory(expanded)) {
+				Se(import_picocolors.default.red(`Local path is not a directory: ${expanded}`));
+				process.exit(1);
 			}
-			if (blobResult) {
-				skills = blobResult.skills;
-				spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
-			} else {
-				spinner.start("Cloning repository...");
-				tempDir = await cloneRepo(parsed.url, parsed.ref);
-				spinner.stop("Repository cloned");
-				spinner.start("Discovering skills...");
-				skills = await discoverSkills(tempDir, parsed.subpath, {
+			const includeInternal = !!(options.skill && options.skill.length > 0);
+			spinner.start("Discovering skills...");
+			let skills;
+			try {
+				skills = await discoverSkills(expanded, void 0, {
 					includeInternal,
 					fullDepth: options.fullDepth
 				});
+			} finally {
+				spinner.stop("Discovery complete");
 			}
-		} else {
-			spinner.start("Cloning repository...");
-			tempDir = await cloneRepo(parsed.url, parsed.ref);
-			spinner.stop("Repository cloned");
-			spinner.start("Discovering skills...");
-			skills = await discoverSkills(tempDir, parsed.subpath, {
-				includeInternal,
-				fullDepth: options.fullDepth
-			});
+			if (skills.length === 0) {
+				M.error(import_picocolors.default.red("No skills found"));
+				Se(import_picocolors.default.red("No valid skills found. Skills require a SKILL.md with name and description."));
+				process.exit(1);
+			}
+			await installLocalSkills(source, expanded, skills, options, agentResult);
+			return;
 		}
+		const skillNameForLookup = options.skill?.[0];
+		let skillIds;
+		const repoRef = isRepoLevelRef(source) ? source : repoUrlToRef(source);
+		const repoLevel = repoRef !== null;
+		if (repoLevel) {
+			const [sourceType, ownerRepo] = repoRef.split(":", 2);
+			spinner.start("查询仓库下的技能...");
+			let repoSkills;
+			try {
+				repoSkills = await listSkillsByRepo(sourceType, ownerRepo);
+			} finally {
+				spinner.stop("查询完成");
+			}
+			if (repoSkills.length === 0) {
+				Se(import_picocolors.default.red(`仓库 "${source}" 下未找到已收录的技能。`));
+				process.exit(1);
+			}
+			if (options.list) {
+				console.log();
+				M.step(import_picocolors.default.bold("Available Skills"));
+				const sorted = [...repoSkills].sort((a, b) => a.name.localeCompare(b.name));
+				for (const skill of sorted) {
+					M.message(`  ${import_picocolors.default.cyan(skill.name)}`);
+					if (skill.description) M.message(`    ${import_picocolors.default.dim(skill.description)}`);
+				}
+				console.log();
+				Se("Use --skill <name> to install specific skills");
+				process.exit(0);
+			}
+			if (options.skill && !options.skill.includes("*")) {
+				const matched = repoSkills.filter((s) => options.skill.some((name) => s.name === name || s.skill_id.endsWith("/" + name)));
+				if (matched.length === 0) {
+					Se(import_picocolors.default.red(`未找到匹配 --skill 的技能: ${options.skill.join(", ")}`));
+					process.exit(1);
+				}
+				skillIds = matched.map((s) => s.skill_id);
+			} else if (options.skill?.includes("*") || options.all || options.yes) skillIds = repoSkills.map((s) => s.skill_id);
+			else {
+				const selected = await multiselect({
+					message: "Select skills to install",
+					options: [...repoSkills].sort((a, b) => a.name.localeCompare(b.name)).map((s) => ({
+						value: s.skill_id,
+						label: s.name,
+						hint: s.description && s.description.length > 60 ? s.description.slice(0, 57) + "..." : s.description ?? ""
+					})),
+					required: true
+				});
+				if (pD(selected)) {
+					xe("Installation cancelled");
+					process.exit(0);
+				}
+				skillIds = selected;
+			}
+		} else try {
+			const result = await resolveSkillId(source, skillNameForLookup);
+			skillIds = Array.isArray(result) ? result : [result];
+		} catch (e) {
+			const message = e instanceof Error ? e.message : String(e);
+			Se(import_picocolors.default.red(message));
+			process.exit(1);
+		}
+		spinner.start(`Downloading ${skillIds.length > 1 ? `${skillIds.length} skills` : `skill ${import_picocolors.default.cyan(skillIds[0])}`} from API...`);
+		try {
+			tempDir = await mkdtemp(join$1(tmpdir(), "skills-"));
+			for (const id of skillIds) await downloadAndExtractSkill(id, tempDir, options.version);
+		} catch (e) {
+			spinner.stop(import_picocolors.default.red("Download failed"));
+			const message = e instanceof Error ? e.message : String(e);
+			Se(import_picocolors.default.red(`Failed to download skill: ${message}`));
+			process.exit(1);
+		}
+		spinner.stop(`Skill archive downloaded from ${import_picocolors.default.cyan("API")}`);
+		const parsed = {
+			type: "git",
+			url: skillIds[0]
+		};
+		const repoPrivacyPromise = Promise.resolve(null);
+		const includeInternal = !!(options.skill && options.skill.length > 0);
+		let skills;
+		let blobResult = null;
+		spinner.start("Discovering skills...");
+		skills = await discoverSkills(tempDir, void 0, {
+			includeInternal,
+			fullDepth: options.fullDepth
+		});
 		if (skills.length === 0) {
 			spinner.stop(import_picocolors.default.red("No skills found"));
 			Se(import_picocolors.default.red("No valid skills found. Skills require a SKILL.md with name and description."));
 			await cleanup(tempDir);
 			process.exit(1);
 		}
-		if (!blobResult) spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
+		spinner.stop(`Found ${import_picocolors.default.green(skills.length)} skill${skills.length > 1 ? "s" : ""}`);
 		if (options.list) {
 			console.log();
 			M.step(import_picocolors.default.bold("Available Skills"));
@@ -3828,7 +3868,13 @@ async function runAdd(args, options = {}) {
 			process.exit(0);
 		}
 		let selectedSkills;
-		if (options.skill?.includes("*")) {
+		if (repoLevel) {
+			selectedSkills = skills;
+			if (skills.length === 1) {
+				M.info(`Skill: ${import_picocolors.default.cyan(getSkillDisplayName(skills[0]))}`);
+				M.message(import_picocolors.default.dim(skills[0].description));
+			} else M.info(`Installing ${skills.length} skills`);
+		} else if (options.skill?.includes("*")) {
 			selectedSkills = skills;
 			M.info(`Installing all ${skills.length} skills`);
 		} else if (options.skill && options.skill.length > 0) {
@@ -3891,8 +3937,10 @@ async function runAdd(args, options = {}) {
 			}
 			selectedSkills = selected;
 		}
-		const ownerRepoForAudit = getOwnerRepo(parsed);
-		const auditPromise = Promise.resolve(null);
+		const auditPromise = skillIds.length === 1 ? fetchAuditBySkillId(skillIds[0]) : Promise.all(skillIds.map((id) => fetchAuditBySkillId(id))).then((results) => results.reduce((acc, r) => ({
+			...acc,
+			...r
+		}), {}));
 		let targetAgents;
 		const validAgents = Object.keys(agents);
 		if (options.agent?.includes("*")) {
@@ -4093,18 +4141,28 @@ async function runAdd(args, options = {}) {
 		}
 		console.log();
 		Me(summaryLines.join("\n"), "Installation Summary");
+		const auditSkills = selectedSkills.map((s) => ({
+			slug: getSkillDisplayName(s),
+			displayName: getSkillDisplayName(s)
+		}));
+		let auditData = null;
 		try {
-			const auditData = await auditPromise;
-			if (auditData && ownerRepoForAudit) {
-				const securityLines = buildSecurityLines(auditData, selectedSkills.map((s) => ({
-					slug: getSkillDisplayName(s),
-					displayName: getSkillDisplayName(s)
-				})), ownerRepoForAudit);
+			auditData = await auditPromise;
+			if (auditData) {
+				const securityLines = buildSecurityLines(auditData, auditSkills);
 				if (securityLines.length > 0) Me(securityLines.join("\n"), "Security Risk Assessments");
 			}
 		} catch {}
+		const highRiskSkills = getHighRiskSkills(auditData, auditSkills);
+		if (highRiskSkills.length > 0) {
+			const list = highRiskSkills.map((s) => `${s.name} 经安全审计标记为 ${s.riskLevel} 风险`).join("，");
+			M.warn(`${import_picocolors.default.red(import_picocolors.default.bold("⚠ 高风险警告："))} ${list}，请谨慎安装。`);
+		}
 		if (!options.yes) {
-			const confirmed = await ye({ message: "Proceed with installation?" });
+			const confirmed = await ye({
+				message: highRiskSkills.length > 0 ? `检测到以下技能存在安全风险：${highRiskSkills.map((s) => `${s.name} (${s.riskLevel})`).join(", ")}。仍要继续安装？` : "Proceed with installation?",
+				initialValue: highRiskSkills.length === 0
+			});
 			if (pD(confirmed) || !confirmed) {
 				xe("Installation cancelled");
 				await cleanup(tempDir);
@@ -4116,17 +4174,7 @@ async function runAdd(args, options = {}) {
 		for (const skill of selectedSkills) for (const target of installTargets) {
 			const { agent, subagent } = target;
 			let result;
-			if (blobResult && "files" in skill) {
-				const blobSkill = skill;
-				result = await installBlobSkillForAgent({
-					installName: blobSkill.name,
-					files: blobSkill.files
-				}, agent, {
-					global: installGlobally,
-					mode: installMode,
-					eveSubagent: subagent
-				});
-			} else if (tempDir && skill.path === tempDir && skill.rawContent) result = await installBlobSkillForAgent({
+			if (tempDir && skill.path === tempDir && skill.rawContent) result = await installBlobSkillForAgent({
 				installName: skill.name,
 				files: [{
 					path: "SKILL.md",
@@ -4152,16 +4200,37 @@ async function runAdd(args, options = {}) {
 		console.log();
 		const successful = results.filter((r) => r.success);
 		const failed = results.filter((r) => !r.success);
-		const skillFiles = {};
-		for (const skill of selectedSkills) if (blobResult && "repoPath" in skill) skillFiles[skill.name] = skill.repoPath;
-		else if (tempDir && skill.path === tempDir) skillFiles[skill.name] = "SKILL.md";
-		else if (tempDir && skill.path.startsWith(tempDir + sep)) skillFiles[skill.name] = skill.path.slice(tempDir.length + 1).split(sep).join("/") + "/SKILL.md";
-		else continue;
+		const skillFiles = buildSkillFiles(selectedSkills, tempDir, blobResult);
 		const normalizedSource = getOwnerRepo(parsed);
 		const lockSource = getLockSource(parsed.url, normalizedSource);
 		if (normalizedSource) if (parseOwnerRepo(normalizedSource)) {
 			const isPrivate = await repoPrivacyPromise;
-			if (isPrivate === false || isPrivate === null && parsed.type !== "github") track({
+			if (isPrivate === false || isPrivate === null && parsed.type !== "github") {
+				console.log("[telemetry-debug-1]", JSON.stringify({
+					isPrivate,
+					parsedType: parsed.type,
+					normalizedSource,
+					sourceType: parsed.type,
+					skillFiles: JSON.stringify(skillFiles)
+				}));
+				track({
+					event: "install",
+					source: normalizedSource,
+					skills: selectedSkills.map((s) => s.name).join(","),
+					agents: targetAgents.join(","),
+					...installGlobally && { global: "1" },
+					skillFiles: JSON.stringify(skillFiles),
+					sourceType: parsed.type
+				});
+			}
+		} else {
+			console.log("[telemetry-debug-2]", JSON.stringify({
+				parsedType: parsed.type,
+				normalizedSource,
+				sourceType: parsed.type,
+				skillFiles: JSON.stringify(skillFiles)
+			}));
+			track({
 				event: "install",
 				source: normalizedSource,
 				skills: selectedSkills.map((s) => s.name).join(","),
@@ -4170,32 +4239,21 @@ async function runAdd(args, options = {}) {
 				skillFiles: JSON.stringify(skillFiles),
 				sourceType: parsed.type
 			});
-		} else track({
-			event: "install",
-			source: normalizedSource,
-			skills: selectedSkills.map((s) => s.name).join(","),
-			agents: targetAgents.join(","),
-			...installGlobally && { global: "1" },
-			skillFiles: JSON.stringify(skillFiles),
-			sourceType: parsed.type
-		});
+		}
 		if (successful.length > 0 && installGlobally && normalizedSource) {
 			const successfulSkillNames = new Set(successful.map((r) => r.skill));
 			let cachedTree;
-			if (parsed.type === "github" && !blobResult) cachedTree = await fetchRepoTree(normalizedSource, parsed.ref, getGitHubToken);
+			if (parsed.type === "github" && true) cachedTree = await fetchRepoTree(normalizedSource, parsed.ref, getGitHubToken);
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
 					let skillFolderHash = "";
 					const skillPathValue = skillFiles[skill.name];
-					if (blobResult && skillPathValue) {
-						const hash = getSkillFolderHashFromTree(blobResult.tree, skillPathValue);
-						if (hash) skillFolderHash = hash;
-					} else if (parsed.type === "github" && skillPathValue && cachedTree) {
+					if (parsed.type === "github" && skillPathValue && cachedTree) {
 						const hash = getSkillFolderHashFromTree(cachedTree, skillPathValue);
 						if (hash) skillFolderHash = hash;
 					} else if (skillPathValue && tempDir) {
-						const hash = await computeSkillFolderHash(join(tempDir, dirname(skillPathValue)));
+						const hash = await computeSkillFolderHash(join$1(tempDir, dirname$1(skillPathValue)));
 						if (hash) skillFolderHash = hash;
 					}
 					await addSkillToLock(skill.name, {
@@ -4217,7 +4275,7 @@ async function runAdd(args, options = {}) {
 			for (const skill of selectedSkills) {
 				const skillDisplayName = getSkillDisplayName(skill);
 				if (successfulSkillNames.has(skillDisplayName)) try {
-					const computedHash = blobResult && "snapshotHash" in skill ? skill.snapshotHash : tempDir && skill.path === tempDir && skill.rawContent ? computeSingleFileSkillHash(skill.rawContent) : await computeSkillFolderHash(skill.path);
+					const computedHash = tempDir && skill.path === tempDir && skill.rawContent ? computeSingleFileSkillHash(skill.rawContent) : await computeSkillFolderHash(skill.path);
 					const skillPathValue = skillFiles[skill.name];
 					await addSkillToLocalLock(skill.name, {
 						source: lockSource || parsed.url,
@@ -4391,24 +4449,188 @@ function parseAddOptions(args) {
 			}
 			i--;
 		} else if (arg === "--dangerously-accept-openclaw-risks") options.dangerouslyAcceptOpenclawRisks = true;
-		else if (arg && !arg.startsWith("-")) source.push(arg);
+		else if (arg === "-v" || arg === "--version") {
+			i++;
+			options.version = args[i];
+		} else if (arg && !arg.startsWith("-")) source.push(arg);
 	}
 	return {
 		source,
 		options
 	};
 }
+function parseAuditOptions(args) {
+	const errors = [];
+	let skillId = "";
+	for (const arg of args) if (arg && !arg.startsWith("-")) {
+		skillId = arg.trim();
+		break;
+	}
+	if (!skillId) errors.push("Missing skill id");
+	return {
+		skillId: normalizeSkillId(skillId),
+		errors
+	};
+}
+async function fetchSkillAudit(skillId, timeoutMs = 15e3) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const url = AUDIT_URL.replace("{skill_id}", skillId);
+		let response;
+		try {
+			response = await fetch(url, { signal: controller.signal });
+		} catch {
+			return {
+				status: "error",
+				message: `无法连接审计服务: ${AUDIT_URL}`
+			};
+		}
+		if (response.status === 404) return { status: "not_found" };
+		if (!response.ok) return {
+			status: "error",
+			message: `审计服务返回 HTTP ${response.status}`
+		};
+		let data;
+		try {
+			data = await response.json();
+		} catch {
+			return {
+				status: "error",
+				message: "审计服务响应格式无效"
+			};
+		}
+		if (data.error) return {
+			status: "no_audit",
+			message: String(data.error)
+		};
+		const auditData = data.data || data;
+		return {
+			status: "ok",
+			data: {
+				risk_level: auditData.risk_level ?? "unknown",
+				risk_score: auditData.risk_score ?? null,
+				risk_signals: auditData.risk_signals ?? [],
+				audited_at: auditData.audited_at ?? null,
+				audit_type: auditData.audit_type ?? null,
+				details: auditData.details ?? null
+			}
+		};
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+function riskColor(level) {
+	switch (level) {
+		case "critical":
+		case "high": return import_picocolors.default.red;
+		case "medium": return import_picocolors.default.yellow;
+		case "low":
+		case "safe": return import_picocolors.default.green;
+		default: return import_picocolors.default.dim;
+	}
+}
+const RISK_LABELS = {
+	critical: "Critical",
+	high: "High",
+	medium: "Medium",
+	low: "Low",
+	safe: "Safe"
+};
+function riskLabel(level) {
+	const color = riskColor(level);
+	const label = RISK_LABELS[level] || level || "Unknown";
+	return level === "critical" ? color(import_picocolors.default.bold(label)) : color(label);
+}
+function severityColor(severity) {
+	const s = severity.toLowerCase();
+	if (s === "critical" || s === "high") return import_picocolors.default.red(severity);
+	if (s === "medium") return import_picocolors.default.yellow(severity);
+	if (s === "low") return import_picocolors.default.green(severity);
+	return import_picocolors.default.dim(severity);
+}
+function buildAuditOutput(skillId, data) {
+	const lines = [];
+	lines.push(`${import_picocolors.default.bold("Skill:")} ${import_picocolors.default.cyan(skillId)}`);
+	const color = riskColor(data.risk_level);
+	const score = data.risk_score != null ? color(`(score ${data.risk_score})`) : color("(score --)");
+	lines.push(`${import_picocolors.default.bold("Risk:")} ${riskLabel(data.risk_level)} ${score}`);
+	if (data.audited_at) lines.push(`${import_picocolors.default.bold("Audited at:")} ${import_picocolors.default.dim(data.audited_at)}`);
+	lines.push("");
+	if (data.risk_signals.length === 0) {
+		lines.push(import_picocolors.default.green("No risk signals detected."));
+		return lines;
+	}
+	lines.push(import_picocolors.default.bold("Risk signals:"));
+	for (const signal of data.risk_signals) {
+		const severity = severityColor(signal.severity || "unknown");
+		lines.push(`  ${import_picocolors.default.bold(signal.name)}  ${import_picocolors.default.dim(`[${severity}]`)}`);
+		if (signal.description) lines.push(`    ${import_picocolors.default.dim(signal.description)}`);
+	}
+	return lines;
+}
+async function runAudit(args) {
+	const { skillId, errors } = parseAuditOptions(args);
+	if (errors.length > 0) {
+		for (const error of errors) console.error(import_picocolors.default.red(error));
+		console.error("Usage: wittyhub audit <skill_id>");
+		return;
+	}
+	const result = await fetchSkillAudit(skillId);
+	track({
+		event: "audit",
+		skillId,
+		found: result.status === "ok" ? "1" : "0"
+	});
+	switch (result.status) {
+		case "ok":
+			for (const line of buildAuditOutput(skillId, result.data)) console.log(line);
+			break;
+		case "no_audit":
+			console.log(`${import_picocolors.default.yellow("No audit result yet.")} ${import_picocolors.default.dim(result.message)}`);
+			break;
+		case "not_found":
+			console.error(import_picocolors.default.red(`Skill not found: ${skillId}`));
+			break;
+		case "error":
+			console.error(import_picocolors.default.red(result.message));
+			break;
+	}
+}
 const RESET$3 = "\x1B[0m";
 const BOLD$3 = "\x1B[1m";
 const DIM$3 = "\x1B[38;5;102m";
 const TEXT$2 = "\x1B[38;5;145m";
 const CYAN$1 = "\x1B[36m";
-const SEARCH_API_BASE = process.env.SKILLS_API_URL || "https://skills.sh";
-function formatInstalls(count) {
-	if (!count || count <= 0) return "";
-	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
-	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K installs`;
-	return `${count} install${count === 1 ? "" : "s"}`;
+const MAGENTA = "\x1B[35m";
+const YELLOW$1 = "\x1B[33m";
+const RED = "\x1B[31m";
+const GREEN = "\x1B[32m";
+function formatInstalls$1(count) {
+	if (count === void 0 || count === null || Number.isNaN(count)) return "0";
+	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M`;
+	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K`;
+	return String(count);
+}
+function formatRiskLevel$1(riskScore) {
+	if (riskScore === void 0 || riskScore === null) return "";
+	if (riskScore <= 20) return `${GREEN}safe${RESET$3}`;
+	if (riskScore <= 50) return `${GREEN}low${RESET$3}`;
+	if (riskScore <= 80) return `${YELLOW$1}medium${RESET$3}`;
+	return `${RED}high${RESET$3}`;
+}
+const KV_KEY_WIDTH = 12;
+function kvKey(key) {
+	return `${DIM$3}${key.padEnd(KV_KEY_WIDTH)}${RESET$3}`;
+}
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function highlightMatches(text, query) {
+	if (!text || !query) return text;
+	const terms = query.trim().split(/\s+/).filter(Boolean).map(escapeRegExp);
+	if (terms.length === 0) return text;
+	return text.replace(new RegExp(`(${terms.join("|")})`, "gi"), `${MAGENTA}$1${RESET$3}`);
 }
 const GITHUB_OWNER_PATTERN = /^[a-z0-9](?:[a-z0-9-]{0,38})$/i;
 function parseFindOptions(args) {
@@ -4422,7 +4644,7 @@ function parseFindOptions(args) {
 		if (arg === "--owner") {
 			const value = args[i + 1];
 			if (!value || value.startsWith("-")) {
-				errors.push("--owner requires a GitHub owner");
+				errors.push("--owner requires an owner");
 				continue;
 			}
 			ownerValue = value;
@@ -4430,7 +4652,7 @@ function parseFindOptions(args) {
 		} else if (arg.startsWith("--owner=")) {
 			ownerValue = arg.slice(8);
 			if (!ownerValue) {
-				errors.push("--owner requires a GitHub owner");
+				errors.push("--owner requires an owner");
 				continue;
 			}
 		} else {
@@ -4439,7 +4661,7 @@ function parseFindOptions(args) {
 		}
 		const owner = ownerValue.trim().toLowerCase();
 		if (!GITHUB_OWNER_PATTERN.test(owner)) {
-			errors.push("--owner must be a valid GitHub owner");
+			errors.push("--owner must be a valid owner");
 			continue;
 		}
 		options.owner = owner;
@@ -4451,24 +4673,52 @@ function parseFindOptions(args) {
 	};
 }
 async function searchSkillsAPI(query, owner) {
+	const url = `${SEARCH_URL}?${new URLSearchParams({
+		q: query,
+		limit: "10",
+		mode: "text"
+	}).toString()}`;
+	let res;
 	try {
-		const params = new URLSearchParams({
-			q: query,
-			limit: "10"
-		});
-		if (owner) params.set("owner", owner);
-		const url = `${SEARCH_API_BASE}/api/search?${params.toString()}`;
-		const res = await fetch(url);
-		if (!res.ok) return [];
-		return (await res.json()).skills.map((skill) => ({
-			name: sanitizeMetadata(skill.name),
-			slug: sanitizeMetadata(skill.id),
-			source: sanitizeMetadata(skill.source || ""),
-			installs: skill.installs
-		})).sort((a, b) => (b.installs || 0) - (a.installs || 0));
+		res = await fetch(url);
 	} catch {
-		return [];
+		return {
+			skills: [],
+			error: `无法连接搜索服务: ${SEARCH_URL}`
+		};
 	}
+	if (!res.ok) return {
+		skills: [],
+		error: `搜索服务返回 HTTP ${res.status}`
+	};
+	let data;
+	try {
+		data = await res.json();
+	} catch {
+		return {
+			skills: [],
+			error: "搜索服务响应格式无效"
+		};
+	}
+	let skills = (data.data?.results ?? data.results ?? []).map((skill) => ({
+		name: sanitizeMetadata(skill.name),
+		slug: sanitizeMetadata(skill.skill_id),
+		source: sanitizeMetadata(skill.source || ""),
+		installs: skill.download_count || 0,
+		description: skill.description ? sanitizeMetadata(skill.description) : void 0,
+		riskScore: skill.risk_score ?? void 0,
+		sourceUrl: skill.source_url ? sanitizeMetadata(skill.source_url) : void 0
+	}));
+	if (owner) {
+		const ownerLower = owner.toLowerCase();
+		skills = skills.filter((skill) => {
+			if (skill.sourceUrl) try {
+				if (new URL(skill.sourceUrl).pathname.split("/").filter(Boolean)[0]?.toLowerCase() === ownerLower) return true;
+			} catch {}
+			return skill.slug.toLowerCase().includes(`/${ownerLower}/`);
+		});
+	}
+	return { skills: skills.sort((a, b) => (b.installs || 0) - (a.installs || 0)) };
 }
 const HIDE_CURSOR = "\x1B[?25l";
 const SHOW_CURSOR = "\x1B[?25h";
@@ -4480,6 +4730,7 @@ async function runSearchPrompt(initialQuery = "", owner) {
 	let selectedIndex = 0;
 	let query = initialQuery;
 	let loading = false;
+	let searchError = null;
 	let debounceTimer = null;
 	let lastRenderedLines = 0;
 	if (process.stdin.isTTY) process.stdin.setRawMode(true);
@@ -4495,19 +4746,26 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		lines.push("");
 		if (!query || query.length < 2) lines.push(`${DIM$3}Start typing to search (min 2 chars)${RESET$3}`);
 		else if (results.length === 0 && loading) lines.push(`${DIM$3}Searching...${RESET$3}`);
+		else if (results.length === 0 && searchError) lines.push(`${RED}${searchError}${RESET$3}`);
 		else if (results.length === 0) lines.push(`${DIM$3}No skills found${RESET$3}`);
 		else {
-			const visible = results.slice(0, 8);
+			const visible = results.slice(0, 6);
 			for (let i = 0; i < visible.length; i++) {
 				const skill = visible[i];
 				const isSelected = i === selectedIndex;
 				const arrow = isSelected ? `${BOLD$3}>${RESET$3}` : " ";
-				const name = isSelected ? `${BOLD$3}${skill.name}${RESET$3}` : `${TEXT$2}${skill.name}${RESET$3}`;
-				const source = skill.source ? ` ${DIM$3}${skill.source}${RESET$3}` : "";
-				const installs = formatInstalls(skill.installs);
-				const installsBadge = installs ? ` ${CYAN$1}${installs}${RESET$3}` : "";
+				const hlName = highlightMatches(skill.name, query);
+				const name = isSelected ? `${BOLD$3}${hlName}${RESET$3}` : `${TEXT$2}${hlName}${RESET$3}`;
+				const risk = formatRiskLevel$1(skill.riskScore);
 				const loadingIndicator = loading && i === 0 ? ` ${DIM$3}...${RESET$3}` : "";
-				lines.push(`  ${arrow} ${name}${source}${installsBadge}${loadingIndicator}`);
+				lines.push(`  ${arrow} ${kvKey("skill_name:")} ${name}${loadingIndicator}`);
+				lines.push(`    ${kvKey("skill_id:")} ${CYAN$1}${skill.slug}${RESET$3}`);
+				lines.push(`    ${kvKey("installs:")} ${CYAN$1}${formatInstalls$1(skill.installs)}${RESET$3}`);
+				if (risk) lines.push(`    ${kvKey("risk:")} ${risk}`);
+				if (skill.description) {
+					const descPlain = skill.description.length > 80 ? `${skill.description.slice(0, 77)}...` : skill.description;
+					lines.push(`    ${kvKey("description:")} ${DIM$3}${highlightMatches(descPlain, query)}${RESET$3}`);
+				}
 			}
 		}
 		lines.push("");
@@ -4523,6 +4781,7 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		loading = false;
 		if (!q || q.length < 2) {
 			results = [];
+			searchError = null;
 			selectedIndex = 0;
 			render();
 			return;
@@ -4532,10 +4791,13 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		const debounceMs = Math.max(150, 350 - q.length * 50);
 		debounceTimer = setTimeout(async () => {
 			try {
-				results = await searchSkillsAPI(q, owner);
+				const result = await searchSkillsAPI(q, owner);
+				results = result.skills;
+				searchError = result.error ?? null;
 				selectedIndex = 0;
 			} catch {
 				results = [];
+				searchError = null;
 			} finally {
 				loading = false;
 				debounceTimer = null;
@@ -4592,49 +4854,47 @@ async function runSearchPrompt(initialQuery = "", owner) {
 		process.stdin.on("keypress", handleKeypress);
 	});
 }
-function getOwnerRepoFromString(pkg) {
-	const atIndex = pkg.lastIndexOf("@");
-	const match = (atIndex > 0 ? pkg.slice(0, atIndex) : pkg).match(/^([^/]+)\/([^/]+)$/);
-	if (match) return {
-		owner: match[1],
-		repo: match[2]
-	};
-	return null;
-}
-async function isRepoPublic(owner, repo) {
-	return await isRepoPrivate(owner, repo) === false;
-}
 async function runFind(args) {
 	const { query, options: findOptions, errors } = parseFindOptions(args);
 	const owner = findOptions.owner;
 	const isNonInteractive = !process.stdin.isTTY;
 	const agentTip = `${DIM$3}Tip: if running in a coding agent, follow these steps:${RESET$3}
 ${DIM$3}  1) npx wittyhub find [query] [--owner <owner>]${RESET$3}
-${DIM$3}  2) npx wittyhub add <owner/repo@skill>${RESET$3}`;
+${DIM$3}  2) npx wittyhub add <skill_id>${RESET$3}`;
 	if (errors.length > 0) {
 		for (const error of errors) console.error(error);
-		console.error("Usage: npx skills find <query> [--owner <owner>]");
+		console.error("Usage: npx wittyhub find <query> [--owner <owner>]");
 		return;
 	}
 	if (query) {
-		const results = await searchSkillsAPI(query, owner);
+		const { skills: results, error: searchError } = await searchSkillsAPI(query, owner);
 		track({
 			event: "find",
 			query,
 			resultCount: String(results.length)
 		});
+		if (searchError) {
+			console.error(`${RED}${searchError}${RESET$3}`);
+			return;
+		}
 		if (results.length === 0) {
 			const ownerSuffix = owner ? ` from owner "${owner}"` : "";
 			console.log(`${DIM$3}No skills found for "${query}"${ownerSuffix}${RESET$3}`);
 			return;
 		}
-		console.log(`${DIM$3}Install with${RESET$3} npx wittyhub add <owner/repo@skill>`);
+		console.log(`${DIM$3}Install with${RESET$3} npx wittyhub add ${TEXT$2}<skill_id>${RESET$3}`);
 		console.log();
 		for (const skill of results.slice(0, 6)) {
-			const pkg = skill.source || skill.slug;
-			const installs = formatInstalls(skill.installs);
-			console.log(`${TEXT$2}${pkg}@${skill.name}${RESET$3}${installs ? ` ${CYAN$1}${installs}${RESET$3}` : ""}`);
-			console.log(`${DIM$3}└ https://skills.sh/${skill.slug}${RESET$3}`);
+			const hlName = highlightMatches(skill.name, query);
+			const risk = formatRiskLevel$1(skill.riskScore);
+			console.log(`${BOLD$3}●${RESET$3} ${kvKey("skill_name:")} ${BOLD$3}${hlName}${RESET$3}`);
+			console.log(`  ${kvKey("skill_id:")} ${CYAN$1}${skill.slug}${RESET$3}`);
+			console.log(`  ${kvKey("installs:")} ${CYAN$1}${formatInstalls$1(skill.installs)}${RESET$3}`);
+			if (risk) console.log(`  ${kvKey("risk:")} ${risk}`);
+			if (skill.description) {
+				const descPlain = skill.description.length > 100 ? `${skill.description.slice(0, 97)}...` : skill.description;
+				console.log(`  ${kvKey("description:")} ${DIM$3}${highlightMatches(descPlain, query)}${RESET$3}`);
+			}
 			console.log();
 		}
 		return;
@@ -4657,26 +4917,154 @@ ${DIM$3}  2) npx wittyhub add <owner/repo@skill>${RESET$3}`;
 		console.log();
 		return;
 	}
-	const pkg = selected.source || selected.slug;
+	const skillId = selected.slug;
 	const skillName = selected.name;
 	console.log();
-	console.log(`${TEXT$2}Installing ${BOLD$3}${skillName}${RESET$3} from ${DIM$3}${pkg}${RESET$3}...`);
+	console.log(`${TEXT$2}Installing ${BOLD$3}${skillName}${RESET$3} ${DIM$3}(${skillId})${RESET$3}...`);
 	console.log();
-	const { source, options: addOptions } = parseAddOptions([
-		pkg,
-		"--skill",
-		skillName
-	]);
+	const { source, options: addOptions } = parseAddOptions([skillId]);
 	await runAdd(source, addOptions);
 	console.log();
-	const info = getOwnerRepoFromString(pkg);
-	if (info && await isRepoPublic(info.owner, info.repo)) console.log(`${DIM$3}View the skill at${RESET$3} ${TEXT$2}https://skills.sh/${selected.slug}${RESET$3}`);
-	else console.log(`${DIM$3}Discover more skills at${RESET$3} ${TEXT$2}https://skills.sh${RESET$3}`);
+	console.log(`${DIM$3}View the skill at${RESET$3} ${TEXT$2}https://skillhub.openeuler.org/skills/${selected.slug}${RESET$3}`);
 	console.log();
 }
+function parseGetOptions(args) {
+	const errors = [];
+	let skillId = "";
+	for (const arg of args) if (arg && !arg.startsWith("-")) {
+		skillId = arg.trim();
+		break;
+	}
+	if (!skillId) errors.push("Missing skill id");
+	return {
+		skillId: normalizeSkillId(skillId),
+		errors
+	};
+}
+async function fetchSkillDetail(skillId, timeoutMs = 15e3) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), timeoutMs);
+	try {
+		const url = GET_URL.replace("{skill_id}", skillId);
+		let response;
+		try {
+			response = await fetch(url, { signal: controller.signal });
+		} catch {
+			return {
+				status: "error",
+				message: `无法连接详情服务: ${GET_URL}`
+			};
+		}
+		if (response.status === 404) return { status: "not_found" };
+		if (!response.ok) return {
+			status: "error",
+			message: `详情服务返回 HTTP ${response.status}`
+		};
+		let data;
+		try {
+			data = await response.json();
+		} catch {
+			return {
+				status: "error",
+				message: "详情服务响应格式无效"
+			};
+		}
+		if (data.error) return {
+			status: "error",
+			message: String(data.error)
+		};
+		const skillData = data.data || data;
+		return {
+			status: "ok",
+			data: {
+				skill_id: skillData.skill_id ?? skillId,
+				name: skillData.name ?? "",
+				description: skillData.description ?? null,
+				version: skillData.version ?? null,
+				commit_id: skillData.commit_id ?? null,
+				author: skillData.author ?? null,
+				source: skillData.source ?? "",
+				source_url: skillData.source_url ?? "",
+				repo_url: skillData.repo_url ?? null,
+				category: skillData.category ?? null,
+				tags: Array.isArray(skillData.tags) ? skillData.tags : null,
+				platform: skillData.platform ?? null,
+				metadata: skillData.metadata ?? null,
+				risk_score: skillData.risk_score ?? null,
+				download_count: skillData.download_count ?? 0,
+				period_downloads: skillData.period_downloads ?? null,
+				rating: skillData.rating ?? null,
+				created_at: skillData.created_at ?? null,
+				updated_at: skillData.updated_at ?? null,
+				last_indexed_at: skillData.last_indexed_at ?? null
+			}
+		};
+	} finally {
+		clearTimeout(timeout);
+	}
+}
+function formatInstalls(count) {
+	if (count === void 0 || count === null || Number.isNaN(count)) return "0 installs";
+	if (count <= 0) return "0 installs";
+	if (count >= 1e6) return `${(count / 1e6).toFixed(1).replace(/\.0$/, "")}M installs`;
+	if (count >= 1e3) return `${(count / 1e3).toFixed(1).replace(/\.0$/, "")}K installs`;
+	return `${count} install${count === 1 ? "" : "s"}`;
+}
+function formatRiskLevel(riskScore) {
+	if (riskScore === void 0 || riskScore === null) return import_picocolors.default.dim("unknown risk");
+	if (riskScore <= 20) return import_picocolors.default.green("safe risk");
+	if (riskScore <= 50) return import_picocolors.default.green("low risk");
+	if (riskScore <= 80) return import_picocolors.default.yellow("medium risk");
+	return import_picocolors.default.red("high risk");
+}
+function buildGetOutput(data) {
+	const lines = [];
+	lines.push(`${import_picocolors.default.bold("Skill:")} ${import_picocolors.default.cyan(data.skill_id)}`);
+	if (data.name) lines.push(`${import_picocolors.default.bold("Name:")} ${data.name}`);
+	if (data.description) lines.push(`${import_picocolors.default.bold("Description:")} ${data.description}`);
+	if (data.author) lines.push(`${import_picocolors.default.bold("Author:")} ${data.author}`);
+	if (data.category) lines.push(`${import_picocolors.default.bold("Category:")} ${data.category}`);
+	if (data.version) lines.push(`${import_picocolors.default.bold("Version:")} ${data.version}`);
+	if (data.tags && data.tags.length > 0) lines.push(`${import_picocolors.default.bold("Tags:")} ${data.tags.join(", ")}`);
+	if (data.platform) lines.push(`${import_picocolors.default.bold("Platform:")} ${data.platform}`);
+	if (data.source) lines.push(`${import_picocolors.default.bold("Source:")} ${data.source}`);
+	if (data.source_url) lines.push(`${import_picocolors.default.bold("Source URL:")} ${import_picocolors.default.dim(data.source_url)}`);
+	if (data.repo_url) lines.push(`${import_picocolors.default.bold("Repo URL:")} ${import_picocolors.default.dim(data.repo_url)}`);
+	lines.push(`${import_picocolors.default.bold("Installs:")} ${import_picocolors.default.cyan(formatInstalls(data.download_count))}`);
+	const riskLabel = formatRiskLevel(data.risk_score);
+	const score = data.risk_score === void 0 || data.risk_score === null ? "" : import_picocolors.default.dim(` (score ${data.risk_score})`);
+	lines.push(`${import_picocolors.default.bold("Risk:")} ${riskLabel}${score}`);
+	if (data.updated_at) lines.push(`${import_picocolors.default.bold("Updated at:")} ${import_picocolors.default.dim(data.updated_at)}`);
+	return lines;
+}
+async function runGet(args) {
+	const { skillId, errors } = parseGetOptions(args);
+	if (errors.length > 0) {
+		for (const error of errors) console.error(import_picocolors.default.red(error));
+		console.error("Usage: wittyhub get <skill_id>");
+		return;
+	}
+	const result = await fetchSkillDetail(skillId);
+	track({
+		event: "get",
+		skillId,
+		found: result.status === "ok" ? "1" : "0"
+	});
+	switch (result.status) {
+		case "ok":
+			for (const line of buildGetOutput(result.data)) console.log(line);
+			break;
+		case "not_found":
+			console.error(import_picocolors.default.red(`Skill not found: ${skillId}`));
+			break;
+		case "error":
+			console.error(import_picocolors.default.red(result.message));
+			break;
+	}
+}
 const isCancelled = (value) => typeof value === "symbol";
 function shortenPath$1(fullPath, cwd) {
-	const home = homedir();
+	const home = homedir$1();
 	if (fullPath === home || fullPath.startsWith(home + sep)) return "~" + fullPath.slice(home.length);
 	if (fullPath === cwd || fullPath.startsWith(cwd + sep)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
@@ -5031,7 +5419,7 @@ const DIM$2 = "\x1B[38;5;102m";
 const CYAN = "\x1B[36m";
 const YELLOW = "\x1B[33m";
 function shortenPath(fullPath, cwd) {
-	const home = homedir();
+	const home = homedir$1();
 	if (fullPath.startsWith(home)) return fullPath.replace(home, "~");
 	if (fullPath.startsWith(cwd)) return "." + fullPath.slice(cwd.length);
 	return fullPath;
@@ -5162,6 +5550,26 @@ async function runList(args) {
 		console.log();
 	}
 }
+function extractSkillName(input) {
+	try {
+		const parsed = parseSource(input);
+		if (parsed.subpath) {
+			const segments = parsed.subpath.split("/");
+			const last = segments[segments.length - 1];
+			if (last) return last;
+		}
+		if (parsed.type !== "local" && parsed.url) {
+			const match = parsed.url.match(/\/([^/]+)\.git$/);
+			if (match?.[1]) return match[1];
+		}
+	} catch {}
+	if (input.includes("/")) {
+		const segments = input.replace(/\.git$/, "").split("/");
+		const last = segments[segments.length - 1];
+		if (last) return last;
+	}
+	return input;
+}
 async function removeCommand(skillNames, options) {
 	const agentResult = await detectAgent();
 	if (agentResult.isAgent) {
@@ -5207,7 +5615,10 @@ async function removeCommand(skillNames, options) {
 	let selectedSkills = [];
 	if (options.all) selectedSkills = installedSkills;
 	else if (skillNames.length > 0) {
-		selectedSkills = installedSkills.filter((s) => skillNames.some((name) => name.toLowerCase() === s.toLowerCase()));
+		selectedSkills = installedSkills.filter((s) => skillNames.some((name) => {
+			if (name.toLowerCase() === s.toLowerCase()) return true;
+			return extractSkillName(name).toLowerCase() === s.toLowerCase();
+		}));
 		if (selectedSkills.length === 0) {
 			M.error(`No matching skills found for: ${skillNames.join(", ")}`);
 			return;
@@ -5268,7 +5679,7 @@ async function removeCommand(skillNames, options) {
 			for (const pathToCleanup of pathsToCleanup) {
 				if (pathToCleanup === canonicalPath) continue;
 				try {
-					if (await lstat(pathToCleanup).catch(() => null)) await rm(pathToCleanup, {
+					if (await lstat(pathToCleanup).catch(() => null)) await rm$1(pathToCleanup, {
 						recursive: true,
 						force: true
 					});
@@ -5286,7 +5697,7 @@ async function removeCommand(skillNames, options) {
 			isStillUsed = true;
 			break;
 		}
-		if (!isStillUsed) await rm(canonicalPath, {
+		if (!isStillUsed) await rm$1(canonicalPath, {
 			recursive: true,
 			force: true
 		});
@@ -5934,7 +6345,7 @@ function buildUsePrompt(input) {
 	return sections.join("\n\n") + "\n";
 }
 async function materializeUseSkill(skill) {
-	const tempRoot = await mkdtemp(join(tmpdir(), "skills-use-"));
+	const tempRoot = await mkdtemp$1(join(tmpdir$1(), "skills-use-"));
 	const skillDir = join(tempRoot, sanitizeName(skill.directoryName || skill.name));
 	if (!isPathSafe(tempRoot, skillDir)) throw new Error("Invalid skill name: potential path traversal detected");
 	await mkdir(skillDir, { recursive: true });
@@ -6161,8 +6572,8 @@ async function writeSafeFile(targetDir, filePath, contents) {
 	const fullPath = join(targetDir, filePath);
 	if (!isPathSafe(targetDir, fullPath)) return;
 	await mkdir(dirname(fullPath), { recursive: true });
-	if (typeof contents === "string") await writeFile(fullPath, contents, "utf-8");
-	else await writeFile(fullPath, contents);
+	if (typeof contents === "string") await writeFile$1(fullPath, contents, "utf-8");
+	else await writeFile$1(fullPath, contents);
 }
 async function copySkillDirectory(src, dest) {
 	await mkdir(dest, { recursive: true });
@@ -6222,6 +6633,308 @@ function fail(message) {
 	process.exit(1);
 }
 var UseCommandError = class extends Error {};
+const CANONICAL_CATEGORIES = new Set([
+	"Research and Design",
+	"Development and Build",
+	"Engineering and Compilation",
+	"Quality and Validation",
+	"Release and Deployment",
+	"Monitoring and Operations",
+	"Performance Optimization",
+	"Security Hardening",
+	"others"
+]);
+const NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+const SEMVER_PATTERN = /^\d+\.\d+\.\d+(?:-[\w.]+)?(?:\+[\w.]+)?$/;
+function parseValidateOptions(args) {
+	let path = "";
+	const options = {};
+	const errors = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--json") options.json = true;
+		else if (arg === "-h" || arg === "--help") {} else if (arg && !arg.startsWith("-")) if (!path) path = arg.trim();
+		else errors.push(`Unexpected argument: ${arg}`);
+		else if (arg) errors.push(`Unknown option: ${arg}`);
+	}
+	if (!path) errors.push("Missing required argument: <path>");
+	return {
+		path,
+		options,
+		errors
+	};
+}
+async function runValidate(args) {
+	const { path, options, errors } = parseValidateOptions(args);
+	if (errors.length > 0) {
+		for (const e of errors) console.error(import_picocolors.default.red(`error: ${e}`));
+		console.error(`\nRun ${import_picocolors.default.cyan("wittyhub validate --help")} for usage.\n`);
+		return null;
+	}
+	const result = await validateSkill(resolve(path));
+	if (options.json) console.log(JSON.stringify(result, null, 2));
+	else printResult(result);
+	return result;
+}
+async function validateSkill(absPath) {
+	const errors = [];
+	const warnings = [];
+	let skillDir = absPath;
+	let skillMdPath = null;
+	let stats;
+	try {
+		stats = await stat(absPath);
+	} catch {
+		errors.push({
+			id: "path-not-found",
+			severity: "error",
+			message: `Path does not exist: ${absPath}`,
+			hint: "Pass the skill directory (e.g. ./my-skill) or the SKILL.md file path."
+		});
+		return {
+			path: absPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	if (stats.isFile()) {
+		const filename = basename(absPath);
+		if (filename !== "SKILL.md") {
+			errors.push({
+				id: "filename-must-be-skill-md",
+				severity: "error",
+				message: `File must be named "SKILL.md" (got "${filename}")`,
+				hint: "Rename the file to SKILL.md (uppercase). The agent skill spec requires this exact filename."
+			});
+			return {
+				path: absPath,
+				errors,
+				warnings,
+				ok: false
+			};
+		}
+		skillMdPath = absPath;
+		skillDir = dirname(absPath);
+	} else if (stats.isDirectory()) {
+		const expected = join(absPath, "SKILL.md");
+		try {
+			await stat(expected);
+			skillMdPath = expected;
+		} catch {
+			errors.push({
+				id: "missing-skill-md",
+				severity: "error",
+				message: `No SKILL.md found in directory: ${absPath}`,
+				hint: "Create one with `wittyhub init <name>` or rename an existing markdown file to SKILL.md (uppercase)."
+			});
+			return {
+				path: absPath,
+				errors,
+				warnings,
+				ok: false
+			};
+		}
+	} else {
+		errors.push({
+			id: "path-invalid-type",
+			severity: "error",
+			message: `Path is neither a file nor a directory: ${absPath}`
+		});
+		return {
+			path: absPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	try {
+		const lowerMdFile = (await readdir(skillDir)).find((e) => e.toLowerCase() === "skill.md" && e !== "SKILL.md");
+		if (lowerMdFile) warnings.push({
+			id: "case-variant-found",
+			severity: "warning",
+			message: `Found a case-variant file "${lowerMdFile}" alongside SKILL.md`,
+			hint: "Only \"SKILL.md\" (all uppercase) is recognized by the agent spec. Remove the variant to avoid confusion."
+		});
+	} catch {}
+	const content = await readFile(skillMdPath, "utf-8");
+	const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/);
+	if (!match) {
+		errors.push({
+			id: "frontmatter-missing",
+			severity: "error",
+			message: "SKILL.md must start with a YAML frontmatter block delimited by \"---\"",
+			hint: "Add a frontmatter block at the top:\n\n  ---\n  name: my-skill\n  description: what it does\n  ---"
+		});
+		return {
+			path: skillMdPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	match[1];
+	const body = match[2] ?? "";
+	const { data: fm } = parseFrontmatter(content);
+	if (!fm || typeof fm !== "object" || Array.isArray(fm)) {
+		errors.push({
+			id: "frontmatter-not-object",
+			severity: "error",
+			message: "Frontmatter must be a YAML mapping (key-value pairs), not a scalar or list."
+		});
+		return {
+			path: skillMdPath,
+			errors,
+			warnings,
+			ok: false
+		};
+	}
+	if (fm.name === void 0 || fm.name === null || fm.name === "") errors.push({
+		id: "name-required",
+		severity: "error",
+		message: "Missing required frontmatter field: name",
+		hint: "Add `name: <skill-name>` to the frontmatter."
+	});
+	else if (typeof fm.name !== "string") errors.push({
+		id: "name-not-string",
+		severity: "error",
+		message: `Frontmatter field "name" must be a string (got ${typeof fm.name})`,
+		hint: "Wrap the value in quotes if it contains special characters."
+	});
+	else {
+		if (!NAME_PATTERN.test(fm.name)) warnings.push({
+			id: "name-not-kebab",
+			severity: "warning",
+			message: `Skill name "${fm.name}" is not in kebab-case (lowercase letters, digits, hyphens)`,
+			hint: "Use a name like \"add-or-fix-type-checking\" for best compatibility."
+		});
+		if (basename(skillDir) !== fm.name) warnings.push({
+			id: "name-dirname-mismatch",
+			severity: "warning",
+			message: `Skill name "${fm.name}" does not match directory name "${basename(skillDir)}"`,
+			hint: "For consistency, the directory name and `name` field should match."
+		});
+	}
+	if (fm.description === void 0 || fm.description === null || fm.description === "") errors.push({
+		id: "description-required",
+		severity: "error",
+		message: "Missing required frontmatter field: description",
+		hint: "Add `description: <one-line summary>` to the frontmatter."
+	});
+	else if (typeof fm.description !== "string") errors.push({
+		id: "description-not-string",
+		severity: "error",
+		message: `Frontmatter field "description" must be a string (got ${typeof fm.description})`
+	});
+	else {
+		const desc = fm.description.trim();
+		if (desc.length < 10) warnings.push({
+			id: "description-too-short",
+			severity: "warning",
+			message: `Description is very short (${desc.length} chars): "${desc}"`,
+			hint: "Aim for at least 10-20 characters so users can quickly understand the skill."
+		});
+		if (desc.length > 200) warnings.push({
+			id: "description-too-long",
+			severity: "warning",
+			message: `Description is very long (${desc.length} chars)`,
+			hint: "Keep it under 200 characters for readability in listings."
+		});
+	}
+	if (fm.category !== void 0 && fm.category !== null) {
+		if (typeof fm.category !== "string") warnings.push({
+			id: "category-not-string",
+			severity: "warning",
+			message: `Frontmatter field "category" should be a string (got ${typeof fm.category})`
+		});
+		else if (!CANONICAL_CATEGORIES.has(fm.category)) warnings.push({
+			id: "category-not-canonical",
+			severity: "warning",
+			message: `Category "${fm.category}" is not in the canonical list`,
+			hint: `Valid values: ${[...CANONICAL_CATEGORIES].join(", ")}. See https://gitcode.com/openeuler/openEuler-skills.`
+		});
+	}
+	if (fm.version !== void 0 && fm.version !== null && fm.version !== "") {
+		if (typeof fm.version !== "string") warnings.push({
+			id: "version-not-string",
+			severity: "warning",
+			message: `Frontmatter field "version" should be a string (got ${typeof fm.version})`,
+			hint: "Quote the value, e.g. `version: \"1.0.0\"`."
+		});
+		else if (!SEMVER_PATTERN.test(fm.version.trim())) warnings.push({
+			id: "version-not-semver",
+			severity: "warning",
+			message: `Version "${fm.version}" is not a valid semver`,
+			hint: "Use the form X.Y.Z (e.g. 1.0.0, 0.2.1-beta)."
+		});
+	}
+	if (fm.metadata !== void 0 && (typeof fm.metadata !== "object" || Array.isArray(fm.metadata))) warnings.push({
+		id: "metadata-not-object",
+		severity: "warning",
+		message: `Frontmatter field "metadata" should be a mapping (got ${Array.isArray(fm.metadata) ? "array" : typeof fm.metadata})`
+	});
+	if (body.trim().length === 0) warnings.push({
+		id: "body-empty",
+		severity: "warning",
+		message: "SKILL.md has no body content after the frontmatter",
+		hint: "Add at least a heading and a few instructions for the agent to follow."
+	});
+	else if (!/^#{1,6}\s+\S/m.test(body)) warnings.push({
+		id: "body-no-heading",
+		severity: "warning",
+		message: "Body content has no Markdown headings",
+		hint: "Structure the instructions with headings like `## When to use`, `## Instructions`."
+	});
+	const knownKeys = new Set([
+		"name",
+		"description",
+		"version",
+		"category",
+		"metadata"
+	]);
+	const unknownKeys = Object.keys(fm).filter((k) => !knownKeys.has(k));
+	if (unknownKeys.length > 0) warnings.push({
+		id: "unknown-frontmatter-keys",
+		severity: "warning",
+		message: `Unknown frontmatter keys: ${unknownKeys.join(", ")}`,
+		hint: `Recognized keys: ${[...knownKeys].join(", ")}.`
+	});
+	return {
+		path: skillMdPath,
+		errors,
+		warnings,
+		ok: errors.length === 0
+	};
+}
+function printResult(result) {
+	const { path, errors, warnings, ok } = result;
+	console.log(`${import_picocolors.default.cyan("Path:")} ${path}`);
+	console.log();
+	if (errors.length === 0 && warnings.length === 0) {
+		console.log(import_picocolors.default.green("  All checks passed."));
+		console.log();
+		return;
+	}
+	if (errors.length > 0) {
+		console.log(import_picocolors.default.red(`${errors.length} error(s):`));
+		for (const rule of errors) {
+			console.log(`  ${import_picocolors.default.red("✗")} [${rule.id}] ${rule.message}`);
+			if (rule.hint) console.log(`    ${import_picocolors.default.dim(rule.hint)}`);
+		}
+		console.log();
+	}
+	if (warnings.length > 0) {
+		console.log(import_picocolors.default.yellow(`${warnings.length} warning(s):`));
+		for (const rule of warnings) {
+			console.log(`  ${import_picocolors.default.yellow("!")} [${rule.id}] ${rule.message}`);
+			if (rule.hint) console.log(`    ${import_picocolors.default.dim(rule.hint)}`);
+		}
+		console.log();
+	}
+	if (ok) console.log(import_picocolors.default.green("  Skill is valid.") + import_picocolors.default.yellow(warnings.length > 0 ? ` (with ${warnings.length} warning${warnings.length > 1 ? "s" : ""})` : ""));
+	else console.log(import_picocolors.default.red("  Skill is NOT valid. Fix the errors above."));
+	console.log();
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
 	try {
@@ -6274,11 +6987,12 @@ function showBanner() {
 	console.log();
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub experimental_install${RESET} ${DIM}Restore from skills-lock.json${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub init ${DIM}[name]${RESET}          ${DIM}Create a new skill${RESET}`);
+	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub validate ${DIM}<path>${RESET}   ${DIM}Validate a local skill${RESET}`);
 	console.log(`  ${DIM}$${RESET} ${TEXT}npx wittyhub experimental_sync${RESET}    ${DIM}Sync skills from node_modules${RESET}`);
 	console.log();
-	console.log(`${DIM}try:${RESET} npx wittyhub add vercel-labs/agent-skills`);
+	console.log(`${DIM}try:${RESET} npx wittyhub add gitcode:openeuler/witty-diagnosis-agent`);
 	console.log();
-	console.log(`Discover more skills at ${TEXT}https://skills.sh/${RESET}`);
+	console.log(`Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}`);
 	console.log();
 }
 function showHelp() {
@@ -6294,6 +7008,10 @@ ${BOLD}Manage Skills:${RESET}
   remove [skills]      Remove installed skills
   list, ls             List installed skills
   find [query]         Search for skills interactively
+  audit <skill_id>       Show security audit result (risk level + risk signals)
+  get <skill_id>         View skill details (author/category/version/description/tags)
+  validate <path>     Validate a local skill for spec compliance (SKILL.md filename,
+                       frontmatter, required fields name/description, etc.)
 
 ${BOLD}Find Options:${RESET}
   --owner <owner>        Search only repositories from a GitHub owner
@@ -6308,7 +7026,7 @@ ${BOLD}Update Options:${RESET}
 
 ${BOLD}Project:${RESET}
   experimental_install Restore skills from skills-lock.json
-  init [name]          Initialize a skill (creates <name>/SKILL.md or ./SKILL.md)
+  init [name]          Initialize a skill (creates <name>/SKILL.md; defaults to my-skill/)
   experimental_sync    Sync skills from node_modules into agent directories
 
 ${BOLD}Add Options:${RESET}
@@ -6321,6 +7039,7 @@ ${BOLD}Add Options:${RESET}
   --subagent <names>     Install to Eve subagents (use 'root' for the root agent)
   --all                  Shorthand for --skill '*' --agent '*' -y
   --full-depth           Search all subdirectories even when a root SKILL.md exists
+  -v, --version <ver>    Download a specific skill version from skill_versions table
 
 ${BOLD}Use Options:${RESET}
   -s, --skill <skill>    Specify the skill to use
@@ -6350,12 +7069,9 @@ ${BOLD}Options:${RESET}
   --version, -v     Show version number
 
 ${BOLD}Examples:${RESET}
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills
-  ${DIM}$${RESET} wittyhub use vercel-labs/agent-skills@vercel-optimize | claude
-  ${DIM}$${RESET} wittyhub use vercel-labs/agent-skills --skill vercel-optimize --agent claude-code
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills -g
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills --agent claude-code cursor
-  ${DIM}$${RESET} wittyhub add vercel-labs/agent-skills --skill pr-review commit
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis -g
+  ${DIM}$${RESET} wittyhub add https://gitcode.com/openeuler/witty-diagnosis-agent --skill system-resource-diagnosis --agent claude-code cursor
   ${DIM}$${RESET} wittyhub remove                        ${DIM}# interactive remove${RESET}
   ${DIM}$${RESET} wittyhub remove web-design             ${DIM}# remove by name${RESET}
   ${DIM}$${RESET} wittyhub rm --global frontend-design
@@ -6374,7 +7090,45 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} wittyhub experimental_sync              ${DIM}# sync from node_modules${RESET}
   ${DIM}$${RESET} wittyhub experimental_sync -y           ${DIM}# sync without prompts${RESET}
 
-Discover more skills at ${TEXT}https://skills.sh/${RESET}
+Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}
+`);
+}
+function showInitHelp() {
+	console.log(`
+${BOLD}Usage:${RESET} wittyhub init [name]
+
+${BOLD}Description:${RESET}
+  Initialize a new skill by creating a SKILL.md template.
+
+${BOLD}Arguments:${RESET}
+  name              Optional skill name. Creates <name>/SKILL.md.
+                    If omitted, defaults to my-skill/ (never the cwd itself).
+
+${BOLD}Examples:${RESET}
+  ${DIM}$${RESET} wittyhub init                    ${DIM}# creates my-skill/SKILL.md${RESET}
+  ${DIM}$${RESET} wittyhub init my-skill           ${DIM}# creates my-skill/SKILL.md${RESET}
+  ${DIM}$${RESET} wittyhub init code-reviewer      ${DIM}# creates code-reviewer/SKILL.md${RESET}
+`);
+}
+function showValidateHelp() {
+	console.log(`
+${BOLD}Usage:${RESET} wittyhub validate <path> [options]
+
+${BOLD}Description:${RESET}
+  Validate a local skill for spec compliance (SKILL.md filename, frontmatter,
+  required fields, etc.). Reports errors (must-fix) and warnings (recommended).
+
+${BOLD}Arguments:${RESET}
+  path               Path to the skill directory or SKILL.md file.
+
+${BOLD}Options:${RESET}
+  --json             Output result as JSON (no ANSI colors).
+  -h, --help         Show this help message.
+
+${BOLD}Examples:${RESET}
+  ${DIM}$${RESET} wittyhub validate ./my-skill
+  ${DIM}$${RESET} wittyhub validate ./my-skill/SKILL.md
+  ${DIM}$${RESET} wittyhub validate ./my-skill --json
 `);
 }
 function showRemoveHelp() {
@@ -6404,24 +7158,25 @@ ${BOLD}Examples:${RESET}
   ${DIM}$${RESET} wittyhub remove --all                      ${DIM}# remove all skills${RESET}
   ${DIM}$${RESET} wittyhub remove --skill '*' -a cursor      ${DIM}# remove all skills from cursor${RESET}
 
-Discover more skills at ${TEXT}https://skills.sh/${RESET}
+Discover more skills at ${TEXT}https://skillhub.openeuler.org/${RESET}
 `);
 }
 function runInit(args) {
 	const cwd = process.cwd();
-	const skillName = args[0] || basename(cwd);
-	const hasName = args[0] !== void 0;
-	const skillDir = hasName ? join(cwd, skillName) : cwd;
+	const skillName = args[0] ?? "my-skill";
+	const skillDir = join(cwd, skillName);
 	const skillFile = join(skillDir, "SKILL.md");
-	const displayPath = hasName ? `${skillName}/SKILL.md` : "SKILL.md";
+	const displayPath = `${skillName}/SKILL.md`;
 	if (existsSync(skillFile)) {
 		console.log(`${TEXT}Skill already exists at ${DIM}${displayPath}${RESET}`);
 		return;
 	}
-	if (hasName) mkdirSync(skillDir, { recursive: true });
+	mkdirSync(skillDir, { recursive: true });
 	writeFileSync(skillFile, `---
 name: ${skillName}
 description: A brief description of what this skill does
+version: 0.1.0  # optional; increment as needed
+category: others  # optional;change if needed — full list at https://gitcode.com/openeuler/openEuler-skills
 ---
 
 # ${skillName}
@@ -6446,12 +7201,12 @@ Describe when this skill should be used.
 	console.log(`${DIM}Next steps:${RESET}`);
 	console.log(`  1. Edit ${TEXT}${displayPath}${RESET} to define your skill instructions`);
 	console.log(`  2. Update the ${TEXT}name${RESET} and ${TEXT}description${RESET} in the frontmatter`);
+	console.log(`  3. Optionally set ${TEXT}version${RESET} and ${TEXT}category${RESET} (see the comment in ${TEXT}${displayPath}${RESET} for the full list of categories)`);
 	console.log();
 	console.log(`${DIM}Publishing:${RESET}`);
-	console.log(`  ${DIM}GitHub:${RESET}  Push to a repo, then ${TEXT}npx wittyhub add <owner>/<repo>${RESET}`);
-	console.log(`  ${DIM}URL:${RESET}     Host the file, then ${TEXT}npx wittyhub add https://example.com/${displayPath}${RESET}`);
+	console.log(`  Submit your skill to ${TEXT}https://gitcode.com/openeuler/openEuler-skills${RESET}`);
 	console.log();
-	console.log(`Browse existing skills for inspiration at ${TEXT}https://skills.sh/${RESET}`);
+	console.log(`Browse existing skills for inspiration at ${TEXT}https://skillhub.openeuler.org/${RESET}`);
 	console.log();
 }
 async function main() {
@@ -6473,6 +7228,10 @@ async function main() {
 			await runFind(restArgs);
 			break;
 		case "init":
+			if (restArgs.includes("--help") || restArgs.includes("-h")) {
+				showInitHelp();
+				break;
+			}
 			if (!inAgent) showLogo();
 			console.log();
 			runInit(restArgs);
@@ -6515,6 +7274,24 @@ async function main() {
 		case "ls":
 			await runList(restArgs);
 			break;
+		case "audit":
+			if (!inAgent) showLogo();
+			await runAudit(restArgs);
+			break;
+		case "get":
+			if (!inAgent) showLogo();
+			await runGet(restArgs);
+			break;
+		case "validate":
+		case "check-skill":
+			if (restArgs.includes("--help") || restArgs.includes("-h")) {
+				showValidateHelp();
+				break;
+			}
+			if (!inAgent) showLogo();
+			console.log();
+			await runValidate(restArgs);
+			break;
 		case "check":
 		case "update":
 		case "upgrade":