Documentation

Overview

SkillSafe is a secured registry for AI coding tool skills. It provides cryptographic integrity verification, dual-side scan report comparison, and content-addressed storage to ensure every skill you install is exactly what the publisher intended.

For AI tool integration, read the raw guide at /skill.md.

Quick Start

1. Install SkillSafe

Copy and send this message to your AI coding tool:

Install skillsafe from https://skillsafe.ai/skill.md

Your AI tool reads the skill definition, downloads the client, and sets up SkillSafe automatically. Works with Claude Code, Cursor, Windsurf, and any AI coding tool that supports skills.

2. Register & Publish

skillsafe auth myname --email me@example.com
skillsafe scan ./my-skill
skillsafe publish ./my-skill --version 1.0.0

Creates your account, scans your skill for security issues, generates a tree hash, and uploads with the scan report. Email verification is required before publishing.

3. Install & Verify

skillsafe install @publisher/skill-name --claude

Downloads, re-scans independently, verifies the report against the publisher's, and installs only if the verdict is verified.

Authentication

All authenticated requests use a Bearer token:

Authorization: Bearer sk_your_api_key_here

API keys are hashed with SHA-256 before storage. The server never stores plaintext keys.

Key Limits

• Free: 5 active keys
• Paid: 20 keys
• Enterprise: unlimited

Manage keys at /account/keys.

Publishing a Skill

POST /v1/skills/@{namespace}/{name}
Content-Type: multipart/form-data

Fields:
  archive      — .tar.gz of the skill directory
  scan_report  — JSON scan report
  metadata     — JSON with version, description, category, tags

Size Limits

• Max archive: 10 MB per version
• Free: 10 MB total | Paid: 100 MB | Enterprise: 500 MB

Installing a Skill

GET /v1/skills/@{namespace}/{name}/download/{version}
Authorization: Bearer sk_...

After downloading, the consumer CLI extracts, re-scans, submits a report, and installs only on verified.

Verification Model

SkillSafe uses dual-side verification.

Searching

GET /v1/skills/search?q=formatter&sort=popular&limit=20

Sort: popular, recent, verified, trending, hot

Personal Vault

Encrypted backup with AES-256-GCM. Server stores only ciphertext.

PUT /v1/vault/{key}
Authorization: Bearer sk_...

API Reference

Base URL: https://api.skillsafe.ai

Security Model

• Content-addressed storage: SHA-256 hashes
• Tree hashes: Immutable per-version
• Dual verification: Independent publisher + consumer scans
• API key hashing: SHA-256 before storage
• Vault encryption: AES-256-GCM, client-side

Report issues: security@skillsafe.ai