What shipped
Every change below is verified work in this repository — run the commands, read the proofs.
skills.sh proof pages, sync, and author Action
Checked-in capability proofs at /skill/ with raw JSON, OG metadata and a badge; bounded trending/hot sync every 6 hours; a GitHub Action skill authors can run; verify skills-sh: and proof-url commands.
Read-only skills.sh commands
skills-sh search, inspect and proof: fetch a skill snapshot, scan it, reconcile the upstream hash, and print the local proof. Exit 2 on hash mismatch, fail-closed errors without a token.
Scanner reports real values, real hashes
Placeholders are gone: domains, interpreters, paths and env names are extracted from content; content_hash is a real sha256; frontmatter supplies name and version; diff exits 2 on changed values; verify fails closed on unknown hashes.
Read API contract generated from Zod
openapi/v1.yaml plus manifest and eval JSON schemas, all generated from the schema source of truth with a sync test.
CLI scan, diff, attest, and tests
The Commander CLI with capability diffing (exit 2 on new privileges), local JSONL attestations, and a green Vitest suite.
Marketing and docs site
VitePress site with a shared design system, Pages deploy workflow, and agent-readable llms.txt index.