[Feature]: Project-local skills are written to skills-lock.json, but check / update do not operate on them

[polybean]

Problem

There seems to be a gap in the current project-local skills workflow.

Summary

npx skills add supports project-local installation and writes a project-scoped skills-lock.json, but npx skills
check and npx skills update do not appear to consume that lock file.

As a result, project-local skills can be:

• installed
• listed
• restored

but not actually checked/updated through the normal check / update flow.

Expected behavior

If a skill is installed project-locally and recorded in skills-lock.json, I expect one of these behaviors:

• npx skills check checks project-local tracked skills
• npx skills update updates project-local tracked skills
• or there is an explicit project-scoped variant for check/update

Actual behavior

In my project:

• npx skills ls --json correctly lists project-local skills
• skills-lock.json contains the installed project-local skills
• but npx skills check does not seem to use that file
• and npx skills update does not update those project-local skills

In practice, I can see project-local skills installed under .agents/skills/, and they are recorded in skills-
lock.json, but check / update still behave as if only the global lock state matters.

Reproduction

1. Install one or more skills as project-local:

   npx skills add vercel-labs/agent-browser

2. Confirm they are listed as project skills:

   npx skills ls --json

3. Confirm they are recorded in:

   skills-lock.json

4. Run:

   npx skills check
   npx skills update

Why this seems inconsistent

The project-local install flow already creates a version-controlled lock file (skills-lock.json), which strongly
suggests project-local tracking is a first-class concept.

But without project-local support in check / update, the workflow feels incomplete:

• install works
• listing works
• lockfile exists
• update path is missing

Proposed Solution

Please support project-local skills in the update flow.

Possible options:

• make check / update read both global and project-local lock state
• add --project variants
• or automatically use skills-lock.json when running inside a project that has one

Alternatives Considered

No response

Additional Context

No response

[elliotllliu]

This looks like the same issue as #522 — my PR #642 already adds local skill support to check and update. It handles both relative-path and absolute-path local sources.

Would appreciate a review to see if it covers your use case! 🙏

[quuu]

This is addressed in #913, shipping in npx skills@1.5.0.

skills update now supports project-scoped skills. When you run it interactively, you'll get a scope prompt:

◆  Update scope
│  ● Project (Update skills in current directory)
│  ○ Global
│  ○ Both
└

You can also use flags to skip the prompt:

• npx skills update -p — update project skills only
• npx skills update -g — update global skills only
• npx skills update -y — auto-detect scope (project if skills-lock.json or .agents/skills/ exists in cwd, otherwise global)

For project skills, update re-clones from the source recorded in skills-lock.json. Skills sourced from node_modules or local paths are skipped (those are managed by skills experimental_sync).