Publish a signed skill

1. Sign it

# get the CLI and make a keypair (once):
curl -fsSLO https://skillx.md/skillx.py
python3 skillx.py keygen --out signing.pem --pub-jwk signing.jwk

# sign your SKILL.md — kid points at YOUR domain:
python3 skillx.py sign --key signing.pem \
  --kid "did:web:example.com#skills-2026" \
  --url "https://example.com/SKILL.md" SKILL.md

Keep signing.pem secret (a password manager or vault). Everything else is public.

2. Host three files on your domain

https://example.com/SKILL.md                  # the skill (unchanged by signing)
https://example.com/SKILL.md.sig              # the signature sidecar
https://example.com/.well-known/did.json      # your public key document

Minimal did.json — paste your JWK from step 1 into publicKeyJwk:

{
  "@context": ["https://www.w3.org/ns/did/v1",
               "https://w3id.org/security/suites/jws-2020/v1"],
  "id": "did:web:example.com",
  "verificationMethod": [{
    "id": "did:web:example.com#skills-2026",
    "type": "JsonWebKey2020",
    "controller": "did:web:example.com",
    "publicKeyJwk": { "kty": "EC", "crv": "P-256", "x": "…", "y": "…" }
  }],
  "assertionMethod": ["did:web:example.com#skills-2026"]
}

Check your work — this must print VERIFIED:

python3 skillx.py verify --scan https://example.com/SKILL.md

Keep it verified on every push — the same check as a one-line GitHub Action:

- uses: The-Holding-Company/skillx-action@v1
  with:
    skill-url: https://example.com/SKILL.md

3. Submit it — one URL

Prefer GitHub? The form above and the routes below all land in the same verified pipeline:

1. Open a Submit a skill issue on the public registry — paste your skill URL. Automation re-verifies the signature against your live URL, runs a content scan, and opens the registry pull request for you. A maintainer review is the final gate; merge = listed.
2. Prefer raw git? PR skillx-registry directly: one entry in the registry, one appended line in the transparency log — CI re-verifies every entry either way. No GitHub? Email hello@holdingco.com with the URL and we run the same steps.
3. Optional: become a Verified Publisher ($9/yr founding) — identity-checked badge on every listing, linked across the User Agency Web.

4. Verify in CI (optional)

Gate your own repo so an unsigned or tampered skill never ships. The skillx GitHub Action runs the same verifier — INVALID fails the build; UNSIGNED does too unless you opt in.

# .github/workflows/verify-skill.yml
- uses: The-Holding-Company/skillx-action@v1
  with:
    skill-url: https://example.com/SKILL.md

Ground rules: a signature proves who published, never that content is safe — we scan, and listings that fail re-verification are pulled and annotated in the log, not silently deleted. Spec: spec.md · CLI + spec source: github.com/The-Holding-Company/skillx.