feat(cli): hide public skills from vlmrun skills list by default

[spillai]

Summary

vlmrun skills list now shows only non-public (organization-owned) skills by default. Pass --public to include public skills in the listing alongside your private ones.

Changes:

• vlmrun/cli/_cli/skills.py — added a --public flag to vlmrun skills list. When omitted, the CLI passes include_public=False to the API so only the caller's non-public skills are returned. When --public is set, it passes include_public=True and all accessible (public + private) skills are returned.
• vlmrun/client/skills.py — plumbed include_public and only_public parameters through Skills.list() so SDK consumers can request the same filtering. Defaults preserve existing server behavior for direct SDK callers (include_public=True, only_public=False).
• vlmrun/cli/README.md — documented the new --public flag.
• tests/cli/test_cli_skills.py — added two tests verifying the CLI passes include_public=False by default and include_public=True when --public is provided.
• tests/conftest.py — extended the MockVLMRun.Skills.list signature to accept the new kwargs.

This maps to the existing include_public query parameter on GET /v1/skills (defined in vlm-cloud/backend/app/api/routes/skills.py), so no server-side change is needed.

Review & Testing Checklist for Human

• Run vlmrun skills list against a real account and confirm the table now shows only non-public (organization-owned) skills.
• Run vlmrun skills list --public and confirm public skills are included again.
• Confirm that scripts/integrations using client.skills.list() directly (without arguments) keep their current behavior (the SDK default still includes public skills, only the CLI default changes).

Notes

• The SDK method default (include_public=True) is intentionally kept as-is to avoid breaking existing programmatic consumers; only the CLI default behavior is flipped, as requested.
• only_public is also exposed on Skills.list() for completeness but isn't surfaced as a CLI flag — happy to add it (e.g. --only-public) if useful.

Link to Devin session: https://app.devin.ai/sessions/c34b623c3551437dab8a45b3d272029f
Requested by: @spillai

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[gemini-code-assist]

Code Review

This pull request introduces the ability to filter public skills in the CLI and SDK by adding a --public flag to the vlmrun skills list command and updating the client's list method. Review feedback suggests removing the only_public parameter across the SDK, mocks, and documentation since it is currently unsupported by the backend. Additionally, there is a recommendation to adjust the CLI docstring formatting for better consistency and readability.

[gemini-code-assist]

The docstring uses double backticks (--public) which is inconsistent with the rest of the CLI help strings in this repository. Additionally, a comma is missing after "By default" for better readability.

Suggested change

	"""List available skills.
	By default only non-public skills owned by your organization are shown.
	Pass ``--public`` to include public skills as well.
	"""
	"""List available skills.
	By default, only non-public skills owned by your organization are shown.
	Pass --public to include public skills as well.
	"""

[gemini-code-assist]

The only_public parameter is added here "for completeness," but the PR description suggests that only include_public is currently supported by the backend. Adding unsupported parameters to the public SDK can be misleading for users. If the backend does not currently support filtering for only public skills, this parameter should be removed to maintain a clean and functional API.

Suggested change

	include_public: bool = True,
	only_public: bool = False,
	include_public: bool = True,

[gemini-code-assist]

Remove the only_public documentation if the parameter is removed. Also, the note about preserving server behavior is more relevant to the PR discussion than the end-user documentation and can be simplified.

Suggested change

	include_public: If True, include public skills alongside the
	caller's organization skills. Defaults to True to preserve
	the server's existing behavior.
	only_public: If True, return only public skills.
	include_public: If True, include public skills alongside the
	caller's organization skills. Defaults to True.

[gemini-code-assist]

Remove only_public from the request parameters if it is not supported by the backend.

Suggested change

	"include_public": include_public,
	"only_public": only_public,
	"include_public": include_public,

[gemini-code-assist]

Update the mock to match the removal of the only_public parameter from the SDK.

Suggested change

	include_public=True,
	only_public=False,
	include_public=True,

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 3 additional findings.

[devin-ai-integration]

Thanks for the review. Addressed the docstring style nit in 5fe2518 (dropped the RST-style double backticks and added the comma after "By default,").

Keeping only_public on Skills.list() though — the backend GET /v1/skills endpoint in vlm-cloud already accepts an only_public query parameter (alongside include_public), so the SDK plumbing matches the existing server contract.