feat(agent): bundle find-skills and skill-creator as built-in skill for agent

[DeJeune]

What this PR does

Before this PR:
Users had no built-in way to discover and install agent skills from the open ecosystem within Claude Code sessions.

After this PR:
The find-skills skill (from vercel-labs/skills) is bundled as a built-in resource and automatically installed to the user-level .claude/skills/ directory on app startup. This enables users to use npx skills find and npx skills add within Claude Code sessions to discover and install skills from the open agent skills ecosystem. When npx is unavailable, the agent falls back to the bundled bun at ~/.cherrystudio/bin/bun x.

Why we need it and why it was done in this way

The find-skills skill acts as a package manager interface for the open agent skills ecosystem, letting users search and install skills via npx skills. Bundling it as a built-in ensures it works offline and is available immediately without user configuration.

The following tradeoffs were made:

• Skills are copied to {userData}/.claude/skills/ (the CLAUDE_CONFIG_DIR path) so they are globally available to all agent sessions without per-project duplication.
• Existing skill directories are not overwritten, preserving any user modifications.
• The SKILL.md includes runtime detection to fall back to Cherry Studio's bundled bun when npx is not installed.

The following alternatives were considered:

• Auto-installing from GitHub on first use — rejected because it requires network access and adds startup latency.
• Copying per-project into each agent's cwd — rejected because the SDK already reads from the user-level .claude/skills/ via CLAUDE_CONFIG_DIR.

Breaking changes

None.

Special notes for your reviewer

• The copy logic runs synchronously in bootstrap.ts alongside other early file operations (copyOccupiedDirsInMainProcess).
• The resources/skills/ directory is already covered by the asarUnpack: resources/** rule in electron-builder.yml.
• The skill content is based on vercel-labs/skills/skills/find-skills/SKILL.md with an added runtime detection section for the bun fallback.

Checklist

• PR: The PR description is expressive enough and will help future contributors
• Code: Write code that humans can understand and Keep it simple
• Refactor: You have left the code cleaner than you found it (Boy Scout Rule)
• Upgrade: Impact of this change on upgrade flows was considered and addressed if required
• Documentation: A user-guide update was considered and is present (link) or not required.
• Self-review: I have reviewed my own code before requesting review from others

Release note

NONE

[GeorgeDong32]

Note

This review was translated by Claude.

Code Review Summary

Overview

This PR implements a practical feature: bundling the find-skills skill as a built-in resource in Cherry Studio, allowing users to conveniently discover and install other skills. The overall code quality is good, and the documentation is clear and complete.

Strengths ✅

1. Simplicity: The installBuiltinSkills() function has clear logic and a single responsibility
2. Idempotency: Checks for target directory existence to avoid duplicate copying, protecting user modifications
3. Complete Documentation: SKILL.md contains detailed usage scenarios, command descriptions, and examples
4. Runtime Detection: Added npx and bun fallback logic

Issues to Watch ⚠️

1. Synchronous file operations may block the main process (bootstrap.ts)
Currently using synchronous APIs (readdirSync, mkdirSync, cpSync) to copy skill files at startup, which may block the Electron main process if the skill package is large. Consider changing to async implementation with error handling.

2. Hardcoded bun path (SKILL.md)
The ~/.cherrystudio/bin/bun path assumes a specific installation structure. Consider adding existence checks or passing via environment variables.

Overall Assessment

Dimension	Score
Correctness	8/10
Maintainability	7/10
Robustness	6/10
Documentation	9/10
Overall	7.5/10

Recommendations

• Consider changing synchronous file operations to asynchronous to avoid blocking the main process
• Add error handling and logging
• Handle edge cases for hardcoded paths

---

Original Content

Code Review Summary

概述

此 PR 实现了一个实用的功能：将 find-skills skill 作为内置资源捆绑到 Cherry Studio 中，使用户可以方便地发现和安装其他技能。整体代码质量良好，文档清晰完整。

优点 ✅

1. 简洁性：installBuiltinSkills() 函数逻辑清晰，职责单一
2. 幂等性：检查目标目录存在性避免重复复制，保护用户修改
3. 文档完整：SKILL.md 包含详细的使用场景、命令说明和示例
4. 运行时检测：添加了 npx 和 bun fallback 的逻辑

需要关注的问题 ⚠️

1. 同步文件操作可能阻塞主进程 (bootstrap.ts)
当前使用同步 API (readdirSync, mkdirSync, cpSync) 在启动时复制技能文件，如果技能包较大可能阻塞 Electron 主进程。建议改为异步实现并添加错误处理。

2. 硬编码的 bun 路径 (SKILL.md)
~/.cherrystudio/bin/bun 路径假设了特定安装结构，建议添加存在性检查或考虑通过环境变量传递。

总体评价

维度	评分
正确性	8/10
可维护性	7/10
健壮性	6/10
文档	9/10
总体	7.5/10

建议

• 考虑将同步文件操作改为异步，避免阻塞主进程
• 添加错误处理和日志记录
• 处理硬编码路径的边界情况

Reviewed by kimi-k2.5

[EurFelux]

Note

This comment was translated by Claude.

We need to discuss whether it is truly necessary to add these two skills to the public skills. The submitted skills are ultimately meant to be shared among team developers, but the relevance of these two skills to our development workflow is not strong. Is it necessary for everyone to install these two skills? What would be inconvenient about making them private skills?

---

Original Content

需要讨论下是否确实需要把这两个skill添加到public skill。这些提交上来的skill说到底是给团队的开发者共享的，但这两个skill与我们的开发流程相关性并不强。我们有必要给每个人都装上这两个skill吗？作为private skill有哪里不方便呢？

[GeorgeDong32]

We need to discuss whether it is truly necessary to add these two skills to the public skills. The submitted skills are ultimately meant to be shared among team developers, but the relevance of these two skills to our development workflow is not strong. Is it necessary for everyone to install these two skills? What would be inconvenient about making them private skills?

Note

This comment was translated by Claude.

This is for adding to the Agent, not as a development skill. I'm mainly concerned about the security of the find skill—when users use it, the permissions are too high, which could automatically download malicious skills.

---

Original Content

这个是加到 Agent 里面的吧，不是作为开发 skill，我主要担心的是 find skill 的安全性问题，用户使用的时候权限过高可能会自动下载恶意 skill

[EurFelux]

Note

This comment was translated by Claude.

Oh, my bad. find-skills indeed also has security issues. Perhaps we could modify this skill's workflow to provide security warnings and let users confirm the skill content?

---

Original Content

oh, my bad. find-skills 确实也有安全性问题，也许我们可以修改一下这个skill的工作流，提供安全性警告并让用户确认skill内容？

[EurFelux]

Note

This comment was translated by Claude.

Or hardcode the requirement that npx/pnpx/bunx skills add <package> must ask for confirmation.

---

Original Content

或者硬编码要求npx/pnpx/bunx skills add <package>需要ask for confirmation.