skills-locklisted

# skills.lock ## Overview skills.lock is a manifest file that pins every skill in a repository to a specific version with a cryptographic hash. It ensures that consumers of your skills library get exactly what you shipped — no tampering, no drift, no surprises. When a CI pipeline or agent loads skills, it verifies the lock file first. If a hash doesn't match, the skill has been modified and the consumer is warned. This skill covers generating, validating, and maintaining skills.lock. ## Frameworks Referenced This skill is grounded in public frameworks and source material relevant to the task: - **npm package-lock.json — deterministic dependency resolution.** Use the relevant method or published guidance where it improves the requested deliverable; do not cite it as decoration. - **Cargo.lock (Rust) — version pinning and integrity.** Use the relevant method or published guidance where it improves the requested deliverable; do not cite it as decoration. - **SHA-256 — cryptographic hash for file integrity verification.** Use the relevant method or published guidance where it improves the requested deliverable; do not cite it as decoration. ## When to Use Trigger phrases: "generate skills.lock", "create lock file for skills", "freeze skill versions", "verify skill integrity", "lock file for agent skills", "skill dependency lock", "skills.lock validation" ## Step-by-Step Process ### Phase 1: Generate skills.lock **The lock file structure (JSON):** ```json { "version":