Introduction¶

There are many sources of Skills in DSH: project directories, user directories, Agent scopes, or remote or memory Providers. The model automatically picks Skills, and users can also directly invoke them using /name. By default, these two paths follow the Skill’s own declaration, and it is not easy to turn off just one of them separately. dsh-skills-management is a plugin designed for this gap: it centrally displays the Skill directory, separately controls “model invocation” and “user manual invocation” for file-based Skills, and reads the latest source files during invocation without needing to modify SKILL.md or copy any resources. Below is an introduction to the plugin’s positioning, installation method, and typical usage.

What is this¶

dsh-skills-management is a DSH Skill directory and invocation strategy plugin, maintained by JayC-L, and categorized under workflows. It does not modify Skill definition files but only maintains a set of invocation strategies to answer “which Skills can be invoked by the model and which can still be invoked by users using /name”.

Core Features¶

1. Dual-channel switches. Each file-based Skill has two independent switches: model invocation (modelInvocable) and user manual invocation (userInvocable, i.e., /name). The four combinations correspond to four states:

Strategies take effect globally based on the Skill name and manage Skills with the same name together. When restoring the original invocation default values, the strategy record is removed, but the default values themselves do not necessarily have both channels enabled.

2. Real-time source file reading. Frontmatter is refreshed when the directory is recalculated, and the current body is read on every get(). Therefore, after the Skill body is updated, there is no need to switch strategies again. References, scripts, and other resources remain in the source Skill directory and are not copied into strategy data. The strategy only saves invocation status and file location metadata, not the body.

3. Full directory and read-only boundaries. Entries for memory, remote, and dynamic Providers are still visible but marked as Read only; the Host will reject strategy modifications targeting them. Non-file Providers continue to provide their own directories and contents; the plugin does not take over, copy, or infer local paths from the source tag. Bundled Provider assets are read-only even if a SKILL.md file exists.

4. Missing entry cleanup. A Skill is only marked as missing when the complete directory or verifiable file evidence confirms that the original definition has disappeared. At this time, a native Delete button appears on the corresponding row, which only deletes the strategy record and never deletes the source file or Junction. If the original Skill is restored, the request returns 409 and the strategy is retained.

5. Single global view. The directory aggregates DSH Registry, the file system, and Agent scopes, without independent strategy controls per session.

Installation and Activation¶

Add this repository in the DSH plugin manager or use the pre-built release package:

https://github.com/JayC-L/dsh-skills-management/releases/latest/download/dsh-skills-management.tgz

Use the built-in plugin manager in DSH Desktop. After installation and activation, refresh the page and open Skills Management in the sidebar.

The plugin has version requirements for DSH: >=0.2.1-rc.5 <0.3.0-0. The project has been verified under DSH 0.2.2-rc.1, Cordis 4.1.0, and Desktop Profile.

If you need to build from source:

pnpm install
pnpm run check
pnpm test
pnpm pack

Scope of Management¶

A Skill can only be managed when the following four hard conditions are met:

1. Already registered in the current DSH Registry.
2. Comes from a project, user, or explicitly configured custom file directory.
3. Has a verifiable local file path.
4. The frontmatter is valid, and the declared name matches the Skill name.

Regular directories, flat Markdown files, and Junctions are all supported. Files found only on the disk but not registered to DSH do not count as manageable invocation targets.

Directory and Refresh¶

Each line displays the Skill name and current description, Provider name, source form (local file, Junction, source file, expired path, registered only, bundled assets, non-file or missing), current invocation status, as well as the two switches, Read only mark, or Delete button.

The management directory is re-requested at the following times:

• Page component mount;
• Successful switch or delete operation;
• Clicking Refresh.

Refresh re-reads the strategy, scans explicitly configured Skill directories, and aggregates Registry and various scopes. You can search by name or description and combine invocation status and source filters; built-in groups are collapsed by default and expand automatically when searching or filtering.

Strategy File¶

Default location:

~/.dsh/skills-management/disabled.json

Each record contains only invocation strategy and file location metadata, with the following fields:

sourcePath and sourceBase are internal Host fields and are not returned through the management list API. Writing uses a serial queue, strictly re-reads the disk before changes, uses temporary files in the same directory, fsync, and atomic replacement; when the strategy file is corrupted, it may temporarily use the last valid in-memory state for reading, but all writes will be rejected to avoid in-memory data overwriting a bad file.

Security Boundaries¶

• Low-priority strategy Providers only override invocation flags and real-time file definitions for file-based Skills; the original Provider is automatically restored after the strategy is removed.
• File-based directories read the current frontmatter; invocations read the current body and verify the declared Skill name.
• File missing, identity conflicts, duplicate candidates, and I/O errors will not be silently replaced with other content.
• Management endpoints only accept loopback requests and verify Host, Origin, Method, and Change headers.
• The plugin does not modify Skill source files, does not scan irrelevant application directories, does not collect telemetry, and does not initiate external network requests.

The management endpoint is:

GET  /api/dsh-skills-management/list

Applicable Scenarios and Notes¶

Suitable for DSH developers who need fine-grained control over Skill invocation scope: for example, not wanting the model to automatically trigger a certain high-risk Skill but still keeping the /name manual entry; or conversely, only allowing users to invoke by name. The plugin is categorized under workflows, has 1 star, and is an early project. It is recommended to read the GitHub source code and MIT license before use and confirm that the current DSH version is within the compatibility range.

Note that the plugin runs with the permissions of the current DSH process and will read and write strategy files under ~/.dsh/skills-management/; it will not modify Skill source files or the Git workspace, but you should still check the source code and license yourself before installation.

Summary¶

The value of dsh-skills-management lies in breaking down “who can invoke a Skill” into two independent switches for the model and user, and maintaining the latest status of the directory and body without modifying source files. Directory page: https://www.skillhub.cn/plugins/JayC-L/dsh-skills-management ; Repository: https://github.com/JayC-L/dsh-skills-management .