diff --git a/pkg/skills/clawhub_registry.go b/pkg/skills/clawhub_registry.go index ff3ba8d70..e1f1068de 100644 --- a/pkg/skills/clawhub_registry.go +++ b/pkg/skills/clawhub_registry.go @@ -248,6 +248,7 @@ func (c *ClawHubRegistry) DownloadAndInstall( result.IsMalwareBlocked = meta.IsMalwareBlocked result.IsSuspicious = meta.IsSuspicious result.Summary = meta.Summary + result.MetadataAvailable = true } // Step 2: Resolve version. diff --git a/pkg/skills/registry.go b/pkg/skills/registry.go index 45ae72253..8032c4f8d 100644 --- a/pkg/skills/registry.go +++ b/pkg/skills/registry.go @@ -36,10 +36,11 @@ type SkillMeta struct { // InstallResult is returned by DownloadAndInstall to carry metadata // back to the caller for moderation and user messaging. type InstallResult struct { - Version string - IsMalwareBlocked bool - IsSuspicious bool - Summary string + Version string + IsMalwareBlocked bool + IsSuspicious bool + Summary string + MetadataAvailable bool } // SkillRegistry is the interface that all skill registries must implement. diff --git a/pkg/tools/skills_install.go b/pkg/tools/skills_install.go index 71bfe730b..ff45b8355 100644 --- a/pkg/tools/skills_install.go +++ b/pkg/tools/skills_install.go @@ -159,10 +159,13 @@ func (t *InstallSkillTool) Execute(ctx context.Context, args map[string]any) *To _ = err } - // Build result with moderation warning if suspicious. + // Build result with moderation warnings. var output string + if !result.MetadataAvailable { + output += fmt.Sprintf("Warning: safety metadata was not available for skill %q. Exercise caution.\n\n", slug) + } if result.IsSuspicious { - output = fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug) + output += fmt.Sprintf("⚠️ Warning: skill %q is flagged as suspicious (may contain risky patterns).\n\n", slug) } output += fmt.Sprintf("Successfully installed skill %q v%s from %s registry.\nLocation: %s\n", slug, result.Version, registry.Name(), targetDir)