Installer provider discovery
Checked 2026-09-08. This records where each skill host discovers instructions, how the installer reaches that location, and what was actually verified. Discovery is distinct from automatic invocation, model compliance, cloud sync, and token savings. No authenticated model conversation was used for this review.
Effective upstream behavior
The reviewed upstream is the integrity-verified skills@1.5.24 package and
source revision 1682051.
The live delegated dependency is unpinned, so this is a versioned observation.
Its installation algorithm
first copies into ~/.agents/skills. Profiles with project skillsDir equal to
.agents/skills are universal: global installation stops there, without creating
the profile's declared globalSkillsDir. Other profiles get a per-skill symlink
at that declared path, with a copy fallback. --copy instead materializes the
profile destination. Reading globalSkillsDir alone therefore gives the wrong
answer for Codex, Cursor, Cline, Copilot, Amp, Warp, Replit and Antigravity.
Caveman uses owned physical copies where the upstream behavior misses a vendor loader or configured directory. Journals and forced-install backups remain beside the skills directory, outside recursive skill discovery. Uninstall removes unchanged owned files and preserves unrelated or subsequently edited content. Existing unowned skill directories and symlinks are not silently adopted.
IDE and coding profiles
~ means the host user's home, including %USERPROFILE% on Windows. A matching
directory below is source or documentation evidence; it is not a full host run.
| Installer ID | Vendor discovery and current installation | Consumption and evidence |
|---|---|---|
codex | Shared ~/.agents/skills; $CODEX_HOME/skills remains compatible. Universal install reaches shared root. | Recursive metadata scan follows user/repository symlinks; body loads on use. Roots, loader. An isolated app-server listing timed out; no runtime success claimed. |
cursor | Docs include ~/.agents/skills and ~/.cursor/skills; universal install reaches shared root. | Metadata first, body on selection/invocation. Official docs. Closed source. Global cloud sync has separate .cursor requirements. |
windsurf | Cascade reads ~/.codeium/windsurf/skills; upstream links there. | Metadata then body on selection/mention. Official Cascade docs. Desktop scope, distinct from Devin CLI/cloud. |
cline | Source reads ~/.cline/skills and ~/.agents/skills; universal install reaches shared root. | fs.stat follows skill symlinks; name/description and directory-name match required; getSkillContent reads body. Directories, loader. |
continue | Owned copies into $CONTINUE_GLOBAL_DIR/skills, default ~/.continue/skills; relative override is cwd-relative. | Actual IDE walker and CLI loader skip per-skill symlink directories. Extracted vendor functions found zero symlinked skills and one physical-copy control. Paths, walker, CLI loader. |
kilo | Current source accepts .kilo, legacy .kilocode, shared .agents, and config roots; upstream legacy link remains supported. | Recursive symlink-aware metadata/body loader; compatibility discovery can be disabled. Paths, loader. No reproduced legacy-path defect. |
roo | Global .roo/skills and .agents/skills; upstream .roo link matches. | fs.stat/realpath follow symlinks; metadata first, file contents on use; project and mode-specific overrides. SkillsManager. |
augment | Global .augment/skills, compatible .claude/.agents, and project roots; upstream link matches docs. | Auto/Manual/Disabled modes. Skills beta requires VS Code 0.789.0+ or JetBrains 0.428.8+ and enabled rollout. VS Code, JetBrains, CLI. Closed source; folder existence cannot prove feature availability. |
copilot | VS Code reads global .agents, .copilot, .claude; universal install reaches shared root. | Metadata/body/resources are progressive; slash or model selection. Locations, prompt service. VS Code source covers the native host, not every Copilot product. The standalone Copilot CLI (copilot binary plus ~/.copilot, now a detection signal; the dir rules out AWS Copilot CLI's same-named binary) reads personal skills from ~/.copilot/skills and ~/.agents/skills per GitHub docs (checked 2026-10-05); no live CLI run. |
aider-desk | Owned copies into $AIDER_DESK_HOME_DIR/skills, otherwise ~/($AIDER_DESK_DIR or .aider-desk)/skills. Relative home override is cwd-relative. | Immediate directories/symlinks; metadata then body. Active agent profile must enable Skills Tools. Plain aider is not AiderDesk detection. Constants, SkillManager. |
Terminal profiles
| Installer ID | Vendor discovery and current installation | Consumption and evidence |
|---|---|---|
amp | Universal install reaches ~/.agents/skills; docs also accept XDG agents and legacy roots. | Metadata then instructions on selection. Official docs. Inspected native package 0.0.1788811227-gce258b; loader not readable, so discovery remains docs-backed. |
bob | Upstream .bob/skills link; Bob Shell 2.0.2 also scans shared .agents and .claude. | Integrity-verified shipped loader accepts directories/symlinks; onActivate reads file body. Vendor docs. Shell 1.x is outside this skill contract. |
codebuddy | Upstream codebuddy profile links ~/.codebuddy/skills (project .codebuddy/skills); detected by the codebuddy binary. | Docs-backed only: upstream mapping, CodeBuddy skills docs (checked 2026-10-05). No local binary, so no native loading run; plugin/hook always-on unverified and not installed. |
crush | Default source includes config crush/skills and shared .agents, covering upstream destinations. Nonempty CRUSH_SKILLS_DIR replaces all roots; Caveman copies into that exact directory. | Metadata for selection, instructions on activation. Pinned loader. Windows/config-root differences retain shared fallback only when explicit override is absent. |
devin | XDG/default .config/devin/skills and shared .agents; upstream destinations match. | Metadata, then instructions/permissions/model settings on invocation. CLI docs. Closed-source CLI 3000.6.7 identified; no account run. |
droid | .factory/skills, shared .agents, .agent, and project roots; upstream link matches. | Enabled effective skill loads body on invocation. Factory docs. Installed native loader strings corroborate paths; no authenticated run. |
forgecode | Configured base skills, shared .agents, project .forge/skills; global base supports .forge and legacy forge. | Later duplicate names override; loader supplies body. Repository loader, environment. Shared copy covers legacy home; outdated docs alone are not an install defect. |
goose | Platform/config Goose root plus shared .agents, even with GOOSE_PATH_ROOT; upstream shared copy matches. | Project precedes global; first duplicate wins; metadata then body. Pinned loader. |
grok | Owned copies into $GROK_HOME/skills, default ~/.grok/skills; relative override is cwd-relative. No confirmed upstream skills CLI grok profile, so the installer copies natively instead of delegating. | Third-party setup docs place the Grok Build config home at ~/.grok with a GROK_HOME override. Always-on: a marker-fenced ruleset block in $GROK_HOME/AGENTS.md; xAI rules docs load global rules from ~/.grok/ and read AGENTS.md at each level (checked 2026-10-05). Closed source; no live binary run, so no native loading success claimed. |
iflow | Default upstream .iflow/skills link matches. Nonempty IFLOW_HOME makes Caveman copy into that home's skills. | Exact shipped 0.5.19 scanner/home/parser executed: default found, custom home missed before fix, correctly placed control found. Symlinks accepted; metadata and body parsed. Published vendor package, docs. Shipped duplicate precedence differs from docs; discovery cache can last five minutes. |
kiro | Global .kiro/skills; upstream link matches. Detection now includes actual kiro-cli. | Metadata then body on match/invocation; custom agents need skill://.../SKILL.md resources. Skills, installer. Manifest reported 2.21.1; rolling docs and native version are separate evidence. |
mistral | $VIBE_HOME/skills, shared agents-home skills and configured/project roots; upstream honors VIBE_HOME. Detection now includes actual vibe. | Metadata and duplicate resolution, then skill tool reads body. Skill manager, entry points. Version 2.25.0. User config-source selection can exclude user skills. |
Other profiles and product scopes
| Installer ID | Vendor discovery and current installation | Consumption and evidence |
|---|---|---|
openhands | SDK user roots start with shared .agents/skills, then persistence skills/microagents; upstream shared copy matches. | Child directories resolve symlinks and find SKILL.md; merged metadata/body loading. Skill source, discovery. Local SDK/CLI home evidence; container/cloud home is a separate scope. |
qwen | Global $QWEN_HOME/skills plus shared .agents/skills; upstream shared copy covers home override. | Directory/symlink scanning validates targets and parses metadata/body. Storage, loader. |
rovodev | User .rovodev/skills or shared .agents/skills; both upstream destinations match docs. | Name/description and directory-name match; refer to the skill in the prompt. Official docs. Closed source. |
tabnine | User .tabnine/agent/skills and shared .agents/skills; upstream link matches. | Vendor explicitly supports linked skills; metadata/body loading, trusted workspace roots only. Official docs. Closed source. |
trae | Trae Code global .trae/skills; upstream link targets documented root. | Metadata then instructions. Project .agents discovery is optional and needs UI enablement. Official IDE docs, rendered page inspected. Closed source; no full host loading test. |
warp | Global shared .agents/skills; universal install matches. | Skills supply instructions on use. Official skills docs. Closed source; Warp cloud/Drive objects have separate scope. |
replit | Project .agents/skills; installer now omits -g and reports cwd. | Run from the Replit project's Shell. Workspace-wide library is managed in Workspace Settings. Official docs. Closed source; home-global installation was not documented discovery. |
junie | Global .junie/skills and shared .agents/skills; upstream destinations match. | Skills discovered and used subject to enabled locations. Official docs. Closed source; intentionally disabled defaults remain disabled. |
qoder | Qoder CLI/IDE user .qoder/skills; upstream link matches. | Metadata first, automatic selection or /skill-name. Official CLI docs. QoderWork's .qoderwork/skills is a separate product scope. |
antigravity | Owned copies into Antigravity IDE .gemini/antigravity/skills; current universal upstream algorithm misses this declared destination. | Official IDE skills docs (IDE 2.5.5). Explicit selection retains the existing installer ID. Closed source; no native loading run. |
antigravity-2 | Owned copies into Antigravity 2.0 .gemini/config/skills, distinct from IDE. | Official 2.0 skills docs (2.12.2). Separate explicit target; no guessed filesystem detection or multi-home install. Closed source; no native loading run. |
antigravity-cli | agy plugin install of a staged caveman plugin; agy copies it to .gemini/config/plugins/caveman and owns it. Detection: agy on PATH. | Plugin skills/ load as skills and rules/AGENTS.md merges into the active rule set while the plugin is enabled (agy 1.2.17 built-in plugin guide). Live run 2026-10-05 in a throwaway HOME: caveman reply with the plugin, normal prose with it disabled or with only skills/. Closed source. |
Native installer integrations
Claude uses its plugin manager, Gemini its extension manager, opencode owned
plugin/rules files, OpenClaw workspace skills plus a marker-fenced SOUL.md block,
and Hermes its native skill directory. Their implementations remain in
installer/install.js and the corresponding installer/lib helpers; temporary-home install,
ownership, restart and hook tests cover these paths. See INSTALL.md
for activation and override instructions. These skill installation paths do not
establish proxy compression compatibility; provider audit
records that separate requirement and its remaining evidence.
Reproduction and limits
tests/installer/provider-skills.test.mjs checks vendor path semantics on POSIX
and Windows path implementations and filesystem ownership behavior.
provider-skills-integration.test.mjs launches the real installer in temporary
homes, checks every copied skill body, forbids incompatible delegation, exercises
detached staging, and verifies preservation during uninstall.
skills-global-install.test.mjs checks actual delegated argv, Replit scope and
command detection. These files are included in the Windows compatibility gate.
Full native loading remains unverified for many hosts, especially closed-source products. Feature toggles, trust, custom-agent resources, conflicting names and remote homes can deliberately exclude otherwise valid skills. Native Windows execution of the final tree is required before claiming Windows conformance; POSIX tests of Windows path functions and cross-compilation do not replace it.