{
  "markdown": "# Skills\n\n[![Install with skills CLI](https://img.shields.io/badge/install-npx%20skills%20add%20indykite%2Fskills-000000?style=for-the-badge&logo=npm&logoColor=white)](https://www.skills.sh/indykite/skills)\n\nA collection of skills for coding agents that work with [IndyKite](https://indykite.ai) — graph-based identity, authorization, and AI-agent integration.\n\nA **skill** is a self-contained bundle of instructions (and optionally scripts, references, or assets) that an agent loads on demand to perform a specialized task.\n\n## Contents\n\n- [Glossary](#glossary)\n- [Skills in this repo](#skills-in-this-repo)\n- [Install](#install)\n- [Bundle install](#bundle-install)\n- [Supported agents](#supported-agents)\n- [How skills activate](#how-skills-activate)\n- [Authoring a skill](#authoring-a-skill)\n- [Resources](#resources)\n- [Contributing and security](#contributing-and-security)\n\n## Glossary\n\nAcronyms used throughout the skills, defined once here.\n\n- **IndyKite** — the company behind these skills. UI at [eu.hub.indykite.com](https://eu.hub.indykite.com/) / [us.hub.indykite.com](https://us.hub.indykite.com/); REST API at `openapi.indykite.com`; docs at [developer.indykite.com](https://developer.indykite.com/).\n- **IKG** — IndyKite Graph; the graph database holding identity, relationships, and properties for a project.\n- **CIQ** — ContX IQ; an IndyKite context authorization policy plus its Knowledge Query, executed via `POST /contx-iq/v1/execute`.\n- **Knowledge Query** — the parameterised read/write definition CIQ runs against the IKG.\n- **AuthZEN** — IndyKite's policy-decision endpoint (`authzen_evaluate`).\n- **IAG** — IndyKite Agent Gateway; enforces caller, workflow, and delegation-chain checks in front of A2A agents or MCP servers.\n- **A2A** — agent-to-agent; one autonomous agent calling another.\n- **MCP** — Model Context Protocol; the IndyKite MCP server exposes AuthZEN and CIQ tools to MCP-aware agents.\n\n## Skills in this repo\n\nEach row is one skill — what it does and a representative prompt it's *designed* to handle. **Activation isn't guaranteed**: which skill actually fires depends on the agent's matching algorithm, the model, and what else is installed. Verify routing in your own setup before relying on it.\n\n| Skill | What it does | Example prompt |\n|:------|:-------------|:---------------|\n| [`indykite-agent-gateway`](indykite-agent-gateway/SKILL.md) | Deploy and configure IAG in front of an A2A agent or MCP server to enforce caller, workflow, and delegation-chain checks. | \"Put IAG in front of my MCP server so every call is authorized before it reaches it, and wire up the workflow in the IKG.\" |\n| [`indykite-mcp-server`](indykite-mcp-server/SKILL.md) | Make AuthZEN/KBAC authorization decisions and run ContX IQ Knowledge Queries from an AI agent over the Model Context Protocol — initialize a session, list tools, call the AuthZEN and CIQ tools — and configure the MCP endpoint for a project. | \"How do I initialise an MCP session against `eu.mcp.indykite.com` and call `authzen_evaluate`?\" |\n| [`indykite-capture-upsert-nodes`](indykite-capture-upsert-nodes/SKILL.md) | Build the request body for the Capture API batch node upsert (`POST /capture/v1/nodes`) — entities with properties, metadata, and external-data references. | \"Add these people and cars to the IKG, with verified email metadata.\" |\n| [`indykite-capture-upsert-relationships`](indykite-capture-upsert-relationships/SKILL.md) | Build the request body for the Capture API batch relationship upsert (`POST /capture/v1/relationships`) — typed connections between existing nodes. | \"Link `millicent` `OWNS` `kitt` and `ryan` `CAN_DRIVE` `kitt`.\" |\n| [`indykite-capture-delete-nodes`](indykite-capture-delete-nodes/SKILL.md) | Build the request body for the Capture API batch node delete (`POST /capture/v1/nodes/delete`) — remove whole nodes by `external_id` + `type`. | \"Delete the test `Person` and `Car` nodes from the graph.\" |\n| [`indykite-capture-delete-node-properties`](indykite-capture-delete-node-properties/SKILL.md) | Build the request body for the Capture API node-property delete (`POST /capture/v1/nodes/properties/delete`) — strip named properties, keep the node. | \"Drop the `email` property from `millicent`.\" |\n| [`indykite-capture-delete-node-property-metadata`](indykite-capture-delete-node-property-metadata/SKILL.md) | Build the request body for the Capture API property-metadata delete (`POST /capture/v1/nodes/properties/metadata/delete`) — strip provenance fields, keep the value. | \"Remove the `assurance_level` metadata from `millicent`'s `name` property.\" |\n| [`indykite-capture-delete-relationships`](indykite-capture-delete-relationships/SKILL.md) | Build the request body for the Capture API batch relationship delete (`POST /capture/v1/relationships/delete`) — disconnect nodes, keep them. | \"Remove the `CAN_DRIVE` link between `ryan` and `kitt`.\" |\n| [`indykite-capture-delete-relationship-properties`](indykite-capture-delete-relationship-properties/SKILL.md) | Build the request body for the Capture API relationship-property delete (`POST /capture/v1/relationships/properties/delete`) — strip properties from an edge, keep the edge. | \"Drop the `status` property from `millicent`'s `OWNS` edge.\" |\n| [`indykite-data-schema`](indykite-data-schema/SKILL.md) | Read the project's observed IKG schema (`GET /data-schema/v1/`) - node types, properties with value-type tallies, labels, and relationship combinations as JGFv2, without the data itself. | \"What does our IKG look like - which node types, properties, and relationships exist?\" |\n| [`indykite-authzen-kbac-policies`](indykite-authzen-kbac-policies/SKILL.md) | Author and manage a KBAC authorization policy (subject, actions, resource, Cypher condition) through the Config API — create, read, list `?type=kbac`, update, delete. The home of KBAC policy authoring. | \"Write a policy letting a `Person` `PROVISION` a `Server` when its cost is within a budget, and publish it.\" |\n| [`indykite-authzen-evaluation`](indykite-authzen-evaluation/SKILL.md) | Make a single KBAC decision via the AuthZEN REST API (`POST /access/v1/evaluation`) — one yes/no answer for a `(subject, action, resource)` triple. | \"Can `ada` `PROVISION` the server `gpu-node-7` with a budget of 120000?\" |\n| [`indykite-authzen-evaluations`](indykite-authzen-evaluations/SKILL.md) | Run many KBAC decisions in one call (`POST /access/v1/evaluations`) with top-level defaults overridden per entry. | \"Of these servers, which can `grace` provision with a budget of 80000?\" |\n| [`indykite-authzen-search-action`](indykite-authzen-search-action/SKILL.md) | List the actions a subject may perform on a resource (`POST /access/v1/search/action`). | \"What can `linus` do with the server `gpu-node-7`?\" |\n| [`indykite-authzen-search-resource`](indykite-authzen-search-resource/SKILL.md) | List the resources a subject may act on, given an action (`POST /access/v1/search/resource`). | \"Which servers can `linus` provision with a budget of 4000?\" |\n| [`indykite-authzen-search-subject`](indykite-authzen-search-subject/SKILL.md) | List the subjects allowed an action on a resource (`POST /access/v1/search/subject`). | \"Who can provision the server `gpu-node-7` with a budget of 80000?\" |\n| [`indykite-ciq-read`](indykite-ciq-read/SKILL.md) | Author a read-only CIQ policy and Knowledge Query, then run it via `POST /contx-iq/v1/execute`. | \"Expose `Person`-`OWNS`-`Car` as a parameterised read query through ContX IQ.\" |\n| [`indykite-ciq-create-node`](indykite-ciq-create-node/SKILL.md) | Author a CIQ policy + Knowledge Query that creates a brand-new node in the IKG. | \"Create a new `Track` node in the IKG with `title` and `loudness`, via CIQ.\" |\n| [`indykite-ciq-create-relationship`](indykite-ciq-create-relationship/SKILL.md) | Author a CIQ policy + Knowledge Query that creates a brand-new relationship between two existing nodes. | \"Add a `PLAYED_AT` relationship between an existing `Track` and an existing `Venue`.\" |\n| [`indykite-ciq-create-node-with-link`](indykite-ciq-create-node-with-link/SKILL.md) | Author a CIQ policy + Knowledge Query that creates a new node AND links it to one or more existing nodes in a single atomic execute. | \"Create a new `Contract` and atomically link it to an existing `Vehicle` and `Person`.\" |\n| [`indykite-ciq-add-property`](indykite-ciq-add-property/SKILL.md) | Author a CIQ policy + Knowledge Query that sets one or more properties on an existing node. | \"Let a `Person` update their own `music_mood` property.\" |\n| [`indykite-ciq-add-relationship-property`](indykite-ciq-add-relationship-property/SKILL.md) | Author a CIQ policy + Knowledge Query that sets one or more properties on an existing relationship. | \"Annotate an existing `PLAYED_AT` relationship with a `verified` flag and timestamp.\" |\n| [`indykite-ciq-delete`](indykite-ciq-delete/SKILL.md) | Author a CIQ policy + Knowledge Query that deletes a node, a relationship, or one or more properties. | \"Clear the `music_mood` property from a `Person` — GDPR-style erase.\" |\n\n## Install\n\nThe recommended path is the [`skills`](https://skills.sh) CLI — one command, many agents. The CLI knows the per-agent install location and targets one (or all) via the `--agent` flag.\n\n```bash\n# All skills in this repo, into the project's local agent directories\nnpx skills add indykite/skills\n\n# All skills, globally for the current user\nnpx skills add indykite/skills -g\n\n# Just one skill, into one agent\nnpx skills add indykite/skills --skill indykite-mcp-server --agent claude-code\n\n# Show what's in the repo without installing\nnpx skills add indykite/skills --list\n```\n\nUseful flags:\n\n- `-g, --global` — install at user scope instead of project scope.\n- `-a, --agent <name>` — limit to one or more agents (use `*` for all). A typo prints the full valid set.\n- `-s, --skill <name>` — limit to one or more skills.\n- `--copy` — copy files instead of symlinking (default is symlink so updates propagate).\n- `-y, --yes` — skip confirmation prompts (handy in CI).\n\n**After installing, restart the agent** (or reload its config) so it picks up the new skill directory. Verify with `npx skills list`.\n\n**Quick verification:** install one skill, then ask the agent something its description matches. For `indykite-mcp-server`: anything about initialising an MCP session against `eu.mcp.indykite.com` / `us.mcp.indykite.com`, calling `authzen_evaluate` / `ciq_execute`, or debugging a `401` from the MCP server.\n\n### Manual install\n\nIf you don't want the CLI, copy or symlink the skill directory into the agent's expected location. For **Claude Code** that's `~/.claude/skills/<skill-name>/` (user scope) or `.claude/skills/<skill-name>/` (project scope). For any other agent, consult its docs — most that don't read `SKILL.md` natively expect the *body* (everything after the YAML frontmatter) pasted into their own rule format.\n\n## Bundle install\n\nFor agents that support a single labelled plugin install, this repo ships per-agent manifest files. They register every skill in this repo at once and prompt for credentials (`API_URL`, `API_KEY`, `BEARER_TOKEN`, `SERVICE_ACCOUNT_TOKEN`, `MCP_URL`, `PROJECT_GID`) at install time. Source of truth for the credential list is [`manifest.yaml`](manifest.yaml).\n\n### Claude Code\n\nShips [`.claude-plugin/plugin.json`](.claude-plugin/plugin.json) and [`.claude-plugin/marketplace.json`](.claude-plugin/marketplace.json):\n\n```text\n# 1. Register this repo as a marketplace\n/plugin marketplace add indykite/skills\n\n# 2. Install the plugin from it\n/plugin install indykite-skills\n```\n\n### Gemini CLI\n\nShips [`gemini-extension.json`](gemini-extension.json) at the repo root:\n\n```bash\ngemini extensions install https://github.com/indykite/skills\n```\n\nGemini uses this `README.md` as its loaded context (`contextFileName`) and exposes each `settings` entry as an environment variable.\n\n### Cherry-picking from a bundle\n\nIf you only want one or two skills, use `npx skills add indykite/skills --skill <name>` instead — see [Install](#install). The bundle prompts for all six credentials; per-skill installs leave credential management to env vars.\n\n## Supported agents\n\nThe `skills` CLI is a **cross-agent installer** — `npx skills add indykite/skills --agent <name>` drops files in the right place for whatever agent `<name>` the CLI knows about. The CLI's `--agent` list is the source of truth and stays current as new agents are added.\n\nVerified end-to-end in this repo: **Claude Code**, **Gemini CLI**.\n\nFor every other agent the CLI lists, files arrive at the right path — but **native `SKILL.md` triggering is a property of the agent, not the CLI**. Whether an agent activates a skill automatically (matching the prompt against `description`), via a slash command, or by explicit selection depends on that agent. Check its docs when automatic activation matters.\n\n## How skills activate\n\nA skill is **passive until invoked**. Supported agents activate skills *automatically* by matching the user's prompt against each installed skill's `description` field — the one-line summary in `SKILL.md`'s frontmatter. When the description fits the request, the agent loads the rest of the skill into context before answering. The `## When to use` section is also read by the agent and determines whether activation fires — that's why the skills here list both positive triggers and explicit anti-triggers.\n\nIf a skill doesn't activate when you expect it to, check three things:\n\n1. **The agent loaded it.** `npx skills list` shows what's installed for the current scope. A skill that isn't installed cannot activate.\n2. **The description fits the prompt.** Open `SKILL.md` and re-read `description` and `## When to use`. Vague descriptions get vague triggering — sharpen the wording, reinstall, retry. If two skills could match the same prompt, the agent picks one; tighten one description to disambiguate.\n3. **Manual fallback.** Most agents let you invoke a skill by name (`/<skill-name>` in Claude Code, or explicit selection in Cursor / Copilot). Useful when automatic routing is uncertain — also tells you whether the skill is loaded at all.\n\nTo **disable** a misbehaving skill: remove the directory (`npx skills remove <name>`, or delete from the agent's skills folder), or set `metadata.internal: true` in its frontmatter so it stays installed but hidden from automatic discovery (it surfaces only when `INSTALL_INTERNAL_SKILLS=1`).\n\n## Authoring a skill\n\nAt-a-glance reference; full submission flow lives in [`CONTRIBUTING.md`](CONTRIBUTING.md).\n\n### Structure\n\n```text\n/\n├── skill-name/\n│   ├── SKILL.md\n│   ├── scripts/      (optional)\n│   ├── references/   (optional)\n│   └── assets/       (optional)\n└── another-skill/\n    └── SKILL.md\n```\n\n### SKILL.md format\n\n```markdown\n---\nname: your-skill-name\ndescription: What it does. Use when [trigger conditions].\n---\n\n# Your Skill Name\n\n## Instructions\n\n### Step 1: ...\n### Step 2: ...\n```\n\n### Conventions\n\n- Folder names are kebab-case (e.g. `my-cool-skill`).\n- The file must be named exactly `SKILL.md` (case-sensitive).\n- The `description` should state both what the skill does and when to invoke it — agents use it to decide whether the skill is relevant.\n- Keep `SKILL.md` focused on core instructions; put longer docs in `references/` and helper code in `scripts/`.\n\n## Resources\n\n- IndyKite Hub UI: [eu.hub.indykite.com](https://eu.hub.indykite.com/) / [us.hub.indykite.com](https://us.hub.indykite.com/)\n- IndyKite REST API: `openapi.indykite.com`\n- Developer docs: [developer.indykite.com](https://developer.indykite.com/)\n- Skills CLI: [skills.sh](https://skills.sh) ([`vercel-labs/skills`](https://github.com/vercel-labs/skills))\n- Agent Skills specification: [agentskills.io/specification](https://agentskills.io/specification)\n\n## Contributing and security\n\n- Add a new skill, fix one, or change conventions → [`CONTRIBUTING.md`](CONTRIBUTING.md) covers the quality bar, style, testing checklist, [Agent Skills specification](https://agentskills.io/specification) compliance, submission process, and code of conduct.\n- Exercise the skills (structural validation, dry-run smoke tests, live API roundtrips) → [`testing/README.md`](testing/README.md). Harness: `./testing/e2e-ciq.sh`.\n- Found a security issue → [`responsible_disclosure.md`](responsible_disclosure.md) before opening a public issue.\n- The `LICENSE` at the repo root applies to every file in the tree.\n",
  "bytes": 16423,
  "sha": "61b73e422400fc85cbced931e019099bda9eec7ca7628c9d844e00416897647f",
  "repo_slug": "indykite/skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_indykite_skills_9dec7db6/readme"
}