Vectle/skills

Public engineering guidance from Vectle, mirrored automatically for agent skill discovery and installation. Vectle remains the canonical source; every skill links to its source page and preserves its immutable version ID and public contributor attribution.
## Browse and install
Browse the live catalog or the generated skills.json index. Skills use stable installation-name directories under skills/; names include a short source-ID digest so identical titles remain distinct. Directory names and frontmatter follow the Agent Skills specification.
sh
npx skills add Vectle/skills --list
npx skills add Vectle/skills --skill
See the installer documentation. Select the guidance you need; this repository can contain thousands of skills.
## Automatic sync
Sync public skills runs daily at 07:37 UTC, and can be run manually from Actions. Scheduled and push-triggered runs use two artifact workers. Manual dispatch defaults to two and offers one through four; the command-line --workers option has the same default and bounds. GitHub may delay scheduled runs. A small sync-status.json receipt records each month's successful catalog check, keeping the repository active even during quiet periods so GitHub's 60-day schedule-inactivity rule does not disable the sync. See GitHub's schedule behavior.
The publisher reads the supported /exports/skills/v1/catalog representation. The backend owns eligibility, stable installation names and exact immutable-version SKILL.md bytes. Search ranking and sitemap inclusion do not define distribution. The publisher accepts schema 1, artifact format 2, policy public-service-distribution-1 and the frozen compatibility name-map revision. An incompatible revision stops publication until its consumer has been reviewed.
Every metadata page must belong to one snapshot, with unique ordered IDs and install names, the expected total and the exact rolling digest. Only the signed terminal certificate permits artifact fetching. The publisher downloads changed, missing or locally corrupt artifacts with two workers by default, checks exact SHA-256 and Agent Skills provenance/frontmatter, and stages them outside the repository. It copies the server's bytes without reconstructing the authored body. A title edit keeps its installation name. Format 2 preserves original public attribution and notices; it deliberately replaces format 1's artifact hashes while preserving install paths.
Immediately before publication, the publisher submits the complete ordered signed claims to the metadata-only admission validator. This rechecks current eligibility and original rights inputs even for unchanged local files. An ordinary newer skill version does not invalidate the pinned dated snapshot. A new restriction stops adoption. Catalog enumeration and final admission validation each restart at most three times on generation drift. Each request has a 30-second aggregate deadline, five attempts, a 2 MiB JSON/256 KiB artifact limit and bounded Retry-After/backoff of at most 120 seconds. The whole job is limited to 300 minutes; expired snapshots or exhausted retries fail honestly.
Publication uses one non-force Git commit/push containing files and index. The branch must still equal the expected starting commit, its published source generation cannot be newer, and the final receipt must be less than five minutes old when pushing. Concurrent branch advancement or push rejection stops the run. A fresh rerun reconciles current main; it never force-pushes or restores old generated files. Failed/interrupted reads, malformed/incomplete pages and checksum mismatches leave the remote valid catalog intact. Only paths owned by the previous validated manifest may be removed. Hand-maintained neighboring files are retained.