chore(skills): use shared skills package (MetaMask#8965)

## Summary

- Add `yarn skills` integration for Core, mirroring Mobile/Extension
behavior.
- Delegate skills sync/setup to the shared `@metamask/skills` CLI
instead of keeping Core-local sync scripts.
- Ignore generated skill outputs and document Core skill usage.

## Related

- ADR 57: MetaMask/decisions#162
- Shared package PR: MetaMask/skills#24

## Validation

Validated against the published `@metamask/skills` npm package
(`^0.1.0`):

- `node --check bin/metamask-skills.mjs`
- `npm pack --pack-destination /tmp`
- packed CLI `sync --target /Users/deeeed/dev/metamask/core-4 --dry-run`
- packed CLI `postinstall --target /Users/deeeed/dev/metamask/core-4
--dry-run` with `SKILLS_AUTO_UPDATE=1`
- packed CLI target override with `METAMASK_SKILLS_TARGET_REPO=core`

The lockfile has been refreshed against the published package, so
dependency install / immutable install checks now pass.

## **How to use**

Run manual sync:

```bash
yarn skills
```

To opt into best-effort regeneration during setup/install, add this to
`.skills.local` or your shell:

```bash
SKILLS_AUTO_UPDATE=1
```

Optional filters work through the shared installer:

```bash
SKILLS_DOMAINS=testing,coding
SKILLS_INCLUDE=agentic/recipe-harness
```

Use `METAMASK_SKILLS_TARGET_REPO` locally for forks or unusual remotes
that should use the canonical `core` overlays.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Developer-only tooling and install hooks; no runtime library or
controller code changes.
> 
> **Overview**
> Wires Core into the shared **`@metamask/skills`** CLI so agent skills
sync matches Mobile/Extension instead of repo-local scripts.
> 
> **`package.json`** adds **`yarn skills`** (`metamask-skills sync`),
**`skills:postinstall`**, and a root **`postinstall`** hook (optional
refresh when **`SKILLS_AUTO_UPDATE=1`**). **`@metamask/skills@^0.1.0`**
is a devDependency with an updated **`yarn.lock`**. LavaMoat
**`allowScripts`** now allows **`$root$`** so install can run the skills
postinstall.
> 
> **`.gitignore`** excludes **`.skills.local`**, **`.skills-cache/`**,
and generated outputs under **`.claude/skills/`**,
**`.agents/skills/`**, and **`.cursor/rules/`**.
**`.skills.local.example`** documents domain filters and env overrides;
**README** adds an **Agent skills** section with usage commands.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
08001cc. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: abretonc7s

.gitignore

@@ -39,6 +39,18 @@ packages/*/*.tsbuildinfo
 # AI
 .sisyphus/
 
+# Agent skills
+# Copy `.skills.local.example` to `.skills.local` and edit `SKILLS_DOMAINS=`.
+.skills.local
+
+# Public MetaMask/skills cache maintained by `yarn skills` / `yarn setup`.
+.skills-cache/
+
+# Generated by MetaMask/skills tools/install. Run `yarn skills` to refresh.
+.claude/skills/
+.agents/skills/
+.cursor/rules/
+
 # Docusaurus
 **/.docusaurus
 packages/wallet-framework-docs/site/build

.skills.local.example

@@ -0,0 +1,34 @@
+# Template for per-engineer skills config used by `yarn skills`.
+# Copy this file to `.skills.local` (gitignored).
+#
+# Zero-config default: the shared @metamask/skills CLI refreshes
+# `.skills-cache/metamask-skills` during setup. `yarn skills` auto-detects that
+# cache when no env var is set, and falls back to the bundled package snapshot
+# if the cache is unavailable — nothing to do.
+#
+# Optional persistent skills config belongs in this file. Environment variables
+# with the same names are only for one-off shell or CI overrides and take
+# precedence over this file.
+#   METAMASK_SKILLS_DIR          path to MetaMask/skills source checkout (optional override)
+#   CONSENSYS_SKILLS_DIR         path to Consensys/skills checkout (private overlay)
+#   METAMASK_SKILLS_TARGET_REPO  canonical repo overlay for forks/unusual remotes
+#
+# Example local setup (only if you want to override the cache):
+#   METAMASK_SKILLS_DIR=~/dev/metamask/skills
+#   CONSENSYS_SKILLS_DIR=~/dev/Consensys/skills   # optional
+#   METAMASK_SKILLS_TARGET_REPO=metamask-mobile   # optional fork override
+#
+# Default behavior installs ALL stable domains available for Core. Set
+# SKILLS_DOMAINS to opt out of some:
+#   SKILLS_DOMAINS=                          # all (default)
+#   SKILLS_DOMAINS=perps                     # single domain
+#   SKILLS_DOMAINS=perps,coding,pr-workflow  # multiple domains
+#
+# Optional: regenerate gitignored installed skills during yarn install/setup after
+# the public cache refreshes. Off by default for backward compatibility.
+#   SKILLS_AUTO_UPDATE=1              # also accepts true/yes
+#
+# Override per-run with `SKILLS_DOMAINS=... yarn skills` or `--domain <list>`.
+# Pick interactively with `yarn skills --select`.
+# Use `yarn skills --reset` to wipe.
+SKILLS_DOMAINS=

README.md

@@ -16,6 +16,26 @@ See the [Contributor Documentation](./docs) for help on:
 
 Each package in this repository has its own README where you can find installation and usage instructions. See `packages/` for more.
 
+## Agent skills
+
+This repo can install MetaMask agent skills for Claude, Cursor, and Codex/OpenAI.
+`yarn setup` keeps the public [`MetaMask/skills`](https://github.com/MetaMask/skills)
+cache available through the shared `@metamask/skills` CLI. Run `yarn skills` any
+time to install or refresh the gitignored generated skills under `.claude/skills/`,
+`.cursor/rules/`, and `.agents/skills/`.
+
+By default, all stable skills that support Core are installed when you run `yarn skills`.
+Set `SKILLS_AUTO_UPDATE=1` to opt into best-effort regeneration during setup. The shared package keeps sync/cache behavior uniform with Mobile and Extension.
+To persist a local selection, copy `.skills.local.example` to `.skills.local` and
+set values such as `SKILLS_DOMAINS=perps`.
+
+```bash
+yarn skills                         # refresh default stable Core skills
+yarn skills --domain perps          # install only the perps domain
+yarn skills --select                # interactively choose domains
+yarn skills --reset                 # clear saved local selection
+```
+
 ## Packages
 
 <!-- start package list -->

package.json

@@ -42,7 +42,10 @@
     "test:packages": "yarn test:verbose --silent --collectCoverage=false --reporters=jest-silent-reporter",
     "test:scripts": "NODE_OPTIONS=--experimental-vm-modules yarn jest --config ./jest.config.scripts.js --silent",
     "test:verbose": "yarn workspaces foreach --all --parallel --verbose run test:verbose",
-    "workspaces:list-versions": "./scripts/list-workspace-versions.sh"
+    "workspaces:list-versions": "./scripts/list-workspace-versions.sh",
+    "skills": "metamask-skills sync",
+    "skills:postinstall": "metamask-skills postinstall",
+    "postinstall": "yarn skills:postinstall"
   },
   "devDependencies": {
     "@lavamoat/allow-scripts": "^3.0.4",
@@ -56,6 +59,7 @@
     "@metamask/eth-json-rpc-provider": "^6.0.1",
     "@metamask/json-rpc-engine": "^10.5.0",
     "@metamask/network-controller": "^32.0.0",
+    "@metamask/skills": "^0.1.0",
     "@metamask/utils": "^11.9.0",
     "@ts-bridge/cli": "^0.6.4",
     "@types/jest": "^29.5.14",
@@ -108,12 +112,13 @@
   "packageManager": "yarn@4.16.0",
   "lavamoat": {
     "allowScripts": {
-      "@lavamoat/preinstall-always-fail": false,
+      "$root$": true,
       "@keystonehq/bc-ur-registry-eth>hdkey>secp256k1": true,
+      "@lavamoat/preinstall-always-fail": false,
       "babel-runtime>core-js": false,
+      "eslint-plugin-import-x>unrs-resolver": false,
       "simple-git-hooks": false,
-      "tsx>esbuild": false,
-      "eslint-plugin-import-x>unrs-resolver": false
+      "tsx>esbuild": false
     }
   }
 }

yarn.lock

@@ -6283,6 +6283,7 @@ __metadata:
     "@metamask/eth-json-rpc-provider": "npm:^6.0.1"
     "@metamask/json-rpc-engine": "npm:^10.5.0"
     "@metamask/network-controller": "npm:^32.0.0"
+    "@metamask/skills": "npm:^0.1.0"
     "@metamask/utils": "npm:^11.9.0"
     "@ts-bridge/cli": "npm:^0.6.4"
     "@types/jest": "npm:^29.5.14"
@@ -8324,6 +8325,15 @@ __metadata:
   languageName: unknown
   linkType: soft
 
+"@metamask/skills@npm:^0.1.0":
+  version: 0.1.0
+  resolution: "@metamask/skills@npm:0.1.0"
+  bin:
+    metamask-skills: bin/metamask-skills.mjs
+  checksum: 10/e8c0fc1387c3d3706d0f2a49ef61ecba2a320e68c0bc00eb40077defc9fbf407c8830b20f10e31acc1481c6a2d7541c7f1c5294b62b0d3e6d0df3d6cfd533ce9
+  languageName: node
+  linkType: hard
+
 "@metamask/slip44@npm:^4.3.0, @metamask/slip44@npm:^4.4.0":
   version: 4.4.0
   resolution: "@metamask/slip44@npm:4.4.0"