external-skill-import

Inventory the archive or repository without extracting or executing anything, verify license and provenance, check for duplicate names against existing skills, and map every dependency to a portable, adaptable, or unsupported classification. Install only after an explicit accept or adapt recommendation is approved.

Provide the repository URL with an optional subpath and ref, preferably an immutable commit. The review records provenance and licensing, inventories actual SKILL.md candidates, and recommends a disposition before any files are copied into an editable skill root.

The inspection stops on absolute or traversal paths, symlinks and special files, duplicate or case-colliding paths, encrypted members, and suspicious compression ratios. Extraction, when needed, uses a temporary directory with regular files only and is deleted afterward.

A duplicate is treated as a conflict, never an overwrite. The review preserves existing authoritative identities and recommends adapt or defer, proposing only genuinely portable guidance for merging into the project-owned skill.

Only if every provider-specific behavior has a verified local equivalent. Features like credential discovery, plugin marketplaces, or restart instructions are classified as unsupported and must be removed with stated limitations, or the candidate is deferred or rejected.

The review cannot verify provenance when source identity is missing, cannot install skills with absent or incompatible licenses, and never executes bundled scripts to test them. Unverifiable sources stop at a defer recommendation until exact files or URLs are supplied.