feat: auto-install find-skills during create and link#25
Conversation
Adds vercel-labs/skills find-skills to the post-install flow so users get skill discovery out of the box when scaffolding or linking a project. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
WalkthroughA new asynchronous installation step is added to installSkills to install find-skills from vercel-labs, featuring verbose logging, error handling, and a 60-second timeout. The addition runs after the existing agent-skills installation with non-blocking error recovery. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/lib/skills.ts`:
- Around line 70-76: The installer currently uses a floating GitHub URL in the
execAsync call and in the fallback message; change both the command string
passed to execAsync('npx skills add https://github.com/vercel-labs/skills
--skill find-skills -y', ...) and the fallback clack.log.warn text to reference
an immutable ref (a specific tag or commit SHA), e.g., replace the URL with the
same GitHub URL pinned to a tag or commit (like
https://github.com/vercel-labs/skills@v1.2.3 or append #<commit-sha> per the
tool’s URL format) so the executed command and the "run manually" message both
point to the exact pinned ref; update the success message location (the
clack.log.success path that checks !json) similarly if it echoes the source URL.
| await execAsync('npx skills add https://github.com/vercel-labs/skills --skill find-skills -y', { | ||
| cwd: process.cwd(), | ||
| timeout: 60_000, | ||
| }); | ||
| if (!json) clack.log.success('find-skills installed.'); | ||
| } catch { | ||
| if (!json) clack.log.warn('Failed to install find-skills. You can run manually: npx skills add https://github.com/vercel-labs/skills --skill find-skills'); |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether any GitHub-based "skills add" sources are unpinned.
# Expected: every GitHub URL includes an immutable ref suffix like #<tag-or-sha>.
rg -nP "skills add https://github\\.com/[\\w./-]+(\\s|['\"])"
rg -nP "skills add https://github\\.com/[\\w./-]+#[\\w.-]+"Repository: InsForge/CLI
Length of output: 358
Pin the GitHub source to an immutable ref.
Lines 70 and 76 install/reference a floating GitHub URL without a commit or tag pin, which is non-reproducible and weakens supply-chain guarantees. Use a tag/commit-pinned source for both the executed command and the fallback message.
🔧 Proposed hardening patch
+ const FIND_SKILLS_SOURCE = 'https://github.com/vercel-labs/skills#<commit-or-tag>';
+
try {
if (!json) clack.log.info('Installing find-skills...');
- await execAsync('npx skills add https://github.com/vercel-labs/skills --skill find-skills -y', {
+ await execAsync(`npx skills add ${FIND_SKILLS_SOURCE} --skill find-skills -y`, {
cwd: process.cwd(),
timeout: 60_000,
});
if (!json) clack.log.success('find-skills installed.');
} catch {
- if (!json) clack.log.warn('Failed to install find-skills. You can run manually: npx skills add https://github.com/vercel-labs/skills --skill find-skills');
+ if (!json) clack.log.warn(`Failed to install find-skills. You can run manually: npx skills add ${FIND_SKILLS_SOURCE} --skill find-skills`);
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@src/lib/skills.ts` around lines 70 - 76, The installer currently uses a
floating GitHub URL in the execAsync call and in the fallback message; change
both the command string passed to execAsync('npx skills add
https://github.com/vercel-labs/skills --skill find-skills -y', ...) and the
fallback clack.log.warn text to reference an immutable ref (a specific tag or
commit SHA), e.g., replace the URL with the same GitHub URL pinned to a tag or
commit (like https://github.com/vercel-labs/skills@v1.2.3 or append
#<commit-sha> per the tool’s URL format) so the executed command and the "run
manually" message both point to the exact pinned ref; update the success message
location (the clack.log.success path that checks !json) similarly if it echoes
the source URL.
There was a problem hiding this comment.
Skills are prompt/markdown definitions, not executable code
There was a problem hiding this comment.
@tonychang04, that's a fair and important clarification — thank you. Since skills are prompt/markdown definitions rather than executable packages, the supply-chain concern I raised (arbitrary code injection) doesn't apply here. The worst-case scenario from a floating URL is unexpected drift in the prompt content, which is a much lower severity than what I originally implied. I'll withdraw the major severity flag on this.
✏️ Learnings added
Learnt from: tonychang04
Repo: InsForge/CLI PR: 25
File: src/lib/skills.ts:70-76
Timestamp: 2026-03-17T23:24:00.981Z
Learning: In the InsForge/CLI repository (`src/lib/skills.ts`), "skills" installed via `npx skills add` (e.g., `https://github.com/vercel-labs/skills`) are prompt/markdown definitions, not executable code. Supply-chain concerns about pinning to immutable refs are therefore low-severity for these installs, as there is no arbitrary code execution risk.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
2 participants
Summary
find-skillsfromvercel-labs/skillsto theinstallSkills()flow insrc/lib/skills.tsinsforge createandinsforge linkfor all templatesTest plan
insforge createwith a template and verifyfind-skillsis installedinsforge linkand verifyfind-skillsis installedfind-skillsinstallation fails🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Improvements