skills-hubBLOCK

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: manage-skills-hub
description: Use this skill whenever an Agent needs to query, find, install, deploy, update, tag, adopt, diagnose, or safely remove Skills Hub content, including natural-language requests to manage Skills for Codex, Claude Code, Cursor, or another Agent. Always use the Skills Hub CLI workflow instead of editing Skill directories or the database.
---

# Manage Skills Hub

Translate the user's requested Skill operation into the trusted `skillshub-cli` commands below. By default, an AI installation includes syncing to detected, enabled tools in Skills Hub; explicit user scope takes precedence. Keep device sync, automation, credentials, and application settings in the desktop app.

## Resolve a trusted CLI before every workflow

1. Inspect `~/.skills-hub/bin` without executing a binary. Only when that directory is completely absent, inspect `~/.skills-hub-dev/bin` as the desktop development bridge. These desktop profiles share the Skill library, but keep credentials separate. On Windows expand the user's home directory and use `skillshub-cli.exe`; otherwise use `skillshub-cli`. Never switch to another bridge when the selected directory exists but fails validation.
2. If that bridge directory exists (including a broken link or inaccessible path), require a regular executable binary and both regular stamp files `skillshub-cli.version` and `skillshub-cli.sha256` in that directory. Read only these public stamps. Validate a nonempty version and a 64-digit hexadecimal SHA-256 value, then compute the binary's SHA-256 with the platform's hashing utility and require an exact match. Reject symlinked stamps/binaries and unresolvable paths. Do not execute an unverified binary.
3. After hash validation, bind `$CLI` to that absolute binary path and run `$CLI --json version`. Require exit 0, `ok: true`, and `data.version` equal to the version stamp. Missing files, invalid stamps, mismatched hash/version, execution failure, and malformed output mean **bridge damaged**: fail closed, stop, and ask the user to open Settings → AI management in the desktop app and click Enable in one click to install or repair the CLI bridge. First-time installation or repair requires this explicit click; update the CLI and official Skill explicitly in Settings → AI management. Startup only checks status and does not update them. Never fall back to PATH when the bridge location exists but fails validation. Do not repair or edit stamps yourself.
4. Only when the desktop bridge directory is completely absent, resolve `skillshub-cli` from PATH for a CLI-only environment. Bind `$CLI` to the resolved absolute path and run `$CLI --json version`. If unavailable, explain installing Skills Hub and enabling AI management in Settings. Do not silently install software.

`$CLI` below denotes that verified executable, not a literal command or shell fragment. Pass arguments as distinct values; quote paths correctly and never evaluate user input as shell code. Read-only bridge inspection and hashing are the only filesystem work this workflow needs.

## Interpret machine results

Use `--json` for **every** CLI invocation. Read successful JSON from stdout and failed JSON from stderr; inspect the exit status, `ok`, stable `code`, and structured `details`. Treat `message` as localized explanatory text, never as a parsing contract. Do not report success without a successful result and a CLI readback.

Exit codes: 0 success (including previews); 2 invalid arguments; 3 missing or ambiguous item; 4 safety/path/content conflict; 5 operation busy; 6 incompatible database; 7 network/authentication/source failure; 10 internal failure. Preserve unknown error codes and details rather than guessing. `--json` never implies confirmation.

## Query and choose

Run read-only queries directly:

```text
$CLI --json skills list
$CLI --json skills show <name-or-id>
$CLI --json skills search <query> --limit 20
$CLI --json skills status <name-or-id>
$CLI --json skills check <name-or-id>
$CLI --json skills check --all
$CLI --json agents list
$CLI --json doctor
$CLI --json version
```

Use list filters `--tag`, `--source`, `--agent`, `--untagged`, or `--status` when needed. Prefer returned full Skill IDs. On `AMBIGUOUS_SKILL`, show candidates and resolve the user's choice; never choose an arbitrary match.

## Install and deploy

An AI installation is complete after library installation AND deployment to the selected tools. The CLI exposes these as separate commands; `skills install` alone still only adds to the library. Install a single Skill when the user explicitly requests it:

```text
$CLI --json skills install <local-path-or-git-ref>
$CLI --json skills install <repo-ref> --subpath <skill-path>
```

Use explicit local paths (`./`, `../`, absolute, or `~/`), Git references, or supported `owner/repo` shorthand. On `MULTI_SKILLS`, show `details.candidates` and use the selected subpath; never automatically install every candidate. Read back with `skills show` using the returned ID.

Resolve the target set for each installation request:

| User request | Target selection |
| --- | --- |
| Explicitly library-only / no sync | Install and read back only; do not deploy or remove existing deployments. |
| Names particular tools | Use only those returned Agent keys; do not add default tools. If a named tool is missing, undetected, or disabled, report it without enabling it or creating its directory. |
| No tools named, including “install” or “sync to all tools” | Run `agents list`; select exactly `data.agents` entries where BOTH `detected` and `enabled` are true, including eligible custom tools. Never use the full supported-tool catalog or assume the current Agent is the only target. |

Use global scope by default. If the user specifies a project, use its absolute path with `--project` for every deployment; ask for the path if unclear. Report unsupported project targets without falling back to global. If no eligible tools exist, keep the installed li

BLOCKgrade F · trust 49/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

What the source does

Filesystem

declared (13 observation(s))

Network

declared (6 observation(s))

Shell

declared (1 observation(s))

Dependencies

not all pinned

Secrets in source

found

Findings (25)

"-----begin private key-----",

"-----begin rsa private key-----",

"-----begin openssh private key-----",

"private-key": "-----BEGIN PRIVATE KEY-----",

format!("{}\n-----BEGIN PRIVATE KEY-----", "safe text\n".repeat(600)).into_bytes(),

|| name == "id_rsa"

|| name == "id_ed25519"

|| name == "id_rsa"

|| name == "id_ed25519"

Never read, print, store, or request credentials, OAuth codes, Authorization headers, private keys, or credential-bearing URLs. The CLI may use existing secure credentials only during a user-requested

icon.icns

let _ = background_command("launchctl")

let out = background_command("launchctl")

.context("launchctl load")?;

"launchctl load failed: {}",

let _ = background_command("launchctl")

std::path::Path::new("/etc/apt").exists(),

("/usr/local/bin/app", true, true, false),

"/usr/local/bin/git",

let secret = "do-not-leak-source-secret";

let secret = "do-not-leak-service-secret";

const SECRET: &str = "github_pat_UNIQUE_PHYSICAL_ERASURE_TEST_6f93c5a1";

const SECRET: &str = "github_pat_UNIQUE_BUSY_WAL_RETRY_TEST_92d81ef4";

assert.throws(() => desktopBuild.clearDesktopBundle({ root, target: '../../unsafe', debug: false }))

std::os::unix::fs::symlink("../../outside", local.join("node_modules/.bin/tool")).unwrap();

Gates applied: critical_finding, no_behavioural_pass.