Skill Set

Skill sets

A skill set is a named, versioned bundle of agent skills, defined by a small JSON manifest and installed as a group. This skill drives the skill-set CLI, which wraps npx skills to resolve each member. Full docs: https://skill-set.md.

Quick start

Install a published, tag-pinned set whose four members are verified against its sidecar lock:

npx @skill-set/cli add https://skill-sets.md/sets/skill-authoring/skill-authoring.skill-set.json npx @skill-set/cli add https://skill-sets.md/sets/skill-authoring/skill-authoring.skill-set.json#sha256=

The first form auto-discovers and checks the author's sidecar lock; the second also pins the rollup hash obtained out-of-band. Either way, if verification fails nothing is kept and the command exits 3.

Or define your own set from remote skills, then install it:

npx @skill-set/cli init [ ...] npx @skill-set/cli install

Core concepts

• Manifest — .skill-set.json: the set's name, version, and member skill locators. The shareable definition.
• Set-lock — .skill-set.lock.json: each member skill's resolved content hash plus a rollup setHash, for byte-exact verification.
• SKILL-SET.md — a generated discovery page per set. Do not hand-edit; run build.
• Sets live under .agents/skills/skill-sets//; member skills install as ordinary skills under .agents/skills/.

Common tasks

Global flags: --json (machine output), --yes (CI), --dry-run (preview, changes nothing). Full reference: https://skill-set.md/cli.

• Create a set — init
• Install / sync — install (skips members the lock already satisfies)
• Generate lock of local contents — lock
• Regenerate pages + index — build [] [--lock]
• Verify installed content — verify [--frozen] (frozen re-hashes vs the lock; the CI default)
• Update members — update (re-resolves via npx skills, then re-locks)
• Remove a set — remove (optionally removes skills no other set uses)

Sharing a set

share re-fetches every member into a clean staging area and records the hash of the delivered content — never your local, possibly-edited folders:

npx @skill-set/cli share

Publish the emitted .skill-set.json and .skill-set.lock.json together. A recipient verifies at install time:

npx @skill-set/cli add # auto-discovers and checks the sidecar lock npx @skill-set/cli add #sha256= # or pin the rollup hash out-of-band

If verification fails, nothing is kept and the command exits 3 — see https://skill-set.md/faq for what gets verified and when.

Caveats

• .agents/skills/skill-sets/ is the set-definitions directory, not a skill. The name skill-sets is reserved: the CLI refuses to install any skill under it, so set definitions survive member installs. To remove a single set, use skill-set remove — never delete inside that directory by hand.
• Local member locators work locally but aren't shareable. You can init, install, and lock a set that references local skill paths, but share rejects them — a shared set must resolve from remote sources on another machine.

Reference

• Manifest + set-lock format — https://skill-set.md/spec
• Full CLI reference (commands, flags, exit codes) — https://skill-set.md/cli
• Trust model, what is verified and when — https://skill-set.md/faq

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: hcjmartin
• Source: hcjmartin/skill-set
• License: MIT
• Homepage: https://skill-set.md

Install and usage instructions live in the source repository linked above.