skills add --skill <name> bypasses the metadata.internal gate (--all honors it)

[jliu-ts]

Summary

#3856 marked the six repo-native skills metadata.internal: true so they stay out of public installs. The gate works on --all. It does not work when a skill is named explicitly with --skill, so all six are still publicly installable today with no flag and no env var.

Reproduction

Run each in an empty directory. Observed today on main at 14b9e2039, installer npx skills add.

Command	INSTALL_INTERNAL_SKILLS	Internal six	Total installed
npx skills add heygen-com/hyperframes --all	unset	excluded ✅	20
npx skills add heygen-com/hyperframes --all	=1	pulled ✅	26
npx skills add heygen-com/hyperframes --skill changelog-video	unset	pulled ❌	1

$ mkdir /tmp/t && cd /tmp/t
$ npx skills add heygen-com/hyperframes --skill changelog-video
●  Selected 1 skill: changelog-video
◇  Installed 1 skill
   ✓ ./.agents/skills/changelog-video
     universal: Antigravity, Codex, Cursor, Droid, Gemini CLI +15 more
     symlinked: Claude Code

The installed SKILL.md is byte-identical to .claude/skills/changelog-video/SKILL.md on current main, marker included:

metadata:
  internal: true

So the registry is serving current content and the flag is present in the payload. The explicit-install path just never checks it.

Expected

.claude/skills/README.md, added in #3856, states the contract:

Each repo-native skill declares metadata.internal: true, so npx skills add skips it during normal installs (including --all). This does not change local agent discovery. To explicitly install these skills elsewhere, set INSTALL_INTERNAL_SKILLS=1 when running the installer.

An explicit --skill <internal-name> without INSTALL_INTERNAL_SKILLS=1 should refuse, the way --all does. Right now the env var is the documented escape hatch for a door that has no lock.

Why it matters

The explicit path ships the full skill directory, 712K, not just the prompt:

assets/fonts/TT_Norms_Pro_{Medium,Bold,Normal}.woff2
assets/fonts/tt_norms_pro_mono_regular-webfont.woff2
assets/fonts/ABCSolarDisplay-Bold.woff2
assets/bgm.mp3
assets/bg-pattern.mp4
references/{build-spec,script-voice,visualization-registry}.md
references/lexicon.json
examples/master-skeleton.html
scripts/align-captions.mjs

Those are commercial foundry webfonts and house brand assets going out through a public install command. That is the exposure #3856 was closing, and it is still open on this path. Worth a licensing check independent of the fix.

Second, smaller finding

CLAUDE.md:12 still documents the pre-#3856 behavior:

npx skills add heygen-com/hyperframes    # interactive picker (terminal only; --all also pulls the 6 repo-internal skills under .claude/skills)

The --all run above disproves that, 20 skills and none of the six. #3856 updated AGENTS.md, README.md, and docs/guides/skills.mdx but not CLAUDE.md. The repo's own "Skill catalog maintenance" section requires these surfaces move in lockstep.

Environment

macOS 15.6, Node via npx, repo at 14b9e2039.