[Bug] Bulk `sk update` reports Updated:0 with ghost entries while individual `sk update <name>` works

[jeanpfs]

Summary

skillkit update (without arguments) consistently reports Updated: 0, Skipped: N, Failed: 0 for all skills, with messages like no SKILL.md in source (for managed skills) or no metadata, reinstall needed (for skills that no longer exist on disk).

However, running skillkit update <skill-name> on the same skills works perfectly and reports no changes detected.

Environment

• skillkit: 1.24.0
• Node: v24.14.0
• macOS: 26.5
• Shell: fish

Reproduction

Setup: ~94 skills installed via skillkit install <owner/repo> --all --global --force, all with .skillkit.json metadata in ~/.claude/skills/<name>/.

# 1. Bulk update — all fail
$ skillkit update
Skipping xlsx (no SKILL.md in source)
Skipping canvas-design (no SKILL.md in source)
# ... 78 similar lines
Updated: 0, Skipped: 110, Failed: 0

# 2. Same skills, individually — all succeed
$ skillkit update xlsx
xlsx: no changes detected
Updated: 0, Skipped: 1, Failed: 0

$ skillkit update canvas-design
canvas-design: no changes detected
Updated: 0, Skipped: 1, Failed: 0

# 3. Loop confirms: 78/78 OK individually
$ for d in ~/.claude/skills/*/; do
    name=$(basename "$d")
    [ -f "$d/.skillkit.json" ] && skillkit update "$name" 2>&1 | grep "no changes"
  done
# 78 lines of "no changes detected"

Additional symptom: ghost entries

The bulk run also iterates over 110 skills when only ~94 exist on disk. The extras include names like imagegen, openai-docs, PowerPoint, Excel, plugin-creator, skill-installer — none of which exist anywhere under ~/.claude/skills/, ~/.agents/skills/, the project's .claude/skills/, the npx-skills lock (~/.agents/.skill-lock.json), or the skillkit lock (~/.skillkit/lock.json).

Things tried that did not clear the ghost list:

• mv ~/.skillkit/marketplace/ <trash> (marketplace cache)
• Removing ghost entries from ~/.agents/.skill-lock.json
• Fixing wrong paths in ~/.skillkit/lock.json
• Removing stale project-local .claude/skills/

The ghost entries appear to come from some runtime/in-memory source I couldn't trace via grep -r.

Expected behavior

skillkit update should iterate only over skills with .skillkit.json metadata on disk and produce the same per-skill outcome as skillkit update <name>.

Workaround

Manual loop with individual updates works fine:

for d in ~/.claude/skills/*/; do
  name=$(basename "$d")
  [ -f "$d/.skillkit.json" ] && skillkit update "$name"
done

Happy to provide more debug info (lock files, env, etc.) if useful.