chore(skills): use shared skills package [DO-NOT-MERGE]

[abretonc7s]

🚧 DO NOT MERGE YET — waiting on @metamask/skills npm publication

This PR intentionally depends on the shared @metamask/skills package from MetaMask/skills#24.

Merge order:

1. Merge and publish @metamask/skills from feat(skills): add shared sync cli package skills#24.
2. Refresh this repo's lockfile against the published npm package.
3. Re-run CI.
4. Remove [DO-NOT-MERGE] and this banner before merging.

Until the package exists on npm, dependency install / immutable install checks are expected to fail with package-not-found errors.

---

Summary

• Add yarn skills integration for Core, mirroring Mobile/Extension behavior.
• Delegate skills sync/setup to the shared @metamask/skills CLI instead of keeping Core-local sync scripts.
• Ignore generated skill outputs and document Core skill usage.

Related

• ADR 57: https://github.com/MetaMask/decisions/pull/162
• Shared package PR: feat(skills): add shared sync cli package skills#24

Validation

Validated against a locally packed @metamask/skills tarball from MetaMask/skills#24:

• node --check bin/metamask-skills.mjs
• npm pack --pack-destination /tmp
• packed CLI sync --target /Users/deeeed/dev/metamask/core-4 --dry-run
• packed CLI postinstall --target /Users/deeeed/dev/metamask/core-4 --dry-run with SKILLS_AUTO_UPDATE=1
• packed CLI target override with METAMASK_SKILLS_TARGET_REPO=core

Note: CI dependency installation requires @metamask/skills to be published and this branch lockfile to be updated after MetaMask/skills#24 lands.

How to use

Run manual sync:

yarn skills

To opt into best-effort regeneration during setup/install, add this to .skills.local or your shell:

SKILLS_AUTO_UPDATE=1

Optional filters work through the shared installer:

SKILLS_DOMAINS=testing,coding
SKILLS_INCLUDE=agentic/recipe-harness

Use METAMASK_SKILLS_TARGET_REPO locally for forks or unusual remotes that should use the canonical core overlays.

---

Note

Low Risk
Developer-only install/sync tooling and gitignored generated files; no runtime controller or client behavior changes.

Overview
Adds MetaMask agent skills to Core via the shared @metamask/skills CLI, aligned with Mobile/Extension: yarn skills runs metamask-skills sync, and postinstall optionally refreshes the skills cache when the binary is present.

package.json gains the dev dependency, skills / skills:postinstall scripts, and Lavamoat $root$ allowlisting so install-time skills hooks can run. .gitignore now excludes local config (.skills.local), cache (.skills-cache/), and generated outputs under .claude/skills/, .agents/skills/, and .cursor/rules/ (and stops tracking .sisyphus/ as an exception).

.skills.local.example documents optional overrides (SKILLS_DOMAINS, SKILLS_AUTO_UPDATE, skill source paths). The README adds an Agent skills section with usage examples (--domain, --select, --reset).

^{Reviewed by Cursor Bugbot for commit 147301e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[geositta]

Thanks for adding a focused skills workflow and tests around the cache/postinstall behavior. I am requesting changes because the new root postinstall entry currently breaks the repo’s normal install path: LavaMoat allow-scripts detects the root lifecycle script and exits until $root$ is configured, even though Yarn itself will not execute lifecycle scripts with enableScripts: false.

Please address the install failure by either adding the explicit root allow-scripts policy or moving this cache refresh into an explicitly invoked setup command instead of declaring a root lifecycle script. I verified scripts/skills-postinstall.test.ts passes with coverage disabled, and git diff --check origin/main...HEAD passes.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9969f81. Configure here.}