Skip to content
SkillPact
日本語
Public review open: 2026-10-22 – 2026-11-21 (JST). How to comment (REVIEW.md) · Tracking issue

Contracts for Agent Skills

SkillPact is a small open standard for a skill.contract.json that sits next to an unchanged SKILL.md. The author declares every side effect, ships tests that run without network, and signs the files. Harnesses read it before install.

Read the specification →Why it existsChecker

Status
Working draft 0.8. Not yet 1.0; breaking changes are possible.
Contract schema
v0.8.json
Policy schema
policy-v0.8.json
Editor
Shogo Kajiyama (SEVENTHWELL)
License
Text CC BY 4.0 · code Apache-2.0
skill.contract.jsonL3
{
  "contract_version": "0.8",
  "skill": { "name": "thumbnail-skill", "version": "0.1.0" },
  "permissions": {
    "read":    { "level": "scoped", "scope": ["$INPUT", "$SKILL_DIR/**"] },
    "write":   { "level": "scoped", "scope": ["$OUTPUT"] },
    "network": { "level": "none" },
    "exec":    { "level": "scoped", "scope": ["python3", "ffmpeg"] },
    "spend":   { "level": "none" },
    "send":    { "level": "none" }
  },
  "capabilities": [ … 5 tools … ],
  "tests": { … },
  "integrity": { … }
}
Excerpt of a real contract (thumbnail-skill, L3); “why” fields omitted. The six effect classes are always present; “none” is a statement, not an omission.

Six effect classes

Every tool in a skill declares what it may do, in these six classes, each with a level (none, scoped, any) and a scope.

ClassMeaningScope syntax
readRead files or datapath glob
writeCreate, change, deletepath glob, remote:<host>/<path>
networkTalk to other hostshost glob, @local
execRun other programscommand name
spendCost moneyservice name
sendReach a person (message, post, mail)recipient kind / service name

Three levels

A level is a statement about evidence, not about safety. L3 means the files are the ones the author signed; it does not mean the skill is harmless.

  1. L1DeclaredA schema-valid contractWhat the author says it does
  2. L2TestedL1 + conformance tests pass in a sandbox: read-only files, no network but declared hosts, only declared programsThe declaration was exercised
  3. L3SignedL2 + file hashes and a trusted ed25519 or Sigstore signatureWho vouches, and that nothing changed since

Where it sits

SkillPact covers the moment before install: a harness reads the contract, compares it with your policy and decides allow, ask or deny. The same policy compiles to Claude Code, Cursor, Codex and Gemini CLI permission settings. Enforcement while the skill runs is left to runtime systems such as APS, ACS and HushSpec; an export to HushSpec and Rego is provided.

From the command line
$ skillpact conformance ./my-skill
$ skillpact policy-compile ./my-skill policy.json --target claude-code
$ skillpact convert ./my-skill --to mda

Documents