Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

skills add --skill <name> bypasses the metadata.internal gate (--all honors it)

Open
  • Is something wrong?
#3,861 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
node.js, typescript
Domain
cli, documentation, tooling

Research direction

Start by tracing the npx skills add explicit --skill path and compare its metadata handling with the --all path described in the reproduction. Verify the behavior with the listed commands and ensure an internal skill is refused unless INSTALL_INTERNAL_SKILLS=1 is set. Also update CLAUDE.md:12 so its installation guidance matches the documented behavior in .claude/skills/README.md and the other catalog surfaces.

Written by the indexing model from the issue text.

Description

triage/needs-triage

Summary

#3856 marked the six repo-native skills metadata.internal: true so they stay out of public installs. The gate works on --all. It does not work when a skill is named explicitly with --skill, so all six are still publicly installable today with no flag and no env var.

Reproduction

Run each in an empty directory. Observed today on main at 14b9e2039, installer npx skills add.

Command INSTALL_INTERNAL_SKILLS Internal six Total installed
npx skills add heygen-com/hyperframes --all unset excluded ✅ 20
npx skills add heygen-com/hyperframes --all =1 pulled ✅ 26
npx skills add heygen-com/hyperframes --skill changelog-video unset pulled ❌ 1 
$ mkdir /tmp/t && cd /tmp/t
$ npx skills add heygen-com/hyperframes --skill changelog-video
●  Selected 1 skill: changelog-video
◇  Installed 1 skill
   ✓ ./.agents/skills/changelog-video
     universal: Antigravity, Codex, Cursor, Droid, Gemini CLI +15 more
     symlinked: Claude Code

The installed SKILL.md is byte-identical to .claude/skills/changelog-video/SKILL.md on current main, marker included:

metadata:
  internal: true

So the registry is serving current content and the flag is present in the payload. The explicit-install path just never checks it.

Expected

.claude/skills/README.md, added in #3856, states the contract:

Each repo-native skill declares metadata.internal: true, so npx skills add skips it during normal installs (including --all). This does not change local agent discovery. To explicitly install these skills elsewhere, set INSTALL_INTERNAL_SKILLS=1 when running the installer.

An explicit --skill <internal-name> without INSTALL_INTERNAL_SKILLS=1 should refuse, the way --all does. Right now the env var is the documented escape hatch for a door that has no lock.

Why it matters

The explicit path ships the full skill directory, 712K, not just the prompt:

assets/fonts/TT_Norms_Pro_{Medium,Bold,Normal}.woff2
assets/fonts/tt_norms_pro_mono_regular-webfont.woff2
assets/fonts/ABCSolarDisplay-Bold.woff2
assets/bgm.mp3
assets/bg-pattern.mp4
references/{build-spec,script-voice,visualization-registry}.md
references/lexicon.json
examples/master-skeleton.html
scripts/align-captions.mjs

Those are commercial foundry webfonts and house brand assets going out through a public install command. That is the exposure #3856 was closing, and it is still open on this path. Worth a licensing check independent of the fix.

Second, smaller finding

CLAUDE.md:12 still documents the pre-#3856 behavior:

npx skills add heygen-com/hyperframes    # interactive picker (terminal only; --all also pulls the 6 repo-internal skills under .claude/skills)

The --all run above disproves that, 20 skills and none of the six. #3856 updated AGENTS.md, README.md, and docs/guides/skills.mdx but not CLAUDE.md. The repo's own "Skill catalog maintenance" section requires these surfaces move in lockstep.

Environment

macOS 15.6, Node via npx, repo at 14b9e2039.

Dominant language
TypeScript
Stars
54.1k
Forks
4.9k
Avg merge
10h 29m
Merged PRs (30d)
756

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from heygen-com/hyperframes

All issues in heygen-com/hyperframes

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.