Skill Installer

Install Procedure

1. Parse the requested skill identity:

   • extract store, slug, package URL, page URL, display title, owner, and version if present;
   • do not assume slug, display title, and SKILL.md frontmatter name are the same.

2. Inspect available store metadata before installing:

   • use only metadata you can verify from the store, repository, downloaded package, or installed files;
   • do not invent setup requirements, hooks, environment variables, or dependencies.

3. If the target directory already exists, inspect it before modifying it:

   • if it already passes the acceptance checks and matches the requested skill identity plus any source/version constraints, report that the skill is already installed;
   • if it passes the acceptance checks but the source or version differs from the request, report the conflict and ask before replacing or updating it;
   • if it is invalid or incomplete, report the failed checks and ask before replacing, updating, or merging it;
   • do not overwrite an existing target directory unless the user explicitly approves.

4. Install or materialize the skill into the selected Pokoclaw target:

   • use a verified channel-specific direct target option when one exists;
   • otherwise stage or install through the store, then copy or symlink only the requested skill into the selected Pokoclaw target;
   • keep the work scoped to the requested skill only.

5. Preserve provenance when available:

   • keep store metadata files such as _meta.json, .clawhub/origin.json, lock entries, or source metadata if they are part of the installed skill;
   • if provenance exists only in an external lock or staging file and the final target will not include that file, write a per-skill provenance file inside the final skill directory;
   • do not copy unrelated store caches or registry state into the skill directory.

6. Inspect after installation:

   • read SKILL.md frontmatter;
   • report the installed skill name, description, source, version if known, and final target path;
   • run the setup inspection checklist below.

7. Do not run setup scripts, enable hooks, edit shell profiles, install extra CLIs, or change broader environment state unless the user explicitly approves.

8. Clean up temporary material:

   • remove temporary download/staging directories;
   • for test installs, restore pre-test lock files and remove test-created symlinks or skill directories;
   • do not remove pre-existing user files.

Unknown Channels

For an unverified store or installer:

1. Read its help/docs or inspect the command output to determine the real install root.
2. Check whether it supports an explicit target root.
3. If it supports a target root, direct it to the selected Pokoclaw target root.
4. If it does not support a target root, install or download in a controlled way, then copy or symlink the requested skill into the selected Pokoclaw target.
5. Record any verified channel behavior if the user is asking you to improve installer support.

Do not rely on store branding, command names, or current working directory to infer where files landed. Verify the actual files.

Setup Inspection Checklist

Inspect these files and paths when they exist in the installed skill. Do not execute them unless the user explicitly approves.

• README*
• package.json
• setup*
• install*
• hooks/
• hook*
• scripts/
• references/
• assets/
• *.sh
• *.js
• *.ts
• _meta*
• metadata*
• .clawhub/origin.json
• .skills-sh/origin.json
• .skillhub/origin.json
• store-specific lock or provenance files, including copied per-skill lock entries

Reason: setup requirements and executable side effects are often documented in these files, and different stores package them differently.