fix(skills): exclude repo-native skills from public installs - #3856

Reviewed head fadfa118322e5cee56b8dcfd93bbd02a1d164068 (one commit over main). Checked out in a detached worktree and reproduced the claims with the real installer rather than reading them.

Strengths

• .claude/skills/*/SKILL.md:4-5 / .agents/skills/*/SKILL.md:4-5 — the six mirror pairs are byte-identical; node scripts/check-skill-mirror.mjs reports 24/24 matching, and bun scripts/lint-skills.ts passes 32 definitions (its schema already allows metadata as an optional mapping, lint-skills.ts:99).
• README/AGENTS/docs wording now describes --all as "the 20 published skills", which is exactly what the installer does at this head (below).

Verified

• Ran skills CLI 1.5.25 (add <local path> --list) against this head and against main:

  Source	--list	--all --list	INSTALL_INTERNAL_SKILLS=1 --list
  main	26	—	—
  this head	20	20	26

  The 6-skill difference is exactly captions-overlay, changelog-video, cut-the-curve, motion-doctrine, oversized-cursor, seam-craft, and the 20 remaining equal the skills/ directory one-to-one.

• metadata.internal is a documented field, not an undocumented behaviour: the CLI README's "Optional Fields" section defines it, and the INSTALL_INTERNAL_SKILLS env var is in its environment-variable table. In the bundled source the filter is metadata?.internal === true gated by INSTALL_INTERNAL_SKILLS being "1"/"true", applied both at local/GitHub discovery and to registry-provided skill lists.

• skills-manifest.json correctly untouched: gen-skills-manifest.ts fingerprints skills/ only, and running it at this head reports "already in sync — no change (20 skills)". CI's skills-manifest job runs the same --check.

• In-repo discovery is unaffected: Claude Code and Codex read .claude/skills / .agents/skills directly and treat metadata as an opaque optional block per the Agent Skills spec; nothing in this repo reads metadata.internal.

• No links in the changed doc lines; Mintlify preview reports Ready. Required checks: all green (regression, Semantic PR title; the build/test matrix correctly skipped for a docs/metadata-only diff).

Nits (non-blocking)

• .claude/skills/README.md:50-54 / .agents/skills/README.md:52-56 — "To explicitly install these skills elsewhere, set INSTALL_INTERNAL_SKILLS=1" is true but not the only path: the CLI also includes internal skills whenever a concrete --skill <name> is passed (no env var needed). Worth one clause so nobody is surprised that npx skills add heygen-com/hyperframes --skill seam-craft still works.
• The exclusion is enforced by the CLI, so users on a skills CLI version that predates metadata.internal will still see 26. The README's "excluded by default" reads fine; just noting the dependency.

Verdict: APPROVE
Reasoning: Metadata-only change whose every claim reproduces with the real installer (20 vs 26, exact six, opt-in restores 26), mirrors stay byte-identical, the manifest is correctly unchanged, and the docs match the observed behaviour.

— Miga