fix(docs): fix incorrect documentation and clarify skill sync workflow

- Fix scripts/meta.ts: rename `sources` to `submodules` in Type 1 comment
- Fix scripts/meta.ts: clarify Type 3 skill copy destination in comment
- Fix docs/skills-generator.md: "two types" → "three types" (Type 1/2/3)
- Fix docs/skills-generator.md: Type 3 destination is plugins/{plugin}/skills/,
  not the intermediate skills/ directory
- Fix docs/skills-generator.md: update repo structure diagram comment for Type 3
- Fix docs/skills-generator.md: standardize sync command to `bun run skills:sync`
- Fix .claude/commands/generate-skill.md: clarify sync only handles Type 2/3,
  add manual cp step for Type 1 generated skills
- Add safety comment to exec()/execSafe() warning against user-provided input
- Add trailing newline to docs/STANDARDS.md

Author: amondnet

.claude/commands/generate-skill.md

@@ -16,13 +16,15 @@ Follow the guidelines in `docs/skills-generator.md` to generate Type 1 skills.
    - `SKILL.md` — index with frontmatter (`name`, `description`, `metadata`) and a table of all references
    - `GENERATION.md` — tracking metadata (source path, git SHA, generation date)
    - `references/*.md` — one file per concept (prefixed by category, e.g. `core-syntax.md`, `features-plugins.md`)
-5. **Run** the sync script to copy the generated skills into the plugin:
+5. **Copy** the generated skills into the plugin directory:
    ```bash
-   bun scripts/cli.ts sync
+   cp -r skills/$ARGUMENTS/ plugins/$ARGUMENTS/skills/$ARGUMENTS/
    ```
+   > Note: `bun run skills:sync` only handles Type 2 (vendor) and Type 3 (manual) skills.
+   > Type 1 (generated) skills must be copied manually to the plugin directory.
 6. **Commit** the generated skills:
    ```bash
-   git add skills/$ARGUMENTS/ plugins/$ARGUMENTS/skills/
+   git add skills/$ARGUMENTS/ plugins/$ARGUMENTS/skills/$ARGUMENTS/
    git commit -m "feat($ARGUMENTS): generate skills from official documentation"
    ```
 

docs/STANDARDS.md

@@ -99,4 +99,4 @@ Stop and revert immediately when you observe any of these signals:
 - Don’t introduce unjustified optimization or abstraction.
 - Don’t overuse broad exceptions.
 - Don’t refactor unrelated code — noisy diffs make reviews harder.
-- Don’t make silent assumptions — state them explicitly or ask.
+- Don’t make silent assumptions — state them explicitly or ask.

docs/skills-generator.md

@@ -11,7 +11,7 @@ PLEASE STRICTLY FOLLOW THE BEST PRACTICES FOR SKILL: https://platform.claude.com
 
 ## Skill Source Types
 
-There are two types of skill sources. The project lists are defined in `scripts/meta.ts`:
+There are three types of skill sources. The project lists are defined in `scripts/meta.ts`:
 
 ### Type 1: Generated Skills (`sources/`)
 
@@ -35,7 +35,7 @@ For projects that **already maintain their own skills**. We clone their repo as
 
 Skills sourced from `vendor/antfu-skills/skills/` — written by Anthony Fu with his preferences, experience, tastes and best practices.
 
-These are **read-only**. Do not modify them here; contribute changes upstream to [antfu/skills](https://github.com/antfu/skills). They are automatically copied to `skills/` by the sync script.
+These are **read-only**. Do not modify them here; contribute changes upstream to [antfu/skills](https://github.com/antfu/skills). They are automatically copied directly to `plugins/{plugin}/skills/` by the sync script (not via the intermediate `skills/` directory).
 
 ## Repository Structure
 
@@ -67,7 +67,7 @@ These are **read-only**. Do not modify them here; contribute changes upstream to
 │
 └── plugins/                        # Plugin directories
     └── {plugin}/
-        └── skills/                 # Synced from skills/ by cli.ts sync
+        └── skills/                 # Synced directly from vendor/ by cli.ts sync
             └── {skill-name}/
 ```
 
@@ -144,7 +144,8 @@ These are **read-only**. Do not modify them here; contribute changes upstream to
 After generating or updating skills, sync them to the plugin directories:
 
 ```bash
-bun scripts/cli.ts sync
+bun run skills:sync
+# or directly: bun scripts/cli.ts sync
 ```
 
 This copies `skills/` → `plugins/*/skills/` according to the mapping in `scripts/meta.ts`.

scripts/cli.ts

@@ -46,6 +46,8 @@ const SKILL_TO_PLUGIN: Record<string, string> = {
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
+// NOTE: exec/execSafe use shell execution. Do NOT call with user-provided or
+// external input — use execFile/execFileSafe instead (they bypass the shell).
 function exec(cmd: string, cwd = ROOT): string {
   return execSync(cmd, { cwd, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim()
 }

scripts/meta.ts

@@ -3,7 +3,7 @@
  * Mirrors the structure of vendor/antfu-skills/meta.ts but managed in this repo.
  *
  * To add a new source (Type 1):
- *   1. Add an entry to `sources` below
+ *   1. Add an entry to `submodules` below
  *   2. Run: bun scripts/cli.ts init
  *   3. Generate skills: /generate-skill <name>
  *   4. Add skill → plugin mapping to SKILL_TO_PLUGIN in scripts/cli.ts
@@ -87,6 +87,6 @@ export const vendors: Record<string, VendorMeta> = {
 
 /**
  * Type 3: Hand-written skills by Anthony Fu.
- * These live in vendor/antfu-skills/skills/ and are read directly.
+ * These live in vendor/antfu-skills/skills/ and are copied directly to plugins/{plugin}/skills/ by the sync script.
  */
 export const manual: string[] = ["antfu"]