Skip to main content
An Agent Skill is a folder whose entry point is SKILL.md. It can also contain scripts, references, assets, license terms, and notices. SelfTune distributes that folder as one immutable package; it does not reduce a skill to a database row or a prompt string. The Agent Skills specification defines the package format and allows a license field. It does not define a registry, prove ownership, authorize redistribution, or give a skill owner telemetry. SelfTune applies the additional checks on this page before a package crosses an organization boundary.

​
Where a shared package is stored

SelfTune has two separate distribution systems: A private share does not publish the skill to the Registry. The recipient gets an authorization to the exact sealed Sync & Backup object selected by the sender. Accepting or importing that object does not install it on the recipient’s computer. A Skill Set is a bill of materials. Its package contains the set manifest and identifies every pinned component revision. SelfTune evaluates the license and distribution rights of every component; a curator does not acquire ownership or telemetry rights merely by assembling the set.

​
What SelfTune checks

Before Registry publication, private recipient sharing, workspace distribution, or portable Skill Set export, SelfTune checks the exact revision that will leave its current boundary:
  • the root SKILL.md and complete bounded file manifest;
  • an SPDX license expression, or bundled terms for a LicenseRef or proprietary package;
  • required license and notice files and their hashes;
  • the declared rights holder and the publisher’s channel-specific rights attestation;
  • source provenance and its verification strength; and
  • the final sealed package hash after any declared SelfTune packaging step.
Uploading a private draft or backing up your own package does not assert that you may distribute it. A missing or ambiguous license leaves that revision available for private authoring but marks outward distribution as blocked or requiring manual review.
These checks verify package consistency, evidence, and policy. They do not prove legal ownership or replace legal review for unusual terms.

​
Publisher, rights holder, and signal recipient

SelfTune records three roles independently:
  • Publisher: the account performing the distribution action.
  • Rights holder: the person or organization declared as controlling the work or providing its license.
  • Signal recipient: the SelfTune organization authorized to receive privacy-protected contributor aggregates for that exact distribution.
Package metadata such as an author name or creator UUID does not grant any of these roles. SelfTune issues a version-scoped routing capability after a distribution has been authorized. Changing package bytes, the recipient, or the signal policy requires new authority.

​
What the owner can see

Sharing a skill does not automatically send telemetry to its owner. Recipient actions use separate consent choices: Contributor signals are default-off. When enabled and consented, the capability allows only the disclosed fields, such as bucketed trigger, grade, or miss category signals. Raw prompts, transcripts, files, code, local paths, email, machine identity, and stable user identity are not part of that contract. Installing a skill with SelfTune does not silently enable contributor signals. Desktop asks separately after a successful install. In v1, trusted connected-install credentials are disabled: authentication and a local claim that a token reached Keychain or Credential Manager are not server-verifiable secure-store evidence. Contributor signals therefore remain off or use the separate, explicitly weaker portable_unverified path when consented. Revoking consent stops new contributor signals. Revoking the distribution or its routing capability also stops new accepted events without rewriting the historical license and authorization audit trail.

​
Recipient choices

Terms that require identity-bearing acceptance can require sign-in before Download. The preview explains this before the action. SelfTune never installs itself or a shared skill merely because you opened a claim link. Importing a Set into Desktop is separate from applying it to an agent or project. Applying it shows the planned target paths and conflicts and starts only after your final confirmation. See Publish or share a skill for sender and recipient journeys, and Privacy and permissions for the consent boundaries.