skills
Add your first skill

[ source → review → install ]

One controlled path from SKILL.md to every AI client.

Add an existing skill, verify the exact package, approve the version and distribute only what each person or client is allowed to use.

Add your first skillFollow the quickstart

Start with a free Personal Vault. Create a company vault only when sharing and approval become part of the job.

Release pathbrand-review / v1.5
Draft
Company brand reviewSKILL.md · references/voice.md · assets/checklist.md
  1. 01
    AddZIP · GitHub · connected client
    Draft created
  2. 02
    ValidateSKILL.md · paths · package limits
    Structure checked
  3. 03
    ScanExact package · security policy
    Required
  4. 04
    ReviewPersonal release or team decision
    Next
  5. 05
    ReadyImmutable approved version
    After approval
  6. 06
    InstallGrant · signed ZIP · checksum
    To your clients
Destinations after Ready

01 / The complete release

Every state is visible. Every transition has a reason.

The web app is the governance console. Your AI clients are where people discover, request, review and install the approved result.

Read the version model
  1. 01

    Add the skill you already have

    Upload a ZIP, scan a public GitHub repository or ask a connected client to save a complete package. Every route starts as a Draft.

    SKILL.md required references/ included assets/ includedDraft · v1.5
  2. 02

    Validate the package boundary

    Installskills checks the manifest, frontmatter, names, paths, sizes and file inventory without executing the package.

    SKILL.md found kebab-case name safe relative paths package limits passed
  3. 03

    Test the Draft privately, if needed

    The author can prepare a short-lived test package before release. It stays Unreviewed, author-only and outside collections and update checks.

    Author receiptDraft test package readybrand-review · v1.5Unreviewed · author only · expires in 15 min
  4. 04

    Scan the exact version

    The security gate is tied to the package hash. A changed file invalidates the old result, and high or critical risk cannot continue.

    package hash trusted scan risk gate
  5. 05

    Release personally or route to review

    Personal Vault owners release after the trusted gate. Team and Enterprise versions wait for an authorized reviewer and keep the exact report attached.

    Personal VaultOwner releaseMedium risk requires acknowledgement
    Team / EnterpriseHuman reviewApprove or return for changes
  6. 06

    Grant access and install the Ready version

    Approved content becomes immutable. Connected clients see only accessible skills and receive a version-pinned signed ZIP, checksum and expiry.

    Readybrand-review · v1.5workspace grant · checksum verified

02 / One control model

Govern in the web app. Work from your clients.

Governance console

Installskills web app

  • Import sources and organize collections
  • Inspect exact security reports
  • Approve versions and assign access
  • Review activity and workspace policy
Where work happens

Connected AI clients

ChatGPT Claude Codex Cursor VS Code Windsurf

Discover, request, decide, download and check updates within the caller's real permissions.

03 / Release boundaries

A Ready label must be earned.

Package state, security evidence and access are separate controls. Passing one never silently bypasses another.

Exact package Scans and reviews stay bound to the content hash.
Explicit gate Blocking risk remains Draft; medium risk needs a note.
Scoped access Ready content still requires a user, group or vault grant.
Verifiable install Clients receive a short-lived URL and ZIP checksum.
See the security model

Ready when your first skill is

Start personal. Add company control when the workflow needs it.

No sales call is required to complete the first Draft → Ready → install loop.

Add your first skill