---
name: check-your-published-index
description: >-
  Checks a site's own /.well-known/agent-skills/index.json against the Agent
  Skills Discovery format and reports what would stop a browser using it. Use
  it when someone has published skills on their own domain and wants to know
  whether agents can actually see them.
runtime: browser
permissions:
  - page:read
  - navigate
  - network:read
scope:
  - https://skills.skylarkbrowser.com/*
triggers:
  - kind: url_pattern
    pattern: https://skills.skylarkbrowser.com/publish
  - kind: intent
    description: check my agent skills index
  - kind: intent
    description: why are my skills not being discovered
  - kind: intent
    description: validate my well-known skills file
version: 1.0.0
---

# Check a published index

A site that publishes its own index is authoritative for itself, which means
nobody else can fix it when it breaks. This is the check to run before assuming
the browser is at fault.

You need to read response headers as well as bodies, because two of the
commonest failures are invisible in the JSON: a wrong content type and a
missing CORS header.

## Fetch it

1. Request the index at the exact path the standard specifies:

   ```
   GET https://{their-host}/.well-known/agent-skills/index.json
   ```

2. Check the response before the body:

   - **Status.** A 404 means it is not published where agents look. A redirect
     to a login page means it is behind auth and no agent will ever read it.
   - **Content type.** It should be `application/json`. A file served as
     `text/plain` or `text/html` is a common outcome of dropping JSON into a
     static host without configuring it.
   - **CORS.** `access-control-allow-origin` needs to permit a cross-origin
     read. Without it the file exists and no browser can use it.

## Check the shape

3. The document needs `$schema` and a `skills` array. Each entry needs `name`,
   `type`, `description`, `url` and `digest`.

4. Go through the fields that fail quietly:

   - **`runtime`.** It defaults to `repo`, meaning a coding agent. A browser
     ignores anything that is not `browser`. This is the single most common
     reason a correct-looking index does nothing, so check it first.
   - **`url`.** Must be absolute and must actually serve the artifact. Fetch
     one and confirm it returns the markdown rather than an HTML error page.
   - **`digest`.** Must be the SHA-256 of the exact bytes at that URL. If it
     was written by hand it is probably already stale, because editing a skill
     without recomputing the digest is the easiest mistake in the format. Use
     `verify-artifact-digest` to check one properly.
   - **`scope`.** URL patterns decide where the skill may act. An entry with no
     scope is not scoped to everything; it is a skill a cautious client may
     decline to run at all.
   - **`permissions`.** Only the seven documented verbs mean anything. An
     invented one is dropped rather than honoured, and dropping it silently
     changes what the skill can do.

## Report it usefully

5. Lead with whether an agent could use this index today, yes or no.

6. Then list what is wrong, most consequential first, with the fix beside it.
   "`runtime` is missing, so browsers skip every entry; add `runtime: browser`"
   is useful. "Schema validation failed" is not.

7. If it is fine, say so without inventing improvements. A correct index does
   not need advice.

## Where you stop

8. You are reading someone's published files and reporting on them. Do not
   offer to change anything on their server, and do not suggest submitting
   their skills to this directory as a workaround. If their own index works,
   that is the better arrangement, and it is the one we recommend on `/publish`.