dsh-skill-manage

dsh-skill-manage

A graphical skill manager for DeepSeek Harness (dsh). Install, search, enable, disable and remove skills from your Web UI — no SKILL.md editing, no shell commands.

English · 中文

Features

• Zero-file management — enable/disable, overwrite and uninstall skills through a Web UI panel; frontmatter flags (disable-model-invocation, user-invocable) are rewritten for you.
• Four install channels — a local folder, a browser folder picker, a GitHub URL, or an online search over skills.sh.
• Smart batch installs — paste a …/tree/<branch>/<dir> link; a parent directory yields a plan from the GitHub Trees API (~0.5 s, zero clone; falls back to a local clone scan automatically). Tick what you want and install in one shot.
• Conflict-first UX — same-name skills never die by default; an inline prompt offers Overwrite / Cancel, identically across every install channel.
• Network resilience — a direct GitHub clone that fails transparently retries through ghfast.top / gh-proxy.com mirrors (on by default).
• Official rank alignment — scans ~/.dsh/skills + ~/.agents/skills in the exact order the official dsh-skill-filesystem provider uses, including same-name shadowing.

Screenshots

User scope — manage every skill registered for all sessions:

Project scope — pick a workspace from the Web UI switcher and manage its .dsh/skills:

Installation

From npm (recommended):

dsh plugin --profile web add @nay-1/dsh-skill-manage

If the pnpm supply chain policy blocks the build script, grant approval in your profile:

# ~/.dsh/profiles/web/pnpm-workspace.yaml
allowBuilds:
  '@nay-1/dsh-skill-manage': true

From GitHub:

dsh plugin --profile web add github:Nay-1/dsh-skill-manage

From a local path:

git clone https://github.com/Nay-1/dsh-skill-manage.git
cd dsh-skill-manage && pnpm install && pnpm build
dsh plugin --profile web add /path/to/dsh-skill-manage

Restart dsh web, then open Settings → Skill Management.

Usage

Management scopes & priority

The project root is resolved to the nearest ancestor containing .git (official provider semantics). Same-name skills are shadowed by the higher-rank root; installs always land in the top root of their scope. Every skill from a non-top rank root (.agents) gets a .agents badge in the list — user and project scopes alike.

Skill formats: directory bundles (<name>/SKILL.md) and flat single-file skills (<name>.md) are both discovered and manageable.

Installing skills

Install plan (parent-directory links, bare multi-skill repos):

1. The repo tree is scanned via the GitHub Trees API — about 0.5 s, no clone (falls back to a clone scan when the API errors, rate-limits, or truncates).
2. A checklist appears; rows already present are marked Already installed and unchecked by default — checking one means overwrite.
3. With more than 15 skills a confirmation bar asks first: "N skills — continue?".
4. Confirm → one shallow clone → each checked skill is validated and installed.

GitHub examples:

Conflicts

Every channel behaves the same: if the name exists, an inline "skill x already exists" prompt offers Overwrite / Cancel. Nothing is overwritten by accident.

Managing the list

• Search / refresh by skill name.
• Each row shows a colored letter icon, a status dot (green = enabled, grey = disabled) and an Enabled / Disabled pill.
• Enable / Disable flips both disable-model-invocation and user-invocable in one click.
• Uninstall is a two-click confirm, confined to managed skill directories.

Performance & limits

• GitHub Trees API without authentication: 60 requests/hour — one scan uses one; on failure / rate limit / truncated payload the plugin silently falls back to a clone scan.
• Batch installs have no hard cap, but >15 skills require explicit confirmation.
• Private repositories are not supported (no credentials).
• skills.sh search has a 10-second timeout with a friendly error; the site is a public, undocumented endpoint.

FAQ

GitHub installs hang or time out — is a VPN required? The clone runs inside the dsh process, so it needs either a reachable network or the mirror fallback (on by default). To use a system proxy, launch dsh in a shell that exports http_proxy/https_proxy; git inherits them. If the process has no proxy variables and the mirror cannot reach GitHub either, the error message tells you so.

Do I need a VPN at all? Usually not: ghfast.top and gh-proxy.com mirrors are reachable without a proxy. Keep use mirror on direct failure checked (default).

Skills.sh search says "response timed out". The endpoint is a third-party site; wait and retry. Direct connectivity to skills.sh is generally fine from China.

A skill I searched for cannot be installed. The repository must contain a SKILL.md with a valid name (kebab-case) and description. Skills.sh sometimes lists renamed or removed skills — pick the newest hit or use the repo directly.

Where does a skill come from? Skills in the .agents home root carry a small .agents badge in the list, so you always know which root you are editing or deleting.

Why does my npm install fail with "Two-step verification required"? That is an npm-side publishing policy, unrelated to this plugin — add 2FA to your npm account or use a granular access token with bypass-2FA enabled.

Architecture

Routes: GET /skills, GET /workspaces · POST /search-skills, /install, /install-upload, /install-github, /remove, /toggle.

Skills are discovered by scanning the filesystem directly (mirroring the official provider's directory and rank semantics), because ctx.skills in the host context only exposes the global layer. GitHub and upload installs clone or stage into temp dirs and reuse one handleInstall validation path. The client bundle is the stable module ID dsh-skill-manage (fixed, not the npm package name — see build.mjs) so registry loading works with any package name.

Development

pnpm install
pnpm build       # emits lib/
pnpm typecheck   # tsc --noEmit

Local loop: edit → pnpm build → restart dsh web.

License

MIT