skills-lock

# skills.lock ## Overview skills.lock is a manifest file that pins every skill in a repository to a specific version with a cryptographic hash. It ensures that consumers of your skills library get exactly what you shipped — no tampering, no drift, no surprises. When a CI pipeline or agent loads skills, it verifies the lock file first. If a hash doesn't match, the skill has been modified and the consumer is warned. This skill covers generating, validating, and maintaining skills.lock. ## Authoritative Foundations - **npm package-lock.json — deterministic dependency resolution** — deterministic dependency resolution - **Cargo.lock (Rust) — version pinning and integrity** — version pinning and integrity - **SHA-256 — cryptographic hash for file integrity verification** — cryptographic hash for file integrity verification ## When to Use Trigger phrases: "generate skills.lock", "create lock file for skills", "freeze skill versions", "verify skill integrity", "lock file for agent skills", "skill dependency lock", "skills.lock validation" ## Step-by-Step Process ### Phase 1: Generate skills.lock **The lock file structure (JSON):** ```json { "version": "1.0.0", "repository": "LeadMagic/gtm-skills", "generated_at": "2026-06-07T18:00:00Z", "generator": "hermes-agent v2026.5.29.2", "total_skills": 172, "skills": { "founder-led/founder-sales": { "version": "1.0.0", "path": "skills/founder-led/founder-sales/SKILL.md", "sha256": "a1b2c3d4e5f6..."...