From 10c77759905b10931db3179790aea794f4f816cc Mon Sep 17 00:00:00 2001 From: Victor Kuznetsov Date: Mon, 5 Oct 2026 20:04:18 -0700 Subject: [PATCH] Hide maintainer skills from public skill discovery The skills CLI discovers every SKILL.md under .claude/skills, so provider-oracles and signal-discovery were offered by `npx skills add` and listed on skills.sh beside the published skill. Mark both metadata.internal, the CLI's documented hide flag, and fail the suite on any project skill that lacks it. Co-Authored-By: Claude Opus 5.5 --- .claude/skills/provider-oracles/SKILL.md | 2 ++ .claude/skills/signal-discovery/SKILL.md | 2 ++ docs/agent-skill.md | 5 +++++ tests/test_agent_skill.py | 10 ++++++++++ 4 files changed, 19 insertions(+) diff --git a/.claude/skills/provider-oracles/SKILL.md b/.claude/skills/provider-oracles/SKILL.md index 4752f54..571db3f 100644 --- a/.claude/skills/provider-oracles/SKILL.md +++ b/.claude/skills/provider-oracles/SKILL.md @@ -1,6 +1,8 @@ --- name: provider-oracles description: Run hash-bound Google, OpenAI, Microsoft, or Meta watermark-oracle checks for this repository. Use for provider verification, multi-account Gemini checks, isolated Playwright checks, or recording oracle evidence. +metadata: + internal: true --- # Provider oracles diff --git a/.claude/skills/signal-discovery/SKILL.md b/.claude/skills/signal-discovery/SKILL.md index 1ac541d..560002a 100644 --- a/.claude/skills/signal-discovery/SKILL.md +++ b/.claude/skills/signal-discovery/SKILL.md @@ -1,6 +1,8 @@ --- name: signal-discovery description: Discover missing AI provenance and watermark coverage in the remove-ai-watermarks library from fresh or historical corpora, then validate detection and removal parity. Use for corpus gap mining, periodic signal audits, new-provider discovery, or deciding whether old retained data must be replayed. Do not use for ordinary per-file identification or removal. +metadata: + internal: true --- # Signal discovery diff --git a/docs/agent-skill.md b/docs/agent-skill.md index 4bef4fe..f5c0fde 100644 --- a/docs/agent-skill.md +++ b/docs/agent-skill.md @@ -26,6 +26,11 @@ SkillsMP indexes public GitHub `SKILL.md` files and does not need a separate upload. ClawHub and the Claude community marketplace are explicit publishes; see [Release and distribution](release-and-distribution.md#agent-skill). +Every maintainer skill under `.claude/skills/` carries `metadata.internal: true`. +The skills CLI discovers every `SKILL.md` in that directory, so without the flag +`npx skills add` offers it and skills.sh lists it beside the published skill. +`tests/test_agent_skill.py` fails on a project skill that lacks it. + ## Where the skill can actually be listed Most skill catalogs are install registries, not discovery engines. A listing diff --git a/tests/test_agent_skill.py b/tests/test_agent_skill.py index 1374e47..ac28be5 100644 --- a/tests/test_agent_skill.py +++ b/tests/test_agent_skill.py @@ -55,6 +55,16 @@ def test_skill_frontmatter_matches_agent_skills_spec() -> None: assert "remove-ai-watermarks" in description +def test_project_skills_stay_out_of_public_skill_discovery() -> None: + # `npx skills add` and skills.sh discover every SKILL.md under .claude/skills; + # metadata.internal hides a maintainer-only skill from that listing. + project_skills = sorted((ROOT / ".claude" / "skills").glob("*/SKILL.md")) + assert project_skills + for path in project_skills: + frontmatter = _frontmatter(path.read_text(encoding="utf-8")) + assert re.search(r"(?m)^metadata:\n internal: true$", frontmatter), path + + def test_plugin_and_marketplace_names_agree() -> None: plugin = json.loads(PLUGIN.read_text(encoding="utf-8")) marketplace = json.loads(MARKETPLACE.read_text(encoding="utf-8"))