Outcome / prerequisites
Roadmap #29; requires #43's namespace/collision rules and existing immutable staging. No dependency on quota, Mesh replacement, a Go port, remote support or a full packaging redesign. First source example: cursor/plugins, exact chosen directories beneath pstack/skills.
Small first interface
Accept Git repository + explicit ref + exact relative skill-directory path. A simple inspection command may list a source directory without installing it. Multiple explicit selections are allowed. Do not parse ambiguous browser URLs, recursively infer dependencies from prose, install an entire plugin, or implement automatic name rewriting in this first version.
Scope
- Resolve the ref once to a full commit, inspect then copy the selected complete
SKILL.md/scripts/references/assets tree and required license files. Record remote/path/ref/commit/content hashes and origin in one selection lock extending the current inventory. Source fetch/install never runs upstream scripts/hooks/submodules/filters; accept only approved Git transports and validate extraction paths/symlinks/file types/size.
- Keep upstream bytes/provenance in a distinct vendored snapshot, with Sum-owned
sum-* wrappers separate. Preserve relative resources/modes. Missing external/shared resources are a visible requirement; require explicit inclusion or a reviewed wrapper rather than silently import sibling skills.
- Retain native names. Refuse duplicates/reserved-prefix collisions without overwriting either source. Defer alias generation and general compatibility transformation. A user-selected adaptation is a separate reviewed
sum-* source, not an opaque rewrite in the installer.
- Installation is not invocation or permission grant. Do not enable upstream rules, routines, MCPs,
allowed-tools, global Cursor/Claude settings or model defaults. Cursor-specific behavior such as pstack global setup must be disclosed; unsupported skills stay inactive or require an explicit wrapper, not declared universally portable.
- Commit reviewed selections/snapshots through the ordinary isolated development PR and existing release path. Setup validates installed hashes; workers need no network/package install during a turn. Explicit skill delivery works in external task worktrees, not just nested projects. Load only relevant metadata/body/resources on demand.
- A small
sum-skills guide points to the helper. No skill marketplace, resolver, scanning agent, scheduler or new database. No selections are preinstalled merely because the owner named pstack as a source.
Acceptance
Local Git fixtures with two siblings and one resource-bearing skill: selecting one imports only its explicit resources/notices. Test exact pin/offline reuse, ref changing during install, repeat install, name collision, missing asset/license, path escape, denied transport, malformed frontmatter and external worktree references. Test actual supported discovery paths plus plain reads and show capability limits.
Keep old running skill bundles usable; activate through #65's fixed updater, never overwrite live files/restart clients. Preserve project instructions, role/approval boundaries and worker/root verification AND review. #45 adds reviewed updates to this exact selection format; it is not required for initial installation to work.
Reference: https://github.com/cursor/plugins/tree/main/pstack/skills
Outcome / prerequisites
Roadmap #29; requires #43's namespace/collision rules and existing immutable staging. No dependency on quota, Mesh replacement, a Go port, remote support or a full packaging redesign. First source example:
cursor/plugins, exact chosen directories beneathpstack/skills.Small first interface
Accept Git repository + explicit ref + exact relative skill-directory path. A simple inspection command may list a source directory without installing it. Multiple explicit selections are allowed. Do not parse ambiguous browser URLs, recursively infer dependencies from prose, install an entire plugin, or implement automatic name rewriting in this first version.
Scope
SKILL.md/scripts/references/assets tree and required license files. Record remote/path/ref/commit/content hashes and origin in one selection lock extending the current inventory. Source fetch/install never runs upstream scripts/hooks/submodules/filters; accept only approved Git transports and validate extraction paths/symlinks/file types/size.sum-*wrappers separate. Preserve relative resources/modes. Missing external/shared resources are a visible requirement; require explicit inclusion or a reviewed wrapper rather than silently import sibling skills.sum-*source, not an opaque rewrite in the installer.allowed-tools, global Cursor/Claude settings or model defaults. Cursor-specific behavior such as pstack global setup must be disclosed; unsupported skills stay inactive or require an explicit wrapper, not declared universally portable.sum-skillsguide points to the helper. No skill marketplace, resolver, scanning agent, scheduler or new database. No selections are preinstalled merely because the owner named pstack as a source.Acceptance
Local Git fixtures with two siblings and one resource-bearing skill: selecting one imports only its explicit resources/notices. Test exact pin/offline reuse, ref changing during install, repeat install, name collision, missing asset/license, path escape, denied transport, malformed frontmatter and external worktree references. Test actual supported discovery paths plus plain reads and show capability limits.
Keep old running skill bundles usable; activate through #65's fixed updater, never overwrite live files/restart clients. Preserve project instructions, role/approval boundaries and worker/root verification AND review. #45 adds reviewed updates to this exact selection format; it is not required for initial installation to work.
Reference: https://github.com/cursor/plugins/tree/main/pstack/skills