From 03e799bde1788aeb4a092b30c0751113d193621f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yuniel=20Acosta=20P=C3=A9rez?=
 <33158051+yacosta738@users.noreply.github.com>
Date: Mon, 6 Apr 2026 22:41:41 +0200
Subject: [PATCH] fix(install): cleanup download.tmp after extracting remote
 skill archives

Prevents leftover temporary download files from being included in
installed skill directories when fetching from remote URLs.
---
 src/skills/install.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/skills/install.rs b/src/skills/install.rs
index 4e4ecab2..7bedd883 100644
--- a/src/skills/install.rs
+++ b/src/skills/install.rs
@@ -279,6 +279,8 @@ pub async fn fetch_and_unpack_to_tempdir(url: &str) -> Result<TempDir, SkillInst
         tmpfile.flush().await.map_err(SkillInstallError::Io)?;
         // Re-open and read into memory for legacy unpacking logic where needed
         let data = std::fs::read(tmp.path().join("download.tmp")).map_err(SkillInstallError::Io)?;
+        // Cleanup download temp file to avoid including it in the skill
+        let _ = std::fs::remove_file(tmp.path().join("download.tmp"));
         (data, ext)
     };
     // Unpack archive type into the tempdir