{
  "schema_version": 1,
  "generated_at": "2026-06-15T06:30:20.028652+00:00",
  "max_age_seconds": 604800,
  "base_url": "https://skills-hub.web.app",
  "prompt": "Install https://skills-hub.web.app",
  "harness": "cowork",
  "skill": "skills-hub",
  "installed_command": "/skills-hub",
  "interaction_policy": "approvals_or_bounded_choices_only",
  "artifact": {
    "package_path": "cowork/skill-packages/skills-hub.skill",
    "package_url": "https://skills-hub.web.app/cowork/skill-packages/skills-hub.skill",
    "package_sha256": "559f7d7998a9f0d5d109bb64d31d1b0c73cd567da31b5a6e94be63ac24e65459",
    "package_size": 3794,
    "b64_path": "cowork/skill-packages/skills-hub.skill.b64.txt",
    "b64_url": "https://skills-hub.web.app/cowork/skill-packages/skills-hub.skill.b64.txt",
    "b64_sha256": "fabc81d57791359b6a42ece194a569185392764918ae91d5861691b412027d71",
    "b64_size": 5194
  },
  "verification": {
    "allowed_signers_path": "bootstrap/skills_hub_allowed_signers",
    "allowed_signers_url": "https://skills-hub.web.app/bootstrap/skills_hub_allowed_signers",
    "signature_path": "cowork/install.json.sig",
    "signature_url": "https://skills-hub.web.app/cowork/install.json.sig",
    "signature_identity": "skills-hub-manifest",
    "signature_namespace": "skills-hub-manifest",
    "signature_payload": "raw cowork/install.json bytes",
    "required_checks": [
      "verify install.json.sig with ssh-keygen and the pinned allowed signers file",
      "reject expired install.json generated_at plus max_age_seconds",
      "do not search the plugin registry or enter plugin-registry retry loops during descriptor install",
      "stop with BLOCKED: no byte-preserving fetch-to-file path if artifact.b64_url cannot be saved exactly",
      "do not use shell heredoc, manual paste, or model-rewritten base64",
      "do not retry after signature, freshness, size, SHA-256, decode, download, or presentation failure",
      "fetch artifact.b64_url as exact text and verify artifact.b64_size and artifact.b64_sha256",
      "decode the verified b64 text to skills-hub.skill",
      "verify downloaded skills-hub.skill size equals artifact.package_size",
      "verify downloaded skills-hub.skill SHA-256 equals artifact.package_sha256",
      "import only the verified local skills-hub.skill package"
    ]
  },
  "failure_policy": "fail_closed_report_exact_check"
}