Move import-skill from plugin to project-level command

The import-skill command doesn't belong in the marketplace — it's a
repo maintenance tool. Move it to .claude/commands/ so it's available
to anyone cloning the repo as /import-skill, no plugin install needed.

- Move command to .claude/commands/import-skill.md
- Move fetch script to scripts/fetch_github_tree.py
- Remove plugin from marketplace.json and README
- Unignore .claude/commands/ in .gitignore

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.claude-plugin/marketplace.json

@@ -220,17 +220,6 @@
         "url": "https://github.com/openai/skills"
       },
       "source": "./plugins/openai-yeet"
-    },
-    {
-      "name": "trailofbits-skill-importer",
-      "version": "1.0.0",
-      "description": "Import skills from GitHub into the curated marketplace. Downloads, transforms to plugin standards, validates, and creates a PR.",
-      "author": {
-        "name": "Trail of Bits",
-        "email": "opensource@trailofbits.com",
-        "url": "https://github.com/trailofbits"
-      },
-      "source": "./plugins/trailofbits-skill-importer"
     }
   ]
 }

.gitignore

@@ -28,6 +28,7 @@ build/
 
 # Local plugin cache
 .claude/
+!.claude/commands/
 
 # MCP server config (contains API keys)
 .mcp.json

README.md

@@ -23,7 +23,6 @@ Everything here has been code-reviewed by Trail of Bits staff. We're sharing it
 |--------|-------------|
 | [planning-with-files](plugins/planning-with-files/) | File-based planning with persistent markdown for complex multi-step tasks |
 | [skill-extractor](plugins/skill-extractor/) | Extract reusable skills from work sessions |
-| [trailofbits-skill-importer](plugins/trailofbits-skill-importer/) | Import skills from GitHub into the curated marketplace |
 
 ### Security
 

plugins/trailofbits-skill-importer/.claude-plugin/plugin.json

@@ -1,10 +0,0 @@
-{
-  "name": "trailofbits-skill-importer",
-  "version": "1.0.0",
-  "description": "Import skills from GitHub into the curated marketplace. Downloads, transforms to plugin standards, validates, and creates a PR.",
-  "author": {
-    "name": "Trail of Bits",
-    "email": "opensource@trailofbits.com",
-    "url": "https://github.com/trailofbits"
-  }
-}

plugins/trailofbits-skill-importer/README.md

@@ -1,45 +0,0 @@
-# Skill Importer
-
-Import skills from GitHub into the curated marketplace. Downloads source files, transforms them to meet plugin standards, validates the result, and creates a PR.
-
-## Installation
-
-```
-/plugin install trailofbits-skill-importer
-```
-
-## Usage
-
-```
-/trailofbits-skill-importer:import-skill https://github.com/mitsuhiko/agent-stuff/tree/main/skills/ghidra
-```
-
-Accepts GitHub URLs in several formats:
-
-- `https://github.com/{owner}/{repo}/tree/{branch}/{path}`
-- `https://github.com/{owner}/{repo}/blob/{branch}/{file}` (uses parent dir)
-- `github.com/owner/repo/tree/branch/path` (no protocol)
-- `owner/repo` (root path, default branch)
-
-## What It Does
-
-1. Fetches the skill source tree from GitHub
-2. Reads and understands the skill content
-3. Asks you to confirm the plugin name
-4. Transforms paths, platform references, and frontmatter
-5. Adds missing required sections ("When to Use", "When NOT to Use")
-6. Generates `plugin.json`, `README.md`, and directory structure
-7. Lints scripts and validates structure
-8. Registers in `marketplace.json` and root `README.md`
-9. Creates a branch, commits, and opens a PR
-
-## Prerequisites
-
-- `gh` CLI installed and authenticated (`gh auth login`)
-- `uv` for running the fetch script
-- `ruff` for Python linting (optional, for script cleanup)
-- `shellcheck` and `shfmt` for shell linting (optional)
-
-## Credits
-
-Built for the Trail of Bits [curated skills marketplace](https://github.com/trailofbits/skills-curated).