refactor(cli): consolidate skill architecture v0.2.0

[originalix]

Summary

• Consolidate 4 CLI skill files by removing perps support, deduplicating cross-domain fallback rules, and trimming repeated Fast Patterns
• Rewrite Universal Fallback in common.md as structured Cross-Domain Fallback section that absorbs rules previously scattered across all 4 skills
• Align all version numbers (marketplace, plugin, skills) to 0.2.0; exclude skills from npm package (distributed via marketplace git-subdir)

Intent & Context

The 4 CLI skills (market, security, swap, wallet) had grown organically through eval iterations, resulting in ~50% of each skill being instructions about OTHER skills' domains. The same Fast Patterns (address poisoning, insufficient balance, research-to-trade) appeared verbatim in 3-4 files. Perps/Hyperliquid rules were spread across all skills despite the CLI having no perps capability. This made behavioral changes require syncing across 5 files.

Design Decisions

• Remove perps entirely rather than keeping stubs — CLI has no perps commands, so detailed routing rules were pure noise. Replaced with a single "not supported" fallback line.
• Consolidate into common.md rather than creating a new shared file — investigated using ../_shared/ relative paths or git symlinks, but research confirmed the official Claude Code plugin pattern is self-contained skills with per-skill references/ copies. The sync-refs.sh + prebuild approach is the sanctioned pattern used by all official multi-skill plugins (superpowers, plugin-dev).
• Keep skills/ in git but remove from npm files — marketplace uses git-subdir source, so skills must be in the repo. npm package only needs dist/ and bin/.

Changes Detail

• _shared/common.md: Remove perps rules, rewrite Universal Fallback → Cross-Domain Fallback with consolidated trade handoff, compound intent, and research-to-trade rules
• market/SKILL.md: 63→36 lines. Keep only price/trending/research domain rules and core patterns
• security/SKILL.md: 55→29 lines. Keep only audit/simulate domain rules and core patterns
• swap/SKILL.md: 66→36 lines. Keep only swap/bridge/buy/sell domain rules and core patterns
• wallet/SKILL.md: 65→40 lines. Keep only balance/transfer/import domain rules and core patterns
• marketplace.json + plugin.json: Version 0.1.0 → 0.2.0
• package.json: Remove skills/ from npm files array

Risk Assessment

• Risk Level: Medium
• Affected Platforms: CLI skills only (no runtime code changes)
• Risk Areas: Behavioral regression in cross-domain fallback handling — rules moved from individual skills to common.md may not trigger identically. Requires benchmark validation.

Test plan

• Run full skill benchmark suite across all 4 skills to verify no regression
• Verify perps requests get clean "not supported" response
• Verify cross-domain flows (e.g., market research → buy handoff) still preserve chain/balance context
• Verify npm pack in apps/cli excludes skills directory

---

[revan-zhang]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[originalix]

Summary

#	Skill	Category	Version	Safety Gate	Score	Report
1	wallet	unknown	0.2.0	✅ PASS	80/100	detail
2	security	unknown	0.2.0	✅ PASS	80/100	detail
3	market	unknown	0.2.0	✅ PASS	77/100	detail
4	swap	unknown	0.2.0	✅ PASS	77/100	detail

Dimension Scores

Skill	Safety	Coverage	Robustness	Routing	UX
wallet	85	73	85	73	77
security	84	73	87	76	73
market	85	69	82	73	68
swap	81	70	85	74	68

Stats

Metric	Value
Total Skills	4
Completed	4
Errors	0

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tailwindcss@​3.4.18
	ws@​8.18.3

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[sidmorizon]

skill 统一用 onekey-cli- 开头吧，这样非 claude 可以安装，防止和其他用户自有 skill 命名冲突

[originalix]

好，拆完仓库后加一下前缀，这个 PR 就不合并了

[sidmorizon]

skill 仓库和主仓库放在一起，如果用 plugin 方式安装，会把整个主仓库 pull 下来吗

[originalix]

确实有这个问题，虽然用 git-subdir 指定了路径，但是会先 clone

拆到独立的仓库里吧