Selecting one skill can leave out sibling skills that its instructions or scripts need. Install those dependencies when the skill declares them in metadata:
name: video-workflow
description: Create a video ad.
metadata:
dependencies: "video-tools text-overlay"skills add owner/collection --skill video-workflow installs all three, including any transitive dependencies. Git sources use one checkout at the requested ref; local sources stay within the supplied directory. Dependencies are ordinary skills with existing lock entries and update/restore behavior.
Resolve before confirmation and writes, rejecting missing or ambiguous names, cycles and paths outside the source. Sync checks the full dependency set against filters and protected destinations, and keeps offline repair working. No new flags, runtime dependencies or lock format changes. Cross-repository dependencies and version constraints are out of scope; npm, well-known and independent download sources reject dependency requirements explicitly.
This follows the use case in #861, but places the declaration under metadata rather than adding a top-level depends field. It is a CLI extension, not a new Agent Skills standard field. No code was copied from that PR. Related: #515, #860, #1438 and scenario-labs/skills#49.
Verified on macOS arm64 with Node 25.8.1 and pnpm 10.17.1: 1,016 tests, build, typecheck, formatting and compiled CLI installation with both package entry points. The selective-install regression failed before the change and now checks the dependency files, sibling resource access and lock entries. Tests also cover sync filters/conflicts, offline repair, pinned refs and restoration. The existing Ubuntu/Windows CI matrix is unchanged; those platforms have not been run locally.
Security review details