@xiashe/agent-skill

Shell-capable external Agents can use this CLI to claim a XiaShe one-time feed token, check the account-level entitlement, receive a protected local Skill package, and confirm status without exposing runtime tokens or Relay details to the end user.

For persistent install cards, the CLI stores the runtime session locally at ~/.xiashe/agent-skill-sessions.json with 0600 permissions. Once a Skill package is delivered, it saves the protected archive to ~/.xiashe/skills, verifies the supplied SHA-256 when available, then safely unpacks regular files into a private versioned directory and verifies that SKILL.md exists. It rejects unsafe paths, links, unsupported tar entries, and oversized archives. The CLI never executes package scripts: inspect and follow the installed SKILL.md yourself. One-shot cards should pass --no-save.

Usage

npx -y --package @xiashe/agent-skill xiashe-agent-skill claim "<one-time-token>" \
  --claim-url "https://actions.xiashe.chat/mcp/xiashe/claim" \
  --mcp-url "https://actions.xiashe.chat/mcp/xiashe" \
  --agent-name "My Agent"

The command retrieves, verifies, safely unpacks, and installs the complete Skill package for the current Agent by default. It prints an explicit local-delivery result so the Agent can tell the user that the full Skill is available locally before it starts using it. It never prints the runtime token.

For a temporary one-shot session:

npx -y --package @xiashe/agent-skill xiashe-agent-skill claim "<one-time-token>" --no-save

To choose a different private archive directory, pass --package-dir <path>. --no-package-save is diagnostic-only: it deliberately leaves the Skill undelivered and does not acknowledge or install it.

Each Agent needs a fresh XiaShe claim card; never copy a runtime token or temporary package URL to another Agent. A paid entitlement belongs to the same XiaShe account, so a second Agent claim for that account does not create a second purchase.

Red capability delivery fallback

Protected Red Skills start directly from the fixed four-field request into the bounded XiaShe MCP tool flow. Payment stays in the MCP response: the current Agent shows its purchase details, waits for explicit confirmation, and runs only that response's existing official local wallet bridge. This package does not preflight, start, poll, or otherwise mediate a payment.

Most hosts should verify and unpack the protected package themselves after MCP confirms the entitlement. A shell host may use this delivery-only fallback only after xiashe.skill_status says paidAccess.canReadPrompt=true:

printf '%s' '<private-start-response-json>' | \
  npx -y --package @xiashe/[email protected] xiashe-agent-skill access deliver \
  --access-origin "https://<bound-registry-origin>" --stdin --json

Pass the complete start response on standard input from the current Agent’s private memory. The helper checks only its fixed MCP tool allowlist, downloads the protected package only when MCP confirms access, verifies its SHA-256, safely unpacks it, reads SKILL.md, then acknowledges receipt. It never saves the runtime token or creates an access-reference state machine. If MCP still reports paymentRequired, it returns a safe message and does not touch the wallet. An HTTP success from the start request is never an entitlement or package-delivery result.

For host compatibility, access deliver accepts the standard --session-file and --package-dir options when a shell host adds them automatically. It deliberately ignores them, so a host cannot redirect protected delivery through a generic local path.

For local testing before npm publish:

node packages/xiashe-agent-skill/bin/xiashe-agent-skill.mjs claim "<one-time-token>"

This package is the small, token-safe feed installer for Agents. For the broader XiaShe command surface, use:

node packages/xiashe-cli/bin/xiashe.mjs skills claim "<one-time-token>"
node packages/xiashe-cli/bin/xiashe.mjs agent connect --token "<agent-connect-token>"