For teams whose Claude Code sessions run skills they did not write

Your agent obeys a folder of text. Anyone who can edit it decides what your agent does.

The checking half runs inside Claude Code today — it reads what Claude Code installed and puts back what changed. Signing and publishing are just files, so they are not tied to any one agent.

A skill is instructions on disk. Change a line and the agent follows the new line — no install, no restart, nothing on screen. Axela signs the folder, and your machine checks it before every session. If the bytes changed, the approved version goes back and you get told. That is the whole product.

Protect this machine Publish skills

Running skills someone else wrote needs no account — it is the first button, and it is free. Publishing them to other people's machines is the second, and that is invite-only while we are in beta.

What it looks like from your chair

1 Someone publishes

On their own laptop they sign a list of every skill file and its fingerprint — that list is the catalog. They commit it, and a CI job only hands it to us. The signing key never leaves the laptop, so a CI job that is edited, or leaked, publishes nothing.

2 We read it, then sign it

We download the repository, check it really contains the bytes the catalog claims, and look at what the skills do. If a script pipes a download into a shell, we refuse. Only then does our signature go on.

3 Your machine checks, every session

Before your agent starts, it compares each skill against the signed record. Same bytes, nothing happens. Different bytes, the approved version goes back and a report is filed. You do nothing.

Two signatures, and your machine wants both. Whoever steals the publisher's key cannot publish, because we would not sign it. Whoever takes ours cannot either, because the publisher's is missing. You decide how many signatures to require — we cannot lower it.

Let your agent set it up

Two names, and they are two things. SkillTrust is the open-source part that runs on your machine and does the checking — you install that. Axela is this service: the second signature, and somewhere for your machines to report. You point one at the other.

Signing, pinning and thresholds are worth understanding — and you should not have to before you can use this. Both halves speak MCP, so the agent already in your terminal can do the whole thing.

# the binary first. Homebrew on macOS/Linux; the GitHub release zip otherwise.
brew install random1st/tap/skillctl

# the machine side: keys, pins, subscriptions, the session hook
claude mcp add skilltrust -- skilltrust-mcp

# the account side: register an organisation, read your dashboard, rotate a token
claude mcp add --transport http axela https://axela.app/mcp

Then say "set up SkillTrust on this machine". The server reports what is already configured and names the next step, so the agent is not guessing an order — and every dangerous default is decided here, not there: it pins the notary as one signer and requires every signer to sign.

Or type it yourself

# skillctl is the release binary, not the plugin. Homebrew on macOS/Linux.
brew install random1st/tap/skillctl
# notary.pub is ours. The publisher sends you theirs — do not make your own.
curl -sO https://notary.axela.app/notary.pub
skillctl subscribe https://github.com/them/skills \
  --catalog https://notary.axela.app/v1/catalogs/their-org/their-skills \
  --key their-publisher.pub --notary-key notary.pub
skillctl sync          # check now: restore anything changed
skillctl hook install --apply  # and check again before every session

Nothing above needs an account. The publisher gives you their public key file and the catalog URL; everything else is on your machine. If you are the one publishing, that is the other path — register an organisation.

The one question everyone asks

"So does this mean a skill is safe?" No, and it is worth being exact about it. A signature proves who published bytes and that they have not changed since. It says nothing about whether those bytes are a good idea.

What narrows that gap is the scan. Before signing, we read every skill and refuse the ones whose executable files do something the reader would not expect. What a skill says never blocks it — we measured that: a scanner matching strings across eleven curated skills refused four, and all four were documentation. A security skill was refused for containing the address it teaches you to block. So prose is reported for a person to read, and behaviour is what stops a publication.

What we never hold

Your publisher's private key stays on the machine that made it. We hold its public half, so a catalog it did not sign is refused — by us, and again by every machine that pinned it. We hold no signing key that could put your name on anything.

Self-host instead

notaryd is the same code under Apache-2.0. Running your own means nobody outside your organisation sees which marketplaces you publish or what your machines report. Axela exists because most people would rather not run one.