diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index 91095ef..2f90a84 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "skill-fetch",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Search, discover, and install AI agent skills from 9 registries with quality scoring, security labels, and cross-platform support",
   "author": {
     "name": "girofu",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2a1dac9..7fa1ebd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [1.4.1] - 2026-04-23
+
+### Fixed
+
+- **Partial skill downloads — install the directory, not the file**: Install logic previously hardcoded `SKILL.md` + `references/*.md` + `scripts/*.sh`, so skills shipping any other subdirs (`assets/`, `templates/`, `prompts/`, `data/`, `examples/`) or non-`.sh` scripts (`*.py`, `*.js`, `*.ts`) were installed with missing files and silently broken. Example: `anthropics/skills/skills/pdf` ships 9 Python scripts that were all dropped. The install flow now enumerates the full skill root via the git tree API and downloads every file, preserving the subtree layout.
+
+### Added
+
+- **`scripts/fetch-skill-bundle.sh`** — parses GitHub `blob`/`tree`/`raw.githubusercontent.com` URLs, enumerates the full skill root via `git/trees/{ref}?recursive=1`, and downloads every file preserving directory structure. When given a `SKILL.md` URL it auto-derives the parent dir as the skill root.
+- **`.github/maintainer/`** — per-repo state (config, context, decisions, patterns, standing rules, contributor notes, run ledger) for the `open-source-maintainer` triage workflow. No user-facing behavior change.
+
+### Changed
+
+- **`installation-guide.md` §3d** — GitHub source and Direct URL source (when pointing at a GitHub file) both use tree enumeration via the bundle helper instead of hardcoded subdirs/extensions. Direct URLs to GitHub files now bring sibling files along.
+- **SKILL.md Step 4 — "Digest the Installed Bundle"** — walks the full installed tree; verifies bundle completeness against relative paths referenced by SKILL.md.
+- **Security scan scope** — `find -type f` walks the complete bundle. Categories now apply to `*.md` throughout the tree (A-F), `*.sh`/`*.bash`/`*.zsh`/`*.py`/`*.js`/`*.ts` (A-E), and `*.json`/`*.yaml`/`*.toml` (D, F).
+- **Integrity hashing** — SHA-256 recorded for every file in the installed bundle, not just `SKILL.md` + `references/*.md` + `scripts/*.sh`.
+
 ## [1.4.0] - 2026-03-23
 
 ### Added
diff --git a/README.md b/README.md
index 2803071..7b0e715 100644
--- a/README.md
+++ b/README.md
@@ -24,11 +24,12 @@ Search, score, and install AI agent skills from **9 registries** in parallel —
 - **Security Labels** — 5 trust tiers: Official, Verified, Partial, Unverified, Security Concerns
 - **6-Category Security Scan** — Destructive commands, RCE, data exfiltration, system modification, obfuscation, prompt injection
 - **Prompt Injection Detection** — 5 sub-categories (PI-1~PI-5): direct override, hidden role markers, encoding tricks, indirect injection, social engineering
-- **Integrity Verification** — SHA-256 hash recorded at install, tamper detection on future loads
+- **Complete Bundle Install** — Downloads the whole skill directory (SKILL.md + `references/`, `scripts/`, `assets/`, `templates/`, `prompts/`, `data/`, etc.), preserving the subtree layout so skills that delegate to sibling files actually work
+- **Integrity Verification** — SHA-256 hash recorded for every file in the bundle at install; tamper detection on future loads
 - **Paginated Results** — Browse 5 at a time with `c` to continue; install by number from any page
 - **Local/Global Install** — Choose project-level or user-level installation (mandatory prompt)
 - **Deduplication** — Same skill across registries is merged; similar descriptions are flagged
-- **Bundled API Scripts** — Pre-built shell scripts for SkillHub and Skills Directory APIs (no API key exposure)
+- **Bundled Scripts** — Shell scripts for SkillHub and Skills Directory APIs (no API key exposure in argv) plus `fetch-skill-bundle.sh` for full-bundle GitHub installs
 
 ## Installation
 
@@ -311,10 +312,15 @@ skill-fetch/
 │       │   ├── search-sources.md     # Source-specific commands & dedup rules
 │       │   ├── quality-signals.md    # Scoring algorithm + security labels
 │       │   ├── interaction-patterns.md # Output templates, security scan, prompt injection
-│       │   └── platform-adapters.md  # Cross-platform tool mapping
+│       │   ├── platform-adapters.md  # Cross-platform tool mapping
+│       │   ├── installation-guide.md # Complete Step 3 install workflow
+│       │   └── local-index.md        # Local skill/plugin scan for pre-search dedup
 │       └── scripts/
-│           ├── fetch-skillhub.sh     # SkillHub API search (reads key from config)
+│           ├── fetch-skill-bundle.sh    # Download a complete skill bundle from GitHub (SKILL.md + all siblings)
+│           ├── fetch-skillhub.sh        # SkillHub API search (reads key from config)
 │           └── fetch-skills-directory.sh # Skills Directory API search
+├── .github/
+│   └── maintainer/                   # Per-repo state for open-source-maintainer workflow
 ├── install.sh                        # Universal bash installer
 ├── install.py                        # Python installer
 ├── CHANGELOG.md                      # Version history