[FEAT] Support skills from hf skills

[burtenshaw]

This PR allows uses to add and update skills from huggingface/skills

You can test it like this.

hf skills add gradio
ls .agents/skills/huggingface-gradio

The naming in huggingface/skills should be simplified before we merge this. i.e. hugging-face-trackio >> trackio. That's added here

---

Note

Medium Risk
Adds new CLI flows that download/extract content from GitHub and overwrite local skill directories, so failures could impact user files and depend on external API behavior/network reliability.

Overview
hf skills add now installs named marketplace skills from huggingface/skills (defaulting to hf-cli) instead of writing a locally generated SKILL.md, and narrows assistant-specific installs to an optional Claude symlink.

Adds hf skills upgrade to detect and refresh installed skills when the upstream revision changes, backed by a new manifest file (.hf-skill-manifest.json) and atomic replace logic for safe overwrites.

Updates the generated CLI docs and expands test coverage with a fake GitHub marketplace/session to validate install/force/upgrade behavior and edge cases.

^{Written by Cursor Bugbot for commit 976f2ac. This will update automatically on new commits. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[Wauplin]

(high level review only, my main feedback being "let's try to keep things simple")

[Wauplin]

I feel that hf skills add and hf skills preview description could be harmonized now that we have more than 1 skill that can be installed

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[burtenshaw]

Thanks for the review @Wauplin. I've responded to each item and cut down the bloat.

[JiwaniZakir]

The removal of --codex, --cursor, and --opencode flags from hf skills add in the docs (and presumably in the CLI implementation) is a breaking change with no deprecation path mentioned. Users relying on those flags in scripts or CI pipelines will get silent failures or unrecognized option errors after upgrading. At minimum, keeping the flags but printing a deprecation warning would be safer.

In install_marketplace_skill, the two consecutive if install_dir.exists() checks are misleading — the second block is only reachable when force=True, but that's implicit rather than explicit. Using elif force: would make the control flow clearer and prevent any future regression if the first guard is accidentally changed.

The constant GITHUB_API_TIMEOUT appears to govern requests made via get_session() to the HuggingFace Hub, not GitHub's API — the name is a misnomer that will cause confusion when someone goes looking for where GitHub calls are rate-limited or configured. Renaming it to HF_API_TIMEOUT or HUB_REQUEST_TIMEOUT would match the actual usage.

[burtenshaw]

@JiwaniZakir thanks for the tokens, but we got this.