feat: add --path flag for subfolder filtering

[shsteimer]

Summary

• Adds -p, --path <subfolder> option to restrict skill discovery to a specific subdirectory within the cloned repo
• Enables parity with the Vercel Skills CLI's tree-URL syntax (npx skills add https://github.com/owner/repo/tree/main/path)
• Validates the path exists after clone, with a clear error if not

This allows the adobe/skills README to document equivalent commands for both tools:

# Vercel Skills CLI
npx skills add https://github.com/adobe/skills/tree/main/skills/aem/edge-delivery-services --all

# upskill (new)
upskill adobe/skills --path skills/aem/edge-delivery-services --all

Test plan

• upskill adobe/skills --path skills/aem/edge-delivery-services --list shows only EDS skills
• upskill adobe/skills --path skills/aem/edge-delivery-services --all installs only EDS skills
• upskill adobe/skills --path nonexistent/path --all fails with clear error
• Existing behavior without --path is unchanged
• CI passes (make test includes new --path tests)

🤖 Generated with Claude Code

---

Summary by cubic

Adds a -p/--path flag to filter skill discovery to a subfolder in the cloned repo. Validates the path after clone, prevents path traversal, and matches the Vercel Skills CLI tree-URL behavior.

• New Features
  • Restricts scanning, listing, and installs to the given subfolder; fails fast with a clear “Path not found” error.
  • Updated README with usage examples and added tests for valid/invalid paths.

^{Written for commit fbf5452. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="upskill">

<violation number="1" location="upskill:375">
P2: User-provided `--path` is concatenated without validation, allowing `../` to escape the cloned repo and scan/copy SKILL.md files outside the repository.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}