dsh-skill-remote

Remote skill source for DeepSeek Harness: discover and install skills from skills.sh and public GitHub repositories, directly from your agent.

• A remote skill provider (ctx.skills): candidates discovered from skills.sh / github.com URLs appear in the session skill catalog beside local skills; bodies load on demand.
• An install_skill tool for the model: downloads a skill bundle atomically into $DSH_HOME/skills/<name>/, where the built-in filesystem provider takes it over — no restart needed.

Zero configuration: with no remotes configured and no installs, the plugin performs no network I/O.

Install

Requires the DeepSeek Harness next line (dsh ≥ 0.1.0-rc.6, which ships dsh-skill 0.1.0-rc.6). From GitHub (sources; pnpm builds via prepare):

dsh plugin --profile default add github:you/dsh-skill-remote

pnpm ≥ 10 asks you to allow the build — add the printed package key to the profile's pnpm-workspace.yaml:

allowBuilds:
  dsh-skill-remote: true

Then re-run the add. (Treat the allowance as permission to run this package's build on your machine; pin a commit if you prefer: github:you/dsh-skill-remote#<sha>.)

From npm (prebuilt, no build permission needed):

dsh plugin --profile default add dsh-skill-remote

Usage

Say to the agent:

Install the skill at https://github.com/anthropics/skills/tree/main/skills/docx

The model calls install_skill, and the skill becomes available through the skill tool immediately. You can also pre-register read-only remote sources:

# profile cordis.patch.yml
- update:
    - id: skill-remote
      config:
        remotes:
          - https://github.com/anthropics/skills/tree/main/skills/docx

Supported URL shapes: https://www.skills.sh/<owner>/<repo>/<skill>, https://github.com/<owner>/<repo>/tree/<ref>/<subpath>, https://raw.githubusercontent.com/<owner>/<repo>/<ref>/<subpath>/<file>.

Safety limits (hard-coded)

Limit	Value
Single file	1 MiB
Whole bundle	8 MiB
File count	64
Recursion depth	4
Request timeout	30 s
Path escape (.., /, \ in entry names)	rejected
Symlinks / submodules	skipped

Installs are atomic: the bundle downloads into a sibling staging directory and is renamed into place only after it validates (SKILL.md present); any failure removes the staging directory. Public repositories only — no token is read, stored, or sent.

Configuration

interface Config {
  providerName?: string   // default 'remote'
  remotes?: string[]      // URLs pre-registered at startup
  installRoot?: string    // default $DSH_HOME/skills
}

Known limitations

• Public repositories only — no OAuth/private repos; unauthenticated GitHub API rate limits (60 req/h per IP) apply.
• Direct-children discovery only — like the built-in filesystem provider, remote sources are not scanned recursively.
• No version pinning — every load fetches the current ref tip; installation is the only persistence.

Contributing to the ecosystem

• The repository is tagged with the dsh-plugin topic — browse other plugins and add yours.
• Found a bug or want a feature? Open an issue or PR; tests run with pnpm install && pnpm test.
• The behavior ported here comes from CsyCode chapter 11's remote skill installer.

License

MIT