The manifest (skilldex.json)

Every scope has a skilldex.json recording what is installed in it: <project>/.skilldex/skilldex.json for a project, and ~/.skilldex/shared/skilldex.json and ~/.skilldex/global/skilldex.json for the others. skillpm writes it on every install, update, and uninstall. You do not edit it by hand.

Structure

{
  "skilldexVersion": "1",
  "scope": "project",
  "skills": {
    "pdf": {
      "name": "pdf",
      "version": "1.0.0",
      "source": "community",
      "sourceUrl": "git+https://github.com/anthropics/skills/tree/main/skills/pdf",
      "installedAt": "2026-09-23T10:00:00.000Z",
      "specVersion": "1.0",
      "score": 100,
      "path": "skills/pdf"
    }
  },
  "skillsets": {},
  "updatedAt": "2026-09-23T10:00:00.000Z"
}

Skill entries

| Field | Description | |---|---| | name | The installed name, as used by uninstall and update | | source | community for registry and GitHub installs, local for a folder | | sourceUrl | Where the skill came from. skillpm update re-fetches from here; local installs have none | | installedAt | When it was installed | | specVersion | The spec version it was validated against | | score | Its format conformance score at install time | | path | Where it lives, relative to the scope's directory |

Skillsets are recorded under skillsets, with the skills each one brought in.

Skills are not pinned

Registry skills have no published versions: installing or updating fetches the skill as it currently is at its source. skillpm list --json reads this file, and the scores it shows are the ones taken at install time.