Validation steps

1. Validate discovery index schema

   Agent Skills index must use $schema https://schemas.agentskills.io/discovery/0.2.0/schema.json.

   Agent Skills discovery index schema is invalid

   Top-level issues

   • $schema must be https://schemas.agentskills.io/discovery/0.2.0/schema.json

   Invalid skills

   [
     {
       "index": 0,
       "valid": false,
       "name": "software-comparison",
       "type": "skill",
       "description": "Compare shortlisted business software products head to head using Findstack data — pricing, features, integrations, ratings and target segments. Use after candidates are identified, when someone asks \"X vs Y\", \"which should I pick\", or \"what's the difference between these tools\".",
       "url": "https://findstack.com/.well-known/agent-skills/software-comparison/SKILL.md",
       "digest": "",
       "resolvedUrl": "https://findstack.com/.well-known/agent-skills/software-comparison/SKILL.md",
       "originClass": "same-origin",
       "missing": [
         "digest"
       ],
       "invalid": [
         "type must be skill-md or archive"
       ],
       "warnings": []
     },
     {
       "index": 1,
       "valid": false,
       "name": "software-discovery",
       "type": "skill",
       "description": "Find and shortlist business software using the Findstack catalog. Use when someone asks what software to use for a job (\"a CRM for a 10-person sales team\", \"open source analytics\", \"project management with a free plan\"), or asks which tools exist in a category.",
       "url": "https://findstack.com/.well-known/agent-skills/software-discovery/SKILL.md",
       "digest": "",
       "resolvedUrl": "https://findstack.com/.well-known/agent-skills/software-discovery/SKILL.md",
       "originClass": "same-origin",
       "missing": [
         "digest"
       ],
       "invalid": [
         "type must be skill-md or archive"
       ],
       "warnings": []
     }
   ]

2. Validate skill entries

   One or more Agent Skills entries have invalid required fields.

   One or more skill entries are invalid

   Skill entry findings

   [
     {
       "index": 0,
       "valid": false,
       "name": "software-comparison",
       "type": "skill",
       "description": "Compare shortlisted business software products head to head using Findstack data — pricing, features, integrations, ratings and target segments. Use after candidates are identified, when someone asks \"X vs Y\", \"which should I pick\", or \"what's the difference between these tools\".",
       "url": "https://findstack.com/.well-known/agent-skills/software-comparison/SKILL.md",
       "digest": "",
       "resolvedUrl": "https://findstack.com/.well-known/agent-skills/software-comparison/SKILL.md",
       "originClass": "same-origin",
       "missing": [
         "digest"
       ],
       "invalid": [
         "type must be skill-md or archive"
       ],
       "warnings": []
     },
     {
       "index": 1,
       "valid": false,
       "name": "software-discovery",
       "type": "skill",
       "description": "Find and shortlist business software using the Findstack catalog. Use when someone asks what software to use for a job (\"a CRM for a 10-person sales team\", \"open source analytics\", \"project management with a free plan\"), or asks which tools exist in a category.",
       "url": "https://findstack.com/.well-known/agent-skills/software-discovery/SKILL.md",
       "digest": "",
       "resolvedUrl": "https://findstack.com/.well-known/agent-skills/software-discovery/SKILL.md",
       "originClass": "same-origin",
       "missing": [
         "digest"
       ],
       "invalid": [
         "type must be skill-md or archive"
       ],
       "warnings": []
     }
   ]

3. Verify advertised artifacts

   No valid skill artifacts were available to verify.

4. Validate skill content

   For skill-md artifacts, include valid YAML frontmatter with name and description followed by Markdown. For archives, include a safe root SKILL.md and no unsafe paths.

5. Review skill artifact security

   Do not publish secrets or prompt-injection instructions in skill artifacts. Treat scripts, archives, and cross-origin artifacts as software supply-chain surfaces.