Open .skill ProtocolThe cryptographic trust standard for AI skills.
Package a skill once as a sealed .skill, content-addressed, cryptographically signed, and independently verifiable before anyone runs it. Create, inspect, sign, and run portable .skill packages for AI agents, the integrity and provenance layer on top of your SKILL.md.
Every skill declares its intent, triggers, inputs and outputs, ordered steps, required permissions, and verification checks — so the same package means the same thing to every agent and host.
🔒
Content integrity built in
A content-addressed skill_id and SHA-256 package and manifest digests make any change after packaging detectable. A license/terms slot travels with the package too.
🔍
Inspect before you run
See the seal, issuer, and digests — and a clean split of cryptographically verified vs. self-reported claims — without executing anything.
🪜
A real trust ladder
Seal with a development key for local work, a configured Ed25519 issuer key for verifiable authorship, or anchor the digest in a public transparency log that anyone can check independently.
🔀
Continuity and release, as first-class modes
Hand off work-in-progress between agents as a continuity package; cut a release only when the contract is complete and a human has reviewed it — release compiles refuse anything less.
🧾
Provenance you can trust
Agents author; humans review and approve. Declared agent host and model travel with the package, and self-reported claims are never presented as verified.
⬆️
Upgrade your existing SKILL.md
One command converts a SKILL.md or skill-creator folder into a sealed, inspectable .skill package.
🌐
Open protocol, portable format
The .skill container is defined by the spec, not the tool — skillerr and the @skillerr/* reference libraries are one implementation, and independent implementations are welcome.
Seals, signs, records provenance, lets you inspect before you run
skillerr
npx skills add owner/repo installs unverified instructions and executable scripts from any repo, with no integrity or provenance check. Distribution tools install a skill; skillerr lets you verify one, its integrity, issuer, and provenance, before you run it.
No telemetry, no tracking. skillerr makes no network calls unless you explicitly opt in (--transparency, --keyless, --online).
A skill is only as trustworthy as your ability to verify it. .skill gives every skill a verifiable identity, provable authorship, and independently checkable provenance, the same guarantees the software supply chain now expects, applied to AI skills.
Pillar
What it gives you
Identity
Content-addressed skill_id and SHA-256 package_digest/manifest_digest. Change one byte after sealing and the identity changes.
Authorship
A configured Ed25519 issuer key (verified_issuer), or an OIDC identity bound with Sigstore Fulcio keyless signing, both using the standard DSSE attestation envelope.
Provenance
The sealed digest anchored to the public Sigstore Rekor transparency log, verified offline against the log's signed tree head by default, with a search.sigstore.dev link so anyone can check independently.
Assurance
--claims splits every field into verified (crypto-checked) and self_reported (asserted), two separate arrays, never blurred together.
No telemetry, no tracking. skillerr makes no network calls unless you explicitly opt in (--transparency, --keyless, --online).
Trust is explicit and layered, you choose how much you need, and verifiers can always tell which rung a package sits on:
Development. Sealed for local iteration with the public dev HMAC key. Clearly labeled, never mistaken for production trust.
Verified issuer. Signed with your configured Ed25519 key (skill keygen + --signer-key); verifiers who pin your key get cryptographic proof of authorship and integrity.
Publicly anchored. The sealed digest is logged to a public transparency log (sigstore's Rekor via --transparency, and/or Fulcio keyless OIDC via --keyless), independently verifiable by anyone without trusting the tool.
Anchoring is orthogonal to trust state and always additive, an anchored package can still be development or self-reported trust. Inclusion is not endorsement: logging a package proves auditability, not goodness. A seal proves who issued a package and that it hasn't changed, never that the skill is correct or safe. See Trust & security.
The primitives that make a .skill verifiable are, by design, a foundation a future ownership layer could build on: on-chain provenance, programmable royalties for skill authors, decentralized skill marketplaces. This is deliberate architecture, not a promise of features.
Content-addressed identity already gives every skill a unique, tamper-evident id, the same reference primitive on-chain assets use to point at off-chain content.
Cryptographic authorship is already key-based (Ed25519, optionally Fulcio-bound OIDC identity), the same shape as wallet-based identity.
Pluggable anchors: the permanence-anchor slot is an open extension point. The wire format already reserves a ledger anchor kind alongside the shipped ones; no ledger-anchoring implementation exists yet, it's a tracked roadmap item, addable without breaking existing packages.
A neutral core: the spec has no marketplace, no token, and no commerce code, so any ownership layer could build on the verifiable foundation without the standard picking winners.
What this is not, today: skillerr does not mint tokens, issue NFTs, or move value. "Minting" a .skill creates a cryptographic attestation, not a financial instrument. On-chain ownership is a roadmap extension point, not a shipped feature, and it will always be optional, never required to author, verify, or run a skill. Nothing here is investment advice or a claim of future value.
