[goldron1]

Summary

• Always pass --allowed-only on --list-skills / --list-skill-versions — no code path omits it, and requests to see blocked/disallowed results are refused rather than served by re-running without the flag.
• Never default to latest or the first repository on jf skills install; resolve version then repo from a single --list-skill-versions call.
• Matches the equivalent behavior already shipped in the Cursor plugin's jfrog-ai-catalog skill.
• Fix-up commit: Copilot Chat has no native arrow-key single-choice picker (unlike Claude Code's AskUserQuestion or Cursor's picker — see jfrog-init/references/how-to-ask-user.md, which never lists VS Code/Copilot Chat as having one). The first pass of this PR incorrectly claimed "VS Code's Quick Pick UI" as an available picker; corrected so version/repo choices always use the Markdown table + plain-language question fallback on this harness.

Test plan

• Diffed the updated discovering-skills.md / installing-skills.md against the Cursor plugin's versions to confirm parity (only the harness-specific Choice UI section intentionally differs, since Copilot Chat has no native picker).
• Manually walk through list/install flows with a project that has more than one skills repo and confirm version-then-repo resolution via the table/question fallback, without assuming latest/first.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}