skills.lock

Overview

skills.lock is a manifest file that pins every skill in a repository to a specific version with a cryptographic hash. It ensures that consumers of your skills library get exactly what you shipped — no tampering, no drift, no surprises. When a CI pipeline or agent loads skills, it verifies the lock file first. If a hash doesn't match, the skill has been modified and the consumer is warned. This skill covers generating, validating, and maintaining skills.lock.

Authoritative Foundations

• npm package-lock.json — deterministic dependency resolution — deterministic dependency resolution
• Cargo.lock (Rust) — version pinning and integrity — version pinning and integrity
• SHA-256 — cryptographic hash for file integrity verification — cryptographic hash for file integrity verification

When to Use