Acquire Codex skill packages from GitHub

feeds/skills/.system/files/skill-authoring/SKILL.md

@@ -3,7 +3,7 @@ name: skill-authoring
 description: "How to create, edit, and manage Netclaw skills. Read this when you need to synthesize a new skill from a session, understand the skill file format, or use the skill_manage tool."
 metadata:
   author: netclaw
-  version: "1.9.0"
+  version: "1.10.0"
 ---
 
 # Skill Authoring
@@ -254,3 +254,30 @@ All skills — regardless of origin — are visible in the skill index and
 available to all sessions. The skill index is a compressed file listing
 injected into the system prompt that points the agent directly at SKILL.md
 files on disk for retrieval-led reasoning.
+
+## GitHub Plugin Sources
+
+Netclaw accepts public `github.com` repositories that use the Codex plugin
+format. Private repositories need a later credential feature.
+
+The plugin root must contain `.codex-plugin/plugin.json`. Netclaw reads only
+these manifest fields:
+
+- `name` is required. It uses lowercase letters, numbers, and hyphens.
+- `version` is optional. A present value must use strict SemVer.
+- `skills` is optional. It must contain one relative directory path.
+
+Netclaw always checks `./skills/`. It also checks the `skills` directory from
+the manifest. Each selected skill is a direct child directory with an exact
+`SKILL.md` filename. Netclaw imports the selected skill files and their safe
+resources only.
+
+Netclaw ignores plugin components that can run code or add authority. These
+components include `agents`, `apps`, `commands`, `hooks`, `mcpServers`, and
+`scripts`. Netclaw reports a notice for each ignored component.
+
+Netclaw rejects the complete candidate when it finds an unsafe path, link in a
+selected skill, special file, invalid manifest, invalid skill, or scanner
+rejection. Netclaw keeps the prior accepted package. Netclaw records a rejected
+commit and skips it during normal sync. An explicit retry checks that commit
+again.

src/Netclaw.Configuration/NetclawPaths.cs

@@ -48,8 +48,11 @@ public sealed class NetclawPaths
     public string ManagedGitSkillDirectory(string sourceName)
         => Path.Combine(ManagedGitSkillsDirectory, sourceName);
 
-    public string ManagedGitSkillCommitDirectory(string sourceName, string commit)
-        => Path.Combine(ManagedGitSkillDirectory(sourceName), "commits", commit);
+    public string ManagedGitSkillCommitDirectory(
+        string sourceName,
+        string sourceFingerprint,
+        string commit)
+        => Path.Combine(ManagedGitSkillDirectory(sourceName), sourceFingerprint, "commits", commit);
 
     public string ServerFeedDirectory(string feedName)
         => Path.Combine(ServerFeedsDirectory, feedName);