feat(skills): install skills from HTTP(S) URL + /reload-skills slash command (Hermes v0.12 parity)

[subinium]

Background

Hermes v0.12 (#16323, #17744) — hermes skills install <url> pulls a skill straight from any HTTP(S) URL; /reload-skills slash command
re-reads the skill directory without restarting the agent.

Current state in CrowClaw

• packages/cli/src/index.ts skill install path is unclear / partial; no direct URL install.
• No /reload-skills slash command — adding a skill requires restart.

Scope

• Modified: packages/cli/src/index.ts — crowclaw skills install <urlOrPath>
• Modified: packages/core/src/index.ts — slash-command handler for /reload-skills
• Tests: tests/skills-install-url.test.ts, tests/skills-reload.test.ts

Implementation sketch

1. URL install: fetch (using web.fetch infra + SSRF helpers), validate manifest sha256 (v0.8.2 feat(security): add sha256 content-hash to SkillManifest with verify on load (NemoClaw parity) #271 parity), unpack to ~/.crowclaw/skills/<name>/
2. /reload-skills rebuilds the in-memory skill index and emits skills:reloaded event
3. Failed install: report INSTALL_FAILED with cause (network / sha256 / validation)
4. Curator-protected skills (sibling Curator issue) cannot be overwritten by install

Acceptance criteria

• crowclaw skills install https://example.com/my-skill.zip works
• sha256 mismatch rejects the install
• /reload-skills picks up a manually-added skill without restart
• Bundled skills never overwritten by install

Effort

S — install path + slash command + sha256 validation (already exists from v0.8.2 #271).

Effect

Lower friction for skill sharing. Combined with the curator (sibling), the skill ecosystem becomes self-managing.

Source

Hermes #16323, #17744 · CrowClaw current: packages/cli/src/index.ts, packages/skills/