docs(skills): #140 document /skill install + [skills] config section

- README: add a "Publishing your own skill" section explaining the
  `github:owner/repo` install path, the multi-skill `skills/<name>/`
  layout, and how to submit to the curated registry.
- config.example.toml: document `[skills] registry_url` /
  `max_install_size_bytes` next to the existing `[network]` section so
  users see the network-gate dependency in context.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

README.md

@@ -198,6 +198,23 @@ Full reference: [docs/CONFIGURATION.md](docs/CONFIGURATION.md)
 
 ---
 
+## Publishing your own skill
+
+DeepSeek-TUI can install community skills directly from a GitHub repo, with no
+backend service in the loop:
+
+1. Create a public GitHub repo with a `SKILL.md` at the root containing the
+   usual `---` frontmatter (`name`, `description`).
+2. Multi-skill bundles use `skills/<name>/SKILL.md` instead — the installer
+   picks the first match and names the install after the frontmatter `name`.
+3. Push to `main` (or `master`); the installer fetches
+   `archive/refs/heads/main.tar.gz` and falls back to `master.tar.gz`.
+4. Users install via `/skill install github:<owner>/<repo>` — installs are
+   gated by the `[network]` policy, validated for path traversal and size, and
+   placed under `~/.deepseek/skills/<name>/`.
+5. Submit a PR to the curated `index.json` (default registry) to make the skill
+   installable by name (`/skill install <name>`) instead of the GitHub spec.
+
 ## Documentation
 
 | Doc | Topic |

config.example.toml

@@ -124,6 +124,25 @@ max_subagents = 5 # optional (1-20)
 # deny = []
 # audit = true            # one line per call to ~/.deepseek/audit.log
 
+# ─────────────────────────────────────────────────────────────────────────────────
+# Skills (#140)
+# ─────────────────────────────────────────────────────────────────────────────────
+# Settings for the `/skill install <spec>` community-skill installer.
+#   * registry_url           — curated index.json that resolves bare names to
+#                              `github:owner/repo` specs. Override to point at
+#                              a private fork or internal mirror.
+#   * max_install_size_bytes — per-skill uncompressed size cap. Tarballs that
+#                              exceed this limit are rejected during validation.
+#                              Default: 5 MiB.
+#
+# `/skill install` is gated by `[network]`. Make sure `github.com` and
+# `raw.githubusercontent.com` are reachable (default `prompt` is fine — you'll
+# be asked once and can persist) before running it.
+#
+# [skills]
+# registry_url = "https://raw.githubusercontent.com/Hmbown/deepseek-skills/main/index.json"
+# max_install_size_bytes = 5_242_880
+
 # ─────────────────────────────────────────────────────────────────────────────────
 # TUI
 # ─────────────────────────────────────────────────────────────────────────────────