Description: The POST /api/skills/install endpoint and the underlying MarketplaceClient::install() function do not actually download and extract the skill tarball. Instead, it only saves the tarball URL to a metadata file.
Location: crates/librefang-skills/src/marketplace.rs:171-182
Expected Behavior: When installing a skill from FangHub marketplace, the function should download the tarball and extract it to the skills directory.
Actual Behavior: The code only saves metadata with the tarball URL. The comment says: 'For now, save the download URL in a metadata file - Full tarball extraction would require a tar/gz library'
Root Cause: Missing tar/gz library dependency for extraction, or incomplete implementation.
Suggested Fix: Add a tar/gz extraction library to Cargo.toml, download the actual tarball content, and extract it to the target directory.
Description: The POST /api/skills/install endpoint and the underlying MarketplaceClient::install() function do not actually download and extract the skill tarball. Instead, it only saves the tarball URL to a metadata file.
Location: crates/librefang-skills/src/marketplace.rs:171-182
Expected Behavior: When installing a skill from FangHub marketplace, the function should download the tarball and extract it to the skills directory.
Actual Behavior: The code only saves metadata with the tarball URL. The comment says: 'For now, save the download URL in a metadata file - Full tarball extraction would require a tar/gz library'
Root Cause: Missing tar/gz library dependency for extraction, or incomplete implementation.
Suggested Fix: Add a tar/gz extraction library to Cargo.toml, download the actual tarball content, and extract it to the target directory.