skill-set: verifiable sets of agent skills

This week I released skill-set, an open spec and npm CLI for defining, sharing and installing collections of AI skills built to tackle a task. Alongside it is skill-sets.md, a small public directory of sets you can install with one command, and share your own.

Why go further than single skills?

It usually takes several skills to do a task well, and I wanted a clean way to group them, version, and hand them to someone else without re-distributing the files, securely...

Agent skills are effectively execution code from an untrusted remote source. Installing pulls remote content that agents later follow as if you wrote it, and that content can change upstream without anyone noticing.

Package managers dealt with a similar problem years ago: cryptographically record exactly what you installed, and check it against the authors published hash. This spec applies that idea to agent skills. A set is locked to the bytes it published with, and you can verify those bytes any time, locally or in CI.

The spec

A skill-set is one JSON manifest and a lock file, containing a list of skills with their sources. The optional lock file records a rolled-up content hash of each skill. verify re-hashes the installed skills against the lock and errors on drift, so a one-line CI step catches silently changed instructions.

Sharing a set is just publishing the manifest at any HTTPS URL. No registry, no accounts.

Here's a locked demo you can run locally (installs the vercel skill-creator skill):

npx @skill-set/cli add https://skill-sets.md/sets/hash-demo/hash-demo.skill-set.json

Authoring your own is fully supported by the cli, docs found here.

Project status

The CLI is at 0.4.0, and there's a skill-set skill agents can use to drive it.

As of yesterday, the directory has a submission path for publishing your own sets, and a skill-search/builder tool is deploying now.

Links

• Docs and the rendered spec: skill-set.md
• The directory: skill-sets.md
• Source and issues: github.com/hcjmartin/skill-set
• The CLI: @skill-set/cli on npm

If you're sharing skills with your team, download the skill-set skill with npx skills add hcjmartin/skill-set and ask your agent to create a skill-set you can publish to a GitHub gist.