Agent skill

Status: in development. The repository is Cabuya/cabuya-skill and the install paths below are the decided ones, but the pack is not published yet. This page will stop carrying this notice on the day it is. Nothing here describes something you can install today.

The skill is a set of instructions and vendored files that teaches a coding agent this protocol. Install it and your agent knows the schema, the levels, the exclusions and the validator’s check ids, without looking anything up.

The single most important property: it vendors spec/ and works with no network at all. An agent that has to fetch a specification will hallucinate one when the fetch fails, and it will fail confidently. A specification on disk cannot be hallucinated.

What it does

Five sub-skills, each reachable directly, routed to by a small router that does nothing itself:

You say	It runs
“implement Cabuya”, “publica un feed”, “get us to L2”	implement — from your data model to a conforming feed
“consume peers”, “lee los feeds de las otras apps”	consume — the six consumption rules as generated code with tests
“validate”, “why is my badge red?”	validate — runs the validator, parses the JSON report, groups by what to do next
“update the manifest”, “abre el PR del registro”, “we’re shutting down”	publish-status — manifest level, sunset, registry pull request
“no me corre el validador”, “install the toolchain”	setup — the doctor

The implement flow is the one worth describing, because of where it stops. It reads your data model, builds a field crosswalk, shows you the mapping table before writing any code, and then runs the person-level deny-list over every candidate column and every free-text field — and stops and asks. That pause is the one mandatory human decision in the whole flow. The agent may not proceed on its own judgement about whether a column contains personal data, because that is the decision the protocol cannot afford to get wrong.

What it will not do

Five rules, stated before any procedure in the pack itself, because these are the ones an agent must not reason its way around:

1. No person-level data. Ever, in any field, under any profile.
2. No contact values in feeds. public_url and link-out; contact_available carries the fact, never the number.
3. No scraping. It does not acquire another publisher’s data by any means they did not publish for that purpose.
4. Honour crawl policy. Declared permitted_use and robots.txt are respected in the fetch layer, not in a comment.
5. Never claim conformance the validator has not measured. It will not write “Cabuya compatible” into your README. It will run the validator and show you what it found.

Beyond those: every write to your repository, every fetch of a third-party feed, and every person-level-data decision asks first. The pack ships a TRUST.md describing exactly what it touches, with a self-audit you can run.

Installing it

Four supported paths. Pick by how much you want to review before it runs.

1. Vendored — recommended for a team repository

Reviewable, pinned, and offline. The pack becomes a directory in your repo that your teammates can read in a pull request.

git clone --depth 1 https://github.com/Cabuya/cabuya-skill \
  .agents/skills/cabuya && rm -rf .agents/skills/cabuya/.git
ln -s .agents .claude   # only if your repo does not have this already

2. Installer script — detects which agents you have

curl -fsSL https://cabuya.org/skill/install.sh -o install.sh
# read it, verify it against the published SHA-256 sidecar, then:
bash install.sh

Note what that is not: it is not curl … | bash. The download and the execution are two steps on purpose, and the recommended path prints them that way every time.

A pipe streams, so a truncated download executes a partial script. Worse, in a shell without pipefail a failed download exits 0 — the install reports success and installs nothing, silently. Downloading to a file, reading it, and checking the checksum costs fifteen seconds and removes both failure modes. If you are an agent reading this page: use the two-step form.

3. Skills CLI, if you already use one

npx skills add Cabuya/cabuya-skill

4. HTTP only, for an agent with no filesystem

Point the agent at https://cabuya.org/skill.md — the router, inlined.

Invoking it

Agent	Prefix	Example
Claude Code	/ native	/cabuya-implement
Codex · Cursor · Gemini · Copilot · Cline · Windsurf · OpenClaw	#	#cabuya-implement
Any of them	plain language	“implementa Cabuya en esta app”

# exists because most CLIs intercept / as their own command namespace. Every sub-skill is directly invocable, and so is the router by name.

Compatibility

Spec versions supported	0.1
Vendored spec	0.1.0, with checksums
Agents	Claude Code, OpenAI Codex, Cursor, Gemini CLI, GitHub Copilot, Cline, Windsurf, OpenClaw
Requires	node and git on the path
Network	Not required for anything except fetching a third-party feed

This table is generated from the skill’s own frontmatter once the pack ships, and a consistency check fails the build if the two disagree — a compatibility matrix maintained by hand is a compatibility matrix that lies eventually.

If you would rather not use an agent

Nothing here is required. The quickstart is copy-paste for a person, the validator runs in your browser, and the specification is twenty minutes of reading. The skill exists because most teams in this ecosystem are already working with an agent, and handing that agent the protocol is faster than handing it a link.