Function downloadSkillFromGitHub

packages/cli/src/utils/github.ts:250–311

(
  skill: Skill & { project: string }
)

}

export async function downloadSkillFromGitHub(
  skill: Skill & { project: string }
): Promise<{ files: SkillFile[]; error?: string }> {
  try {
    const parsed = parseGitHubUrl(skill.url);

    if (!parsed) {
      return { files: [], error: `Invalid GitHub URL: ${skill.url}` };
    }

    const { owner, repo, branch, path: skillPath } = parsed;

    const ghHeaders = getGitHubHeaders();

    const treeData = await fetchRepoTree(owner, repo, branch, ghHeaders);
    if ("error" in treeData) {
      const hint =
        !ghHeaders["Authorization"] && /403|429|rate/.test(treeData.error)
          ? " — run `gh auth login` or set the GITHUB_TOKEN env var to increase rate limits"
          : "";
      return { files: [], error: `GitHub API error: ${treeData.error}${hint}` };
    }

    const skillFiles = treeData.tree.filter(
      (item) => item.type === "blob" && item.path.startsWith(skillPath + "/")
    );

    if (skillFiles.length === 0) {
      return { files: [], error: `No files found in ${skillPath}` };
    }

    const files: SkillFile[] = [];
    for (const item of skillFiles) {
      const rawUrl = `${GITHUB_RAW}/${owner}/${repo}/${branch}/${item.path}`;
      const fileResponse = await fetch(rawUrl, { headers: ghHeaders });

      if (!fileResponse.ok) {
        console.warn(`Failed to fetch ${item.path}: ${fileResponse.status}`);
        continue;
      }

      const content = await fileResponse.text();
      const relativePath = item.path.slice(skillPath.length + 1);

      // Reject paths that attempt directory traversal
      if (relativePath.includes("..")) {
        console.warn(`Skipping file with unsafe path: ${item.path}`);
        continue;
      }

      files.push({
        path: relativePath,
        content,
      });
    }

    return { files };
  } catch (err) {