feat(skills): publish skills to the team and install team skills locally

[k11kirky]

Problem

Team skills exist as a read-only concept — users can browse them but have no way to publish a local skill to the team or install a team skill onto their machine. This blocks the core share-and-reuse workflow for team skills.

Changes

Publishing local skills to the team

• Added createLlmSkill and publishLlmSkillVersion API client methods, along with the LlmSkillFileInput interface, to support creating a new skill and bumping its version respectively.
• Added publishSkill to TeamSkillsService, which creates the skill on first publish or patches a new version against the current latest. Validates that a name and description are present before calling the API.
• Added exportSkill to SkillsService, which reads a writable skill directory into a publishable shape: frontmatter is split out, the body is extracted, and every text companion file is included. Binary files and files exceeding the size limit are skipped and reported back to the caller.
• Wired up an export tRPC procedure and a usePublishSkill mutation hook. A "Publish to team" button (cloud-upload icon) appears in SkillDetailPanel when canPublish is true, guarded by a confirmation dialog. On success, a toast shows the published version number and any skipped files.

Installing team skills locally

• Added fetchSkillForInstall to TeamSkillsService, which fetches the latest skill body and resolves every companion file's content in parallel.
• Added installTeamSkill to SkillsService, which materializes the skill under ~/.claude/skills. Validates the skill name, guards against path traversal in companion file paths, and requires an explicit overwrite: true flag if the skill already exists locally.
• Wired up an installTeamSkill tRPC procedure and a useInstallTeamSkill mutation hook. An Install/Reinstall button appears in TeamSkillDetailPanel. If the skill already exists, an overwrite confirmation dialog is shown before proceeding.

How did you test this?

• Added unit tests for TeamSkillsService.publishSkill covering first-publish (create), subsequent publish (version bump), missing description, and unavailable feature.
• Added unit tests for TeamSkillsService.fetchSkillForInstall verifying that the body and all companion file contents are resolved.
• Added integration tests for exportSkill verifying frontmatter extraction, companion file collection, binary file skipping, and access denial for non-writable skills.
• Added integration tests for installTeamSkill covering the happy path, the overwrite guard, invalid skill names, and path traversal rejection.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[k11kirky]

• refactor(skills): apply simplify-pass cleanups across the stack #2612
• feat(skills): Codex unification — bring your skills, use them anywhere #2611
• feat(skills): publish skills to the team and install team skills locally #2610 👈 (View in Graphite)
• feat(skills): PostHog cloud team skills — read path #2609
• feat(skills): skills.sh marketplace browse and install #2608
• feat(skills): validation and shadowing signals #2607
• feat(skills): live refresh from the filesystem #2606
• feat(skills): create, edit, and delete user and repo skills #2605
• feat(skills): render full skill directories #2604
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

React Doctor could not complete this scan.

No React dependency found in /tmp/react-doctor-baseline-lDddHP/package.json. Add "react" to dependencies (or peerDependencies) and re-run.

_{Reviewed by React Doctor for commit 12ec1c5.}

[greptile-apps]

Prompt To Fix All With AI

Fix the following 3 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 3
packages/workspace-server/src/services/skills/skills.ts:248-263
**Partial write left on disk when file-path validation fails**

`resolveSkillFilePath` is called inside the write loop — after `mkdir(target)` and `writeFile(SKILL.md)` have already run. If any companion file carries a path that escapes the skill directory, the validation throws and the partially-created `~/.claude/skills/<name>` directory (with `SKILL.md` already written) is left on disk. The next call to `installTeamSkill` with the same name (and no `overwrite: true`) then fails with "already exists" instead of the real validation error — the test's `finally { rm(target) }` block papers over this exact scenario.

Validate all resolved paths before touching the filesystem: compute each `filePath` against `target` first, collect them, then proceed with `mkdir`/`writeFile`.

### Issue 2 of 3
packages/ui/src/features/skills/TeamSkillDetailPanel.tsx:51
The "already exists" detection relies on substring-matching the error message. If the server-side error text ever changes (e.g., a future i18n change or message reword), the overwrite dialog will silently stop appearing and the user will see a generic "Failed to install skill" toast instead.

```suggestion
      if (!overwrite && (message.includes("already exists") || message.includes("already installed"))) {
```

### Issue 3 of 3
packages/core/src/skills/teamSkillsService.ts:24-29
**Duplicate `ExportedSkill` type (OnceAndOnlyOnce)**

`ExportedSkill` is now defined in both `packages/core/src/skills/teamSkillsService.ts` (files-only shape) and `packages/workspace-server/src/services/skills/schemas.ts` (same shape + `skipped`). The two definitions are structurally compatible today, but they can drift independently. The workspace-server type is the canonical one since it's the Zod schema that validates the tRPC wire format — the core type could simply re-export or `Omit<ExportedSkill, 'skipped'>` from it.

_{Reviews (1): Last reviewed commit: "feat(skills): publish skills to the team..." | Re-trigger Greptile}

[k11kirky]

Merge activity

• Jun 12, 11:31 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 12, 11:32 AM UTC: Graphite couldn't merge this pull request because a downstack PR feat(skills): create, edit, and delete user and repo skills #2605 failed to merge.
• Jun 12, 11:54 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 12, 12:49 PM UTC: Graphite rebased this pull request as part of a merge.
• Jun 12, 1:01 PM UTC: @k11kirky merged this pull request with Graphite.