when rosie installs a repo, it walks the extracted tree looking for SKILL.md files. three layers, checked in order:

• 1 root SKILL.md single-skill repos where the repo root is the skill
• 2 skills/ subdir conventional layout: skills/<name>/SKILL.md
• 3 recursive walk (fallback) only runs when layers 1 and 2 found nothing · descends into any non-hidden subdirectory · stops at the first SKILL.md on each branch · max depth 5

dot-directories are intentionally skipped — that includes consumer-side install destinations like .agents/skills/, .claude/skills/, .cursor/skills/, etc. Those are where rosie installs into, not where a package authors its own skills. A project that commits its installed third-party skills will not have them re-published when its own repo is installed as a package.