SKILL artifact: package reusable instructions

The shape of a skill

A skill has content.entrypoint pointing to its main markdown file. The entrypoint is read from the downloaded bundle and providers copy the skill directory, preserving supporting files.

Use a conventional SKILL.md at the package root unless your tool-specific contract requires another relative path. The path is case-sensitive on many systems and must also appear in files.

{ "entrypoint": "SKILL.md" }

What to put in files

files is the release allow-list. Include the entrypoint and every file it references. Glob patterns are relative to path and support **.

Example manifest entry

This package keeps the entrypoint explicit and captures all support files. The public tag can be namespaced; the local deployment key is auditor.

{
  "auditor": {
    "kind": "artifact",
    "path": "packages/auditor",
    "tag": "vendor/security-auditor",
    "version": "1.2.0",
    "visibility": "public",
    "artifact_type": "SKILL",
    "content": { "entrypoint": "SKILL.md" },
    "files": ["SKILL.md", "references/**", "scripts/**"]
  }
}

What install materializes

Supported providers read the entrypoint and copy the artifact bundle into their managed skill location, adding ownership metadata. A provider can apply, skip or report a type-specific limitation; check the install report rather than assuming every provider has identical paths.

Use hubbound install artifact <author/tag>@<version> or pin it under dependencies and run bare hubbound install from the project root.