Skill Management UI

English | 中文

The plugin owns its original skill icon in Settings; its icon contribution is removed with the plugin.

@deepseek-ai/dsh-client-ui-skill-manager owns the native Skill Management Settings page. The Client lists current Skills, opens their files without leaving the page, and offers one Import Skill menu for local files, folders, ZIP archives, or a GitHub repository URL. File and folder choices open the browser picker immediately; GitHub alone reveals an inline URL field. The Host resolves the same preset-scoped Skill registry as the active work Session, previews only files owned by the selected Skill, and installs only into $DSH_HOME/skills. If pure Chat is selected, management prefers the latest work Session so installed Skills remain visible without granting Chat any Skill capability; if that historical Session is no longer resident, it safely falls back to the global registry.

Sources and inspection

The page groups user-dsh and user-agents as personal, project-dsh and project-agents as project, and shows runtime, custom, and bundled sources separately. Only personal rows are writable. Project, runtime, custom, and bundled rows are read-only. The first view is a width-capped single-column Skill catalog: each row shows the icon, name, an AI-judged category tag (from the optional category frontmatter field; rows without one omit the tag), a two-line clamped introduction merging description with optional whenToUse, and the writability badge on the right. Opening a row replaces that catalog with a focused reader: a back action returns to all Skills, the human explanation is compact and expandable, and the file tree remains beside a readable content pane. Markdown preview removes only leading YAML frontmatter from the visual rendering; the source file remains unchanged. Text, code, and raster images render inline, while other binary files show type and size metadata. Hidden files and symbolic links are not exposed through directory preview.

Import and installation

POST /plugins/skill-manager/api/import accepts browser file data or a plain https://github.com// URL from a loopback, same-origin page. Browser folder imports preserve webkitRelativePath. ZIP entries are validated before extraction, and GitHub imports use a shallow, single-branch clone without tags. Each operation stays in a temporary $DSH_HOME/tmp/skill-import-* directory and is removed after success or failure.

Imported repositories and files are untrusted data. The Host rejects path traversal and symbolic links, caps file count and bytes, and excludes common credential and secret filenames from model input. It calls only deepseek-official/deepseek-v4-flash-vision-exp with an explicit empty tool list. The model returns one SKILL.md plus validated mappings to staged resources; the response must carry a short Chinese category tag that matches the frontmatter value. It cannot execute imported code or choose another model. When the normalized name already exists, only that Skill's direct definition is added to a second normalization call.

The Host validates the final name, frontmatter, and resource paths before writing a same-filesystem candidate directory. Replacing a personal Skill first renames the original to a private backup, swaps the candidate into place, and restores the original if the swap fails. Project and bundled directories are never modified.

Composition

The Host requires WebServer, ctx.skills, ctx.llm, Sessions, Agents, and Agent Presets. Requests carry the active work Session id so the page resolves the same cwd, live Agent, preset, and scoped registry as the composer. The Client uses the selected Session directly unless it is pure Chat; in that case it picks the newest non-Chat Session from the existing Session list. It falls back to Config.cwd and the global registry when no usable work Session exists or when that durable history row is no longer resident in the Host. Config.dshHome selects the personal destination and otherwise follows the standard DSH Home resolver. The Client requires the Settings slot registry and Session service. The package contributes section id skill, ordered after the native Xiaozhuang plugin catalog.

Model Experience

Auxiliary Skill normalization

What the model sees

The fixed deepseek-official/deepseek-v4-flash-vision-exp request sees the bounded staged file list and inline text, framed as untrusted data. A same-name conflict causes one second request that additionally sees only that existing Skill's name, description, and instruction body. The request has no tools and does not join a user conversation or Session log.

Token effect

One auxiliary call consumes the bounded imported text; a same-name conflict consumes one additional call. Binary resources contribute only path and size metadata. Installed content becomes model-visible only later through the existing Skill registry and Skill consumer.

KV Cache effect

The auxiliary calls are independent from the active conversation and do not rewrite its cache. Each import's staged file JSON changes the auxiliary request, while the fixed system instruction remains reusable subject to provider caching.

Known Limitations and Deferred Work

• The catalog shows the winning Skill for each name because ctx.skills resolves provider precedence before this package reads it; shadowed duplicates are not separately inspectable.
• Raster images are previewed but reach normalization as resource metadata in this first implementation; the original bytes remain available for validated resource copying.
• Import is one synchronous request. The page reports completion or failure but does not persist a background progress history.