skill-installer-vetter

# Skill Installer Vetter Bundled commands use `$PLUGIN_ROOT` (`$env:PLUGIN_ROOT` in PowerShell; same path suffix) for the plugin root. Set it once: use the host's plugin-root variable when defined (Claude Code: `PLUGIN_ROOT="$CLAUDE_PLUGIN_ROOT"`), otherwise the absolute path of this skill folder's `../..`. Install only after provenance and safety are clear. Discovery candidates are not executable until the user requested installation and the vetting result supports it. Read `$PLUGIN_ROOT/references/skill-runtime-model.md` when choosing a skill install/update destination, explaining restart or live-reload behavior, or comparing Codex, Claude Code, Cursor, and open Agent Skills discovery surfaces. ## Source Types - Curated OpenAI skills: list or install with bundled GitHub helpers. - Explicit GitHub repo/path: inspect source, pin ref when possible, then install. - Local folder: treat as a source candidate; audit and copy only if it is a valid skill and the destination is clear. - Candidate reference in synthesis: inspect only; do not install during evaluation. For explicit skill installation, use the active agent's skills dir unless the user or repo instructions select another destination — Codex: `$HOME/.agents/skills/<skill-name>`, Claude: `${CLAUDE_HOME:-$HOME/.claude}/skills/<skill-name>`, Cursor: `${CURSOR_HOME:-$HOME/.cursor}/skills/<skill-name>`. Detect the active agent with `$PLUGIN_ROOT/scripts/agent_target.py`. For repository source work, audit and validate the...