Hide maintainer skills from public skill discovery

The skills CLI discovers every SKILL.md under .claude/skills, so
provider-oracles and signal-discovery were offered by `npx skills add`
and listed on skills.sh beside the published skill. Mark both
metadata.internal, the CLI's documented hide flag, and fail the suite
on any project skill that lacks it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/provider-oracles/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: provider-oracles
 description: Run hash-bound Google, OpenAI, Microsoft, or Meta watermark-oracle checks for this repository. Use for provider verification, multi-account Gemini checks, isolated Playwright checks, or recording oracle evidence.
+metadata:
+  internal: true
 ---
 
 # Provider oracles

.claude/skills/signal-discovery/SKILL.md

@@ -1,6 +1,8 @@
 ---
 name: signal-discovery
 description: Discover missing AI provenance and watermark coverage in the remove-ai-watermarks library from fresh or historical corpora, then validate detection and removal parity. Use for corpus gap mining, periodic signal audits, new-provider discovery, or deciding whether old retained data must be replayed. Do not use for ordinary per-file identification or removal.
+metadata:
+  internal: true
 ---
 
 # Signal discovery

docs/agent-skill.md

@@ -26,6 +26,11 @@ SkillsMP indexes public GitHub `SKILL.md` files and does not need a separate
 upload. ClawHub and the Claude community marketplace are explicit publishes;
 see [Release and distribution](release-and-distribution.md#agent-skill).
 
+Every maintainer skill under `.claude/skills/` carries `metadata.internal: true`.
+The skills CLI discovers every `SKILL.md` in that directory, so without the flag
+`npx skills add` offers it and skills.sh lists it beside the published skill.
+`tests/test_agent_skill.py` fails on a project skill that lacks it.
+
 ## Where the skill can actually be listed
 
 Most skill catalogs are install registries, not discovery engines. A listing

tests/test_agent_skill.py

@@ -55,6 +55,16 @@ def test_skill_frontmatter_matches_agent_skills_spec() -> None:
     assert "remove-ai-watermarks" in description
 
 
+def test_project_skills_stay_out_of_public_skill_discovery() -> None:
+    # `npx skills add` and skills.sh discover every SKILL.md under .claude/skills;
+    # metadata.internal hides a maintainer-only skill from that listing.
+    project_skills = sorted((ROOT / ".claude" / "skills").glob("*/SKILL.md"))
+    assert project_skills
+    for path in project_skills:
+        frontmatter = _frontmatter(path.read_text(encoding="utf-8"))
+        assert re.search(r"(?m)^metadata:\n  internal: true$", frontmatter), path
+
+
 def test_plugin_and_marketplace_names_agree() -> None:
     plugin = json.loads(PLUGIN.read_text(encoding="utf-8"))
     marketplace = json.loads(MARKETPLACE.read_text(encoding="utf-8"))