RFC: Remote Agent Skills - URL-based Skill Import

RFC: Remote Agent Skills - URL-based Skill Import

Summary

This RFC proposes extending the Agent Skills format to support remote skill import via URLs, allowing agents to discover and load SKILL.md files hosted on remote servers without requiring local file copies.

Motivation

Currently, Agent Skills are loaded from local directories. While this works well for bundled skills, it creates friction for:

1. Sharing skills - Users must manually copy skill directories
2. Versioning - No standard way to update skills from a source
3. Discovery - No mechanism to browse and import community skills
4. Dependencies - Skills can't reference other remote skills

Proposal

Remote Skill URLs

Allow skills to be imported from URLs:

# In agent configuration or via CLI
skills:
  - https://skills.example.com/pdf-processing/SKILL.md
  - github:anthropics/skills/code-review
  - npm:@agentskills/data-analysis

URL Schemes

Well-Known Discovery

Skill hosts can expose a discovery endpoint at /.well-known/agent-skills.json:

{
  "version": "1.0",
  "skills": [
    {
      "name": "pdf-processing",
      "description": "Extract text and tables from PDF files",
      "url": "/pdf-processing/SKILL.md",
      "version": "1.2.0"
    },
    {
      "name": "code-review", 
      "description": "Automated code review with best practices",
      "url": "/code-review/SKILL.md",
      "version": "2.0.1"
    }
  ]
}

Import Command

Add an import command to skill-compatible agents:

# Import a remote skill
claude skills import https://skills.example.com/pdf-processing

# Import from GitHub
claude skills import github:anthropics/skills/code-review

# List imported remote skills
claude skills list --remote

# Update all remote skills
claude skills update

Caching

Remote skills should be cached locally with cache invalidation based on:

• Cache-Control headers
• ETag/Last-Modified for conditional requests
• Manual refresh via skills update

Security Considerations

1. Trust model - Prompt user before importing from untrusted sources
2. Content verification - Optional signature verification for skills
3. Sandboxing - Remote skills with scripts/ should require explicit approval
4. Rate limiting - Respect rate limits when fetching skills

SKILL.md Extension: Dependencies

Add optional dependencies field for skills that require other skills:

---
name: full-stack-dev
description: Full stack development assistance
dependencies:
  - github:anthropics/skills/code-review
  - github:anthropics/skills/testing
---

Registry (Optional)

A public registry for discovering community skills:

GET https://registry.agentskills.dev/search?q=pdf

{
  "results": [
    {
      "name": "pdf-processing",
      "author": "anthropics",
      "url": "github:anthropics/skills/pdf-processing",
      "stars": 245,
      "downloads": 1200,
      "verified": true
    }
  ]
}

Implementation Notes

For Skill Authors

No changes required to SKILL.md format. Simply host the skill directory on any HTTP server or git repository.

For Agent Implementers

1. Add URL resolution for skill paths
2. Implement caching layer for remote skills
3. Add trust prompts for new remote sources
4. Support /.well-known/agent-skills.json discovery

Open Questions

1. Should there be a central registry, or federated discovery?
2. How should skill versioning work? (semver in URL vs. metadata?)
3. Should remote skills be able to include scripts/ by default?
4. Authentication for private skills?

Related Work

• MCP Remote Servers - Remote tool hosting
• npm packages - Package distribution model
• GitHub Marketplace - Discovery and trust model

Feedback welcome! What use cases would remote skills enable for you?