npx skills add vercel/eve installs the entire monorepo (1831 files) instead of the skill

[haydenbleasel]

Summary

Running npx skills add vercel/eve installs the entire eve monorepo (1,831 files) into the project instead of the single eve skill. The skill is meant to be just its ~1 KB SKILL.md (a pointer skill whose body is essentially "read node_modules/eve/docs/").

This is the exact command published on the eve website under its "for agents" install snippet, so anyone copy-pasting that command hits this.

Repro

npx skills add vercel/eve

Result: a single skill named eve whose directory contains the whole repo — .changeset/, .github/workflows/, apps/docs/app/**, Dockerfile, lockfiles, etc.

Root cause

vercel is a blob-allowed owner, so add takes the skills.sh blob fast-path rather than cloning. The download/snapshot API scopes a snapshot to everything under the SKILL.md's directory. For a normal skill that directory is the skill's own folder; for vercel/eve the SKILL.md lives at the repo root, so "its directory" is the entire repository.

Evidence from the download API:

Skill	SKILL.md location	snapshot files
vercel-labs/skills → find-skills	its own folder find-skills/	1 ✅
vercel/eve → eve	repo root	1831 ❌ (whole monorepo)

GET https://skills.sh/api/download/vercel/eve/eve            → 200, files=1831
GET https://skills.sh/api/download/vercel-labs/skills/find-skills → 200, files=1

So snapshot scoping is "folder of the SKILL.md," with no special case for the degenerate root-level layout. Root-level SKILL.md is otherwise a first-class, supported layout (the discovery code lists '' as a priority prefix in both the blob path and the on-disk walk), so the install command is meant to work — the packaging just needs to scope it.

Suggested fix

• skills.sh (primary): when a skill's SKILL.md is at the repo root, the snapshot should include only the SKILL.md plus genuine sibling skill assets — never the surrounding project (lockfiles, apps/, packages/, CI workflows, etc.). A size/file-count cap as a backstop would also help.
• CLI (defense-in-depth): the clone fallback shares the same flaw — discoverSkills treats a root-level SKILL.md as a skill rooted at the repo root, and copyDirectory only excludes .git/__pycache__/__pypackages__, so it would copy node_modules/apps/packages too. Worth guarding (skip obvious project dirs and/or warn before writing an unusually large "skill").

Workaround

npx skills remove eve (or delete the eve skill directory).

[jimweller]

Same failure on ogulcancelik/herdr. Its SKILL.md is at the repo root because the Rust binary embeds it via include_str!, so root placement is a build requirement there.

npx skills add ogulcancelik/herdr --skill herdr installs 2,323 files / 41 MB — the full Rust source tree, vendor/, and the marketing website. With the default multi-agent install that is ~131 MB across agent dirs, for a 124-word instruction file.

Same on 1.5.20 with both the owner/repo and full-URL forms, and with or without --copy.