Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

skills add --skill <name> bypasses the metadata.internal gate (--all honors it)

Abierto
  • ¿Algo no está bien?
#3,861 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
68/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
node.js, typescript
Área
cli, documentation, tooling

Línea de trabajo

Start by tracing the npx skills add explicit --skill path and compare its metadata handling with the --all path described in the reproduction. Verify the behavior with the listed commands and ensure an internal skill is refused unless INSTALL_INTERNAL_SKILLS=1 is set. Also update CLAUDE.md:12 so its installation guidance matches the documented behavior in .claude/skills/README.md and the other catalog surfaces.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

triage/needs-triage

Summary

#3856 marked the six repo-native skills metadata.internal: true so they stay out of public installs. The gate works on --all. It does not work when a skill is named explicitly with --skill, so all six are still publicly installable today with no flag and no env var.

Reproduction

Run each in an empty directory. Observed today on main at 14b9e2039, installer npx skills add.

Command INSTALL_INTERNAL_SKILLS Internal six Total installed
npx skills add heygen-com/hyperframes --all unset excluded ✅ 20
npx skills add heygen-com/hyperframes --all =1 pulled ✅ 26
npx skills add heygen-com/hyperframes --skill changelog-video unset pulled ❌ 1 
$ mkdir /tmp/t && cd /tmp/t
$ npx skills add heygen-com/hyperframes --skill changelog-video
●  Selected 1 skill: changelog-video
◇  Installed 1 skill
   ✓ ./.agents/skills/changelog-video
     universal: Antigravity, Codex, Cursor, Droid, Gemini CLI +15 more
     symlinked: Claude Code

The installed SKILL.md is byte-identical to .claude/skills/changelog-video/SKILL.md on current main, marker included:

metadata:
  internal: true

So the registry is serving current content and the flag is present in the payload. The explicit-install path just never checks it.

Expected

.claude/skills/README.md, added in #3856, states the contract:

Each repo-native skill declares metadata.internal: true, so npx skills add skips it during normal installs (including --all). This does not change local agent discovery. To explicitly install these skills elsewhere, set INSTALL_INTERNAL_SKILLS=1 when running the installer.

An explicit --skill <internal-name> without INSTALL_INTERNAL_SKILLS=1 should refuse, the way --all does. Right now the env var is the documented escape hatch for a door that has no lock.

Why it matters

The explicit path ships the full skill directory, 712K, not just the prompt:

assets/fonts/TT_Norms_Pro_{Medium,Bold,Normal}.woff2
assets/fonts/tt_norms_pro_mono_regular-webfont.woff2
assets/fonts/ABCSolarDisplay-Bold.woff2
assets/bgm.mp3
assets/bg-pattern.mp4
references/{build-spec,script-voice,visualization-registry}.md
references/lexicon.json
examples/master-skeleton.html
scripts/align-captions.mjs

Those are commercial foundry webfonts and house brand assets going out through a public install command. That is the exposure #3856 was closing, and it is still open on this path. Worth a licensing check independent of the fix.

Second, smaller finding

CLAUDE.md:12 still documents the pre-#3856 behavior:

npx skills add heygen-com/hyperframes    # interactive picker (terminal only; --all also pulls the 6 repo-internal skills under .claude/skills)

The --all run above disproves that, 20 skills and none of the six. #3856 updated AGENTS.md, README.md, and docs/guides/skills.mdx but not CLAUDE.md. The repo's own "Skill catalog maintenance" section requires these surfaces move in lockstep.

Environment

macOS 15.6, Node via npx, repo at 14b9e2039.

Lenguaje dominante
TypeScript
Estrellas
54.1k
Forks
4.9k
Merge medio
9 h 46 min
PR fusionados (30 d)
652

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de heygen-com/hyperframes

Todos los issues de heygen-com/hyperframes

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.