[trevorwang]

问题与结果 / Problem and outcome

增加 agc skills命令来安装 skill fix #4

改动 / Changes

• agc skills add 可安装 Copilot、Claude Code 和 Codex 的 skill。

兼容性 / Compatibility

• CLI / REST： CLI 命令行为不变；REST 不受影响。
• 配置与凭据 / Configuration and credentials： 无变化。
• 输出格式 / Output schema： 无变化。

验证 / Validation

• 检查命令及结果 / Checks and results： make ci、go test -race ./...、文档检查和 secret scan 通过。
• 尚未验证或不适用 / Not verified or not applicable： 未进行真实 Huawei API 调用。CodeQL 因变更仅涉及文档删除和测试而跳过；Code Review 工具因模型不可用未能运行。

文档与完成条件 / Documentation and completion

• 改动范围明确，无无关文件 / Focused scope, no unrelated files
• 行为变更有相关测试；纯文档改动注明不适用 / Installer tests updated; no production behavior change
• 共享能力已检查 CLI 与 REST / CLI and REST checked; REST is unaffected
• 参数、JSON 输出和默认行为的兼容性已说明 / No changes to flags, JSON output, or defaults
• 受影响的中文与英文文档同步 / N/A：未更改用户指南内容
• 用户可见变化已写入 CHANGELOG / N/A：无用户可见行为变化
• 已运行适用检查，未验证项已说明 / Relevant checks run; limitations listed above
• 示例和日志已脱敏 / No secrets detected; no live credentials or tokens used

[Createitv]

Request changes before merge

Thanks for adding the agent skill installer. The direction is useful, but this should not merge yet because the current implementation has filesystem-safety and data-loss risks:

1. Project-boundary escape through parent symlinks/junctions — cmd/agc/command/root.go:399-421 checks only the final SKILL.md path with Lstat. A parent such as .agents/skills/agc-cli can be a symlink (or Windows junction), so --force may delete or overwrite a file outside --project. Resolve/canonicalize the destination and reject symlink/reparse-point parents; add Unix symlink and Windows junction coverage.
2. Non-atomic --force replacement — the old file is removed before the new file is safely written. A create/write/close failure loses the working skill, and --agent all can leave a partial install. Write a same-directory temporary file, fsync/close it, then atomically replace; cover rollback/partial-failure behavior.
3. Embedded skill documentation is stale — cmd/agc/command/assets/agc-cli/SKILL.md:93-129 omits the current --file support and says binary uploads require external tooling, which contradicts current main. Update the embedded guide and add a regression check against the real CLI surface.
4. Credential/token examples are unsafe for CI and agents — avoid putting AGC_CLIENT_KEY in argv and avoid recommending commands that print a live access token. Use protected files/environment handling and redacted verification examples.

Please rebase onto current main, address these items with regression tests, and wait for the exact head SHA's required checks before squash merging.

[Createitv]

Thanks for the contribution. PR #13 has now merged the task-oriented Skills collection, the safer npx-based agc skills list/install flow, and the website download/install surface. That implementation supersedes this earlier embedded single-skill approach, so I’m closing this PR without merging it. The contributor branch remains untouched.