Duplicate skill discovery when repos include examples or mirrored SKILL.md files

Hi — quick repro from trying to install a real multi-surface skills repo.

openskills install appears to recursively discover every SKILL.md in the repository and then install by skill name, so repos that include canonical skills plus examples / mirrored well-known artifacts can report duplicates and overwrite the same target multiple times.

Repro:

tmp=$(mktemp -d)
cd "$tmp"
npx --yes openskills@latest install caioribeiroclw-pixel/pluribus --universal --yes

Observed output excerpt:

Found 6 skill(s)

✅ Installed: context-receipts
✅ Installed: skill-policy-receipts
Overwriting: context-receipts
✅ Installed: context-receipts
Overwriting: skill-policy-receipts
✅ Installed: skill-policy-receipts
Overwriting: context-receipts
✅ Installed: context-receipts
Overwriting: skill-policy-receipts
✅ Installed: skill-policy-receipts

✅ Installation complete: 6 skill(s) installed

Final filesystem only contains the two expected skills:

.agent/skills/context-receipts/SKILL.md
.agent/skills/skill-policy-receipts/SKILL.md

Why this matters: as skills repos add examples/, docs mirrors, marketplace submissions, or .well-known/agent-skills artifacts, recursive discovery can make the audit/install output look noisy even when the end state is safe. It is also hard for a user to know which duplicate source path won.

Potential fixes / options:

• de-dupe by name and warn with the list of source paths;
• prefer top-level skills/<name>/SKILL.md when duplicate names exist;
• add/recognize an ignore file for examples/docs/well-known mirrors;
• expose the selected source path in the install audit / .openskills.json;
• related to #53: --skills=name1,name2 helps selection, but it would not fully clarify duplicate source precedence.

This is not urgent, but it is a useful package-manager edge case for security/review UX: install logs should say exactly which skill artifact crossed into the target agent directory.