Skill Repository Runner

Problem

When pulling and validating third-party skill repositories, the friction is rarely just cloning. Dependency versions, mirror sources, runtime differences, and unclear entrypoints often turn debugging into manual triage. This skill turns that workflow into a repeatable execution path for verifying owner/repo repositories in isolated environments.

How it works

• Repository pull: parse the repository address, clone it into a local cache directory, then read skill.json.
• Dependency handling: process only declared dependencies and match available mirror sources from config/mirrors.json.
• Entrypoint execution: run only the script declared by entrypoint, not undeclared files in the repository.
• Structured output: use --json to return execution status, logs, and artifact paths for automation pipelines.
• Prechecks and self-tests: use --dry-run for batch pull rehearsals and --selftest to verify network, Git, and runtime prerequisites.

Boundaries

It does not guarantee third-party repository safety or handle authentication credentials. If entrypoint, dependency versions, branch, or mirror configuration is missing, it emits [needs verification: field] instead of guessing. It is useful for developers, operators, and automation engineers validating skill repositories, but not for bypassing code review or silently executing unknown scripts.