chore(skills): use shared skills package

[abretonc7s]

Summary

• Add yarn skills integration for Core, mirroring Mobile/Extension behavior.
• Delegate skills sync/setup to the shared @metamask/skills CLI instead of keeping Core-local sync scripts.
• Ignore generated skill outputs and document Core skill usage.

Related

• ADR 57: https://github.com/MetaMask/decisions/pull/162
• Shared package PR: feat(skills): add shared sync cli package skills#24

Validation

Validated against the published @metamask/skills npm package (^0.1.0):

• node --check bin/metamask-skills.mjs
• npm pack --pack-destination /tmp
• packed CLI sync --target /Users/deeeed/dev/metamask/core-4 --dry-run
• packed CLI postinstall --target /Users/deeeed/dev/metamask/core-4 --dry-run with SKILLS_AUTO_UPDATE=1
• packed CLI target override with METAMASK_SKILLS_TARGET_REPO=core

The lockfile has been refreshed against the published package, so dependency install / immutable install checks now pass.

How to use

Run manual sync:

yarn skills

To opt into best-effort regeneration during setup/install, add this to .skills.local or your shell:

SKILLS_AUTO_UPDATE=1

Optional filters work through the shared installer:

SKILLS_DOMAINS=testing,coding
SKILLS_INCLUDE=agentic/recipe-harness

Use METAMASK_SKILLS_TARGET_REPO locally for forks or unusual remotes that should use the canonical core overlays.

---

Note

Low Risk
Developer-only tooling and install hooks; no runtime library or controller code changes.

Overview
Wires Core into the shared @metamask/skills CLI so agent skills sync matches Mobile/Extension instead of repo-local scripts.

package.json adds yarn skills (metamask-skills sync), skills:postinstall, and a root postinstall hook (optional refresh when SKILLS_AUTO_UPDATE=1). @metamask/skills@^0.1.0 is a devDependency with an updated yarn.lock. LavaMoat allowScripts now allows $root$ so install can run the skills postinstall.

.gitignore excludes .skills.local, .skills-cache/, and generated outputs under .claude/skills/, .agents/skills/, and .cursor/rules/. .skills.local.example documents domain filters and env overrides; README adds an Agent skills section with usage commands.

^{Reviewed by Cursor Bugbot for commit 08001cc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[geositta]

Thanks for adding a focused skills workflow and tests around the cache/postinstall behavior. I am requesting changes because the new root postinstall entry currently breaks the repo’s normal install path: LavaMoat allow-scripts detects the root lifecycle script and exits until $root$ is configured, even though Yarn itself will not execute lifecycle scripts with enableScripts: false.

Please address the install failure by either adding the explicit root allow-scripts policy or moving this cache refresh into an explicitly invoked setup command instead of declaring a root lifecycle script. I verified scripts/skills-postinstall.test.ts passes with coverage disabled, and git diff --check origin/main...HEAD passes.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9969f81. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​metamask/​skills@​0.1.0

View full report