What

Lets a harness mount skills from the Volcengine skill hub, alongside the
existing model/tools customization.

Changes

veadk/cloud/harness_app.py

• Harness gains a skills field. Both tools and skills are now
  comma-separated strings split server-side (_split_csv), so CLI/curl just
  pass strings (e.g. "web_search,link_reader").
• _download_and_extract_skill: GET <SKILL_HUB_DOWNLOAD_URL>/<name> → extract
  the zip into /tmp/<timestamp>/ → rename the dir to the skill's declared
  name (ADK's load_skill_from_dir requires dir name == SKILL.md name) →
  return the dir. Includes a zip-slip guard. Hub base URL is configurable via
  SKILL_HUB_DOWNLOAD_URL.
• _create_skill_toolset: loads each skill and mounts them as one
  SkillToolset. Skills that fail to download/load (malformed name, not a zip,
  404, …) are skipped with a warning so the rest still load; returns None
  if none load.

veadk/cli/cli_agentkit.py

• harness add gains --skills.
• harness invoke gains --tools / --skills for one-time overrides.
• Client timeout is tunable via HARNESS_TIMEOUT (default 600s) — tool/skill
  driven agent runs can take minutes.

Verified locally (against the real skill hub + Ark models)

• Skill download → extract → rename-to-declared-name → load_skill_from_dir →
  SkillToolset mount → agent build, via internal call and HTTP /harness/add
  (string and array forms).
• Graceful skip: with data-visualization-cloud, byted-arkclaw-paper-research, academic-deep-research, web-scraper, the 2 valid skills load and the 2
  invalid ones (not a zip on the hub) are skipped — the run continues.
• End-to-end invoke with --tools web_search,link_reader + skills on two models
  (deepseek-v4-flash, doubao-seed-2-0-code-preview): the model loads the
  data-visualization skill, calls run_skill_script / web_search, and
  produces an HTML dashboard.

Notes

• run_code is unrelated to this PR but worth flagging: passing large code
  payloads as a tool-call argument can trip ADK/litellm's
  json.loads(tool_call.arguments) (truncated → Unterminated string). Skill
  scripts (run_skill_script) are unaffected.
• Lint: ruff + pyright clean. No new dependency (uses python-frontmatter,
  already a base dep; google.adk.skills exists in adk 1.32 and 2.x).

🤖 Generated with Claude Code