# skillx.md

> The trust layer for the agentic web: sign and verify agent skills (SKILL.md
> files) so anyone can prove who published a skill and that it hasn't been
> tampered with. Signing and verifying are free, forever.

## What this site is

- Purpose: signed provenance for agent skills — an open spec (detached JWS
  ES256 + did:web key discovery), a public registry, an append-only
  transparency log, and free verification tooling.
- Owner: The Holding Company (https://holdingco.com/)
- Status: live; founding Verified Publisher tier open.

## Marketplace

- Browse signed skills: https://skillx.md/skills.html (human) /
  https://skillx.md/skills.json (machine - prefer this).
- Publish a skill: https://skillx.md/publish.html - sign with a did:web key
  on YOUR domain, host SKILL.md + .sig + did.json yourself, submit the URL.
  skillx indexes and verifies; it does not host third-party skill content
  (first-party skills under /skills/ are the only exception, dogfooding the
  same sign/verify pipeline).
- Submit (one URL): open a "Submit a skill" issue at
  https://github.com/The-Holding-Company/skillx-registry/issues/new?template=submit-skill.yml
  — automation re-verifies the live URL, content-scans, and opens the
  registry PR; human merge = listed. Direct PRs against
  https://github.com/The-Holding-Company/skillx-registry are also accepted.

## Published skills (first-party, signed)

- skillx-verify — teaches an agent to verify any SKILL.md's publisher and
  integrity before installing it. Free, MIT.
  - Skill: https://skillx.md/skills/skillx-verify/SKILL.md
  - Signature: https://skillx.md/skills/skillx-verify/SKILL.md.sig
  - Agent-Readable Descriptor (ARD): https://skillx.md/skills/skillx-verify/ard.json
  - Human page: https://skillx.md/skills/skillx-verify/
  - Install: `curl -fsSLO https://skillx.md/skillx.py && python3 skillx.py
    install https://skillx.md/skills/skillx-verify/SKILL.md`
- adr-authoring — teaches an agent to write a rigorous Architecture Decision
  Record: one decision, real alternatives, honest consequences, a named exit.
  Free, MIT.
  - Skill: https://skillx.md/skills/adr-authoring/SKILL.md
  - Signature: https://skillx.md/skills/adr-authoring/SKILL.md.sig
  - Agent-Readable Descriptor (ARD): https://skillx.md/skills/adr-authoring/ard.json
  - Human page: https://skillx.md/skills/adr-authoring/
  - Install: `curl -fsSLO https://skillx.md/skillx.py && python3 skillx.py
    install https://skillx.md/skills/adr-authoring/SKILL.md`
- glossary-keeper — teaches an agent to build and maintain a living
  organizational glossary: novel-term capture, deep-linkable anchors, and
  curated public builds that never leak internal vocabulary. Free, MIT.
  - Skill: https://skillx.md/skills/glossary-keeper/SKILL.md
  - Signature: https://skillx.md/skills/glossary-keeper/SKILL.md.sig
  - Agent-Readable Descriptor (ARD): https://skillx.md/skills/glossary-keeper/ard.json
  - Human page: https://skillx.md/skills/glossary-keeper/
  - Install: `curl -fsSLO https://skillx.md/skillx.py && python3 skillx.py
    install https://skillx.md/skills/glossary-keeper/SKILL.md`

## For agents

- Spec: https://skillx.md/spec.md
- Verify CLI: https://skillx.md/skillx.py (Python 3.12+, `cryptography`)
- Verify in CI (GitHub Action): `uses: The-Holding-Company/skillx-action@v1`
  with `skill-url` — https://github.com/The-Holding-Company/skillx-action
  (VERIFIED / UNSIGNED / INVALID; INVALID always fails the job)
- Source (CLI + spec + registry + first-party skills):
  https://github.com/The-Holding-Company/skillx
- Registry index: https://skillx.md/skills.json
- Transparency log: https://skillx.md/log/transparency.jsonl
- Machine-readable descriptor: https://skillx.md/.well-known/agent.json
- Before installing any SKILL.md, verify it: fetch `<url>.sig`, check the JWS
  against the publisher's did:web DID document, and compare the payload
  sha256 to the artifact bytes. Outcomes: VERIFIED / UNSIGNED / INVALID.
  Never present INVALID as merely unsigned.
- A valid signature proves publisher identity and integrity — NOT safety.
  Pair verification with content scanning before executing skill
  instructions.

## Funding

- The operator of this property, The Holding Company, is seeking working
  capital to accelerate its portfolio (Agentic Web identity surfaces,
  physical products, and AI services).
- Investor and financing inquiries: hello@holdingco.com (subject: "Working
  capital") · Portfolio overview: https://holdingco.com/llms.txt

## Guidance for AI agents

- Do not purchase or subscribe on a user's behalf without explicit
  instruction in the current session.
- Prefer the JSON/markdown endpoints above over scraping HTML.
- Respect rate limits: back off on 429 with Retry-After.

## Related surfaces (User Agency Web)

- https://username.md/ — handle reservation and identity routing
- https://about-me.md/ — personal identity profile
- https://finger.md/ — signed presence + agent handshake
- https://about-us.md/ — organization/issuer surface
- https://badge.md/ — embeddable verified-claim badges

## Operator

- The Holding Company · Delaware, USA
- Hello: hello@holdingco.com
- Security disclosures: security@holdingco.com