The supply chain nobody signed
A skill is a folder of plain instructions, a SKILL.md, that Claude Code, Hermes, Codex, Cursor and dozens of other agents load and then follow with the agent’s own permissions: the shell, the files, the keys. In February 2026 the security firm Snyk audited 3,984 skills from two public indexes and found that 13.4 percent had a critical issue. Seventy-six carried confirmed malicious payloads, most of them pairing malware with prompt injection.
The indexes those skills came from share four habits. A name belongs to whoever uploads it first, so a look-alike fact-check is one upload away. Nothing pins the bytes, so a skill can change after you trusted it. A single company decides what counts as safe, and doesn’t show its reasoning. And abandoned listings stay up forever, collecting installs.
Four properties, each enforced by the chain or by your own machine
- 名前A name has an owner
- A skill is
name@publisher. The publisher is Arkiv’s$creator, written by the chain itself. Anyone can publish afact-check; nobody can publish one as someone else. - 凍結A version never changes
- Each version is a single
readonlyrecord carrying a hash of every file. Install re-checks every byte before writing anything and pins the result inskills.lock.json. - 信頼You pick the judges
- Ratings are public records anyone can post. Your trust file lists the raters you believe, and the verdict (PASS, WARN or BLOCK) is computed on your machine. The same data can give you and a stranger different answers. That is the design.
- 期限Listings are leases
- A version lives ninety days. Its owner renews it, or anyone who still depends on it can pay to keep it alive. Abandoned skills fall away on their own.
Won’t smarter models make all of this obsolete?
It’s the right question to ask in a year when a better model ships almost every week. If next month’s model writes better code from a prompt than the code someone pinned in March, why keep a registry at all? Why not a registry of prompts, and let each new model generate the rest?
What goes stale
Bundled code. The next model writes a better script. Regenerate it.
Scaffolding for weaker models. “Think step by step,” rigid twelve-step procedures, over-specified formats. They can make a stronger model worse.
Workarounds for one model’s quirks. They die with the model.
What lasts
Facts. Of 234 skills on one working developer’s machine, 59 contain any script at all. The other three-quarters are markdown: hosts, house rules, decisions, pitfalls.
Knowledge, as distinct from intelligence. A model ten times smarter still doesn’t know your deploy target or last month’s expensive mistake.
Verification. When generating code costs nothing, knowing who wrote an instruction, that it hasn’t changed, and who vouches for it is the scarce thing.
A prompt registry wouldn’t escape the problem; it would rename it. Prompts are the attack surface. Prompt injection lives in prose, which is exactly where a scanner is weakest. A skill already is a prompt, plus the facts it depends on, plus a description of when to use it.
Models get smarter every week. Your intent, your constraints and your tests shouldn’t have to be rewritten each time. skillreg stores what lasts and verifies what’s regenerated.
A registry of intents and evals
If models improve weekly, the durable asset isn’t the implementation. It’s the specification and the test. The record format is heading toward four parts with very different lifetimes:
| Part of the record | Lifetime |
|---|---|
| Intent. What the skill is for. | Long |
| Facts and constraints. What no model can derive. | Long, renewed as they change |
| Evals. Runnable acceptance checks any model’s output must pass. | Long |
| Reference code. Marked disposable. | Until the next model |
Ratings then mean more than “this file looks safe.” They also mean “model X, on date Y, produced output that passed these evals.” The ninety-day lease already suits content that decays.
Humans set the policy. Agents do the work. The record keeps both honest.
As agents begin writing skills and handing them to one another, a registry’s real users become machines. An agent can hold a key and pay for storage; it can’t comfortably pass an email-and-captcha signup. skillreg needs nothing to read and only a wallet to publish, rate or sponsor, and its exit codes (2 for blocked, 3 for needs confirmation) are written for an agent to act on.
To be precise about the claim: skillreg doesn’t make a model’s values good. That is alignment research. What it does is narrower, and real. It keeps what agents are told to do in readable text, pinned and audited in public, and it leaves the human in charge of whose judgment their agent obeys. Call it AI control, or supply-chain defence. The same pattern extends to MCP servers, tools and messages between agents.
A d/acc tool, scored honestly
Vitalik Buterin’s d/acc asks builders to accelerate the technologies that make the world safer for pluralism: decentralized, defensive, differential, democratic. In “My techno-optimism” he calls for info-defence that plugs into “a large and sophisticated group of people” rather than a single arbiter, and argues that security tools “should not be something that requires explicit installs.”
| Today | Next | |
|---|---|---|
| Defensive | Detection and pinning help the person installing. Public findings also teach attackers, the trade every CVE database makes, and still net defensive. | LLM and sandbox raters whose rules can’t be tested offline |
| Differential | Makes the open ecosystem safer, so open can compete with walled marketplaces on safety, not only on freedom. | Safe install as the default inside every agent harness |
| Decentralized | Data on Arkiv; reads need no server. But the default trust list, this page and the CLI source are still one maintainer. | Trust lists as records, several defaults, mirrors by hash |
| Democratic | Everyone picks their own judges. There is no central list of good and bad. | Surface ratings that agree across rater groups that usually disagree |
The honest comparison is Sigstore
Sigstore already gives npm and PyPI signed provenance and a public transparency log, and skillreg should interoperate with it. Arkiv adds two things Sigstore doesn’t. Identity without an account: $creator is the publisher, with no GitHub or Google login vouching for you, which is what lets an agent publish. Ratings without an operator: third-party judgments are first-class records that anyone can query from a browser, with no server of ours in between. Add leases, entity expiration with permissionlessExtension, and a community can keep an orphaned skill, or a warning about a malicious one, alive.
What it doesn’t do yet
- The static scanner is a floor, not the defence. Its rules are public, so an attacker can test against them. Calibrated on 269 real skills: 234 clean, 33 warn, 2 malicious.
- The default trust list is one maintainer’s scanner wallet. Replace it; that is the point.
- It runs on Arkiv’s Tiramisu testnet.
- You install through the skillreg CLI today.
In order of priority
- A
/.well-known/agent-skills/index.jsongateway, so Hermes, Claude Code, Codex andnpx skillsread skillreg with no changes. - Trust lists as Arkiv records you subscribe to, like ad-block filter lists.
- An LLM rater and a sandbox rater, each with a public track record.
- Intents and evals in the record format.
- Gasless publishing for authors who will never hold test tokens.
- Mirrors to git and IPFS by hash.