Skill Hub API v1
The sinobee.ai Skill Hub protocol v1, compatible with the SinoBee client (sinobee skills search / install / publish / sync-revocations).
| GET | /api/v1/skills?q=&page=&kind=evaluation&target= | { items: [{ id, name, description, latest, trust, publisher, downloads, kind, targets?, reviewed?, security? }], page, total } |
| GET | /api/v1/skills/{publisher}/{name} | { id, name, license, publisher: { id, verified }, versions: [{ version, sha256, bundle_url, signature, reviewed, published_at, scan: { verdict, findings } }] } |
| GET | /api/v1/bundles/{publisher}/{name}/{version}.tar.gz | .tar.gz — single <name>/ folder + .sinobee-manifest.json |
| GET | /api/v1/revocations | { revoked: ["sha256:…"] } |
| POST | /api/v1/skills | Bearer sbh_… · multipart bundle + manifest → { id, version, status: "pending_review" } |
| GET | /api/v1/evals?kind=&subject=&suite_hash= | { items: [{ id, subject, suiteHash, thinkingModel, executionModel, trials, fairScore, evaluator, url, … }] } — public reports only |
| POST | /api/v1/evals | Bearer (evals:write) · one report per combination; visibility public | private, evaluator, suite_ref |
| PATCH | /api/v1/evals/{id} | Bearer (evals:write) · { visibility } — the publisher only |
| GET | /api/v1/evals/suites?skill=&version= | { items: [{ hash, subject, evaluator, inputs, questions, categories, reportCount, url }] } |
| GET | /api/v1/evals/suites/{hash} | { hash, skill, evaluator, suite, inputs } — the hash is SinoBee's sfs.suite_hash |
| POST | /api/v1/evals/suites | Bearer (evals:write) · { hash, skill, suite, inputs, evaluator } → the hash is recomputed; steering or personal data is refused |
| GET | /.well-known/sinobee-hub-keys.json | { alg: "ed25519", keys: ["<base64 raw public key>"] } |
Client verification
- Download the bundle (≤ 20 MB, ≤ 500 files; path traversal, symlinks and device files are rejected).
- Validate against the Agent Skills spec; compute the content hash and compare with the Hub’s sha256 — abort on mismatch.
- Verify the signature (ed25519 over the content_hash string) with the pinned public keys.
- Abort if the Hub scan says dangerous; run a local security scan as well.
- Verified publisher, reviewed version and valid signature → verified; otherwise community.
Examples
curl https://sinobee.ai/api/v1/skills?q=research
curl https://sinobee.ai/api/v1/skills/cafeca/web-research
curl -H "Authorization: Bearer sbh_..." -F [email protected] -F [email protected] https://sinobee.ai/api/v1/skills