fix(skills): refresh skilld instructions for 3.6.4

.skills/skilld-lock.yaml

@@ -1,19 +1,19 @@
 {
   "version": 1,
-  "transactionId": "1791339101009345295-0",
+  "transactionId": "1791345234786881456-0",
   "skills": {
     "skilld": {
       "source": {
         "type": "remote",
-        "source": "github:skilld-dev/skilld/skills/skilld#commit:fe3c82cf3dd5bea05036a747b1d9efa461f13c3b",
-        "commit_sha": "fe3c82cf3dd5bea05036a747b1d9efa461f13c3b",
+        "source": "github:skilld-dev/skilld/skills/skilld#commit:a71ea9c8eefdd6e2578f9e62989ccac03133bc68",
+        "commit_sha": "a71ea9c8eefdd6e2578f9e62989ccac03133bc68",
         "skill_path": "skills/skilld"
       },
       "sourceStatus": {
         "type": "verified",
-        "artifact_id": "sha256:c8633ed1d78d433dc4cb1ea8da74166f8f6910e3a4fd6664853e90f41f7541ff",
-        "content_sha256": "c8633ed1d78d433dc4cb1ea8da74166f8f6910e3a4fd6664853e90f41f7541ff",
-        "installed_sha256": "76f0bd7cfed129d7b1c6f8d0fbb71c0e96dde4f7611bd73f701ed523ac9083a1",
+        "artifact_id": "sha256:0ea5db9047ac38f4ac79dec2c20ccf29c4cf076f6eb83211829da5a9a33ff304",
+        "content_sha256": "0ea5db9047ac38f4ac79dec2c20ccf29c4cf076f6eb83211829da5a9a33ff304",
+        "installed_sha256": "83df67092189efdeb917f6d11cd578e11de764851a940763aed23ca0e5c16d10",
         "attestation_key_id": "skilld-production-2026-08"
       },
       "targets": [
@@ -40,8 +40,8 @@
       "skilld": {
         "source": {
           "type": "remote",
-          "source": "github:skilld-dev/skilld/skills/skilld#commit:fe3c82cf3dd5bea05036a747b1d9efa461f13c3b",
-          "commit_sha": "fe3c82cf3dd5bea05036a747b1d9efa461f13c3b",
+          "source": "github:skilld-dev/skilld/skills/skilld#commit:a71ea9c8eefdd6e2578f9e62989ccac03133bc68",
+          "commit_sha": "a71ea9c8eefdd6e2578f9e62989ccac03133bc68",
           "skill_path": "skills/skilld"
         },
         "targets": [

.skills/skilld.json

@@ -5,7 +5,7 @@
   "mode": "symlink",
   "skills": {
     "skilld": {
-      "source": "github:skilld-dev/skilld/skills/skilld#commit:fe3c82cf3dd5bea05036a747b1d9efa461f13c3b"
+      "source": "github:skilld-dev/skilld/skills/skilld#commit:a71ea9c8eefdd6e2578f9e62989ccac03133bc68"
     }
   }
 }

.skills/skilld/SKILL.md

@@ -111,6 +111,8 @@ An empty list proves nothing. Patterns miss obfuscated code.
 
 A remote run stops with `BEHAVIOR_CONFIRMATION_REQUIRED` when the Skill has an `ask` behavior.
 skilld loaded nothing. Show the user every behavior in `error.message`.
+A match can carry a model reading, such as `(model reading: quoted example. REASON)`.
+Show it as a language model's reading. It never replaces the user's approval.
 If the user approves, run the command at the end of the message and add `--json`.
 Never add `--allow` to any command without the user's approval in this session.
 If the user declines, stop and load nothing.
@@ -265,19 +267,28 @@ skilld install skilld --global
 Install every Skill a Repository, curator, or collection names:
 
 ```sh
-skilld add OWNER/REPOSITORY
-skilld add @LOGIN/SLUG --global
+skilld add OWNER/REPOSITORY --all
+skilld add @LOGIN/SLUG --all --global
 ```
 
 `skilld add` accepts `--global`, `--agent`, and `--mode` like `skilld install`.
 It prints one `Installed Skill` line per Skill.
-An Agent run installs every Skill the ref names. Pass `--all` to state that intent.
-A person at a terminal is asked which Skills to install.
-Run `skilld run` with the same ref first, then confirm the list with the user.
+If several Skills are listed, an Agent run requires `--all`.
+A normal terminal asks which Skills to install. `--plain` also requires `--all` for several Skills.
+One listed Skill installs without a picker. `add` does not support JSON output.
+Run `skilld run` with the same ref first, then confirm the list with the user before using `--all`.
 `skilld add` with one Skill selector installs that Skill like `skilld install`.
+Listing never requests registry indexing.
+Skills discovered through GitHub still use hosted delivery by default.
+If delivery fails, skilld shows an explicit direct installation command where possible.
+Only use direct installation when the user chooses it. Never use it to bypass a verification or policy failure.
+`skilld add OWNER/REPOSITORY --all --direct` lists and installs public GitHub files without skilld.dev.
+It records `unverified`. Curator and collection refs require hosted delivery.
+Behavior approval still applies.
+`skilld add ./PATH` installs one local Skill whose directory contains `SKILL.md`.
 
 Always use the source selector shown by `skilld search`.
-After installation, report the Skill name, scope, Agent targets, and source status.
+After installation, report the Skill name, scope, installed agent paths, and source status.
 
 ## Fork a Skill
 

package.json

@@ -50,8 +50,8 @@
     "db:migrations:prod": "wrangler d1 migrations apply DB --remote",
     "checkin": "nuxt-checkin prepare && nuxt-checkin",
     "demo:record": "tsx scripts/record-skill-demo.ts",
-    "sync:skills": "pnpm dlx skilld@3.6.0 sync --plain",
-    "check:skills": "pnpm dlx skilld@3.6.0 sync --check --plain"
+    "sync:skills": "pnpm dlx skilld@3.6.4 sync --plain",
+    "check:skills": "pnpm dlx skilld@3.6.4 sync --check --plain"
   },
   "dependencies": {
     "@comark/nuxt": "catalog:",