StablEdge uses one installer for Skills from every source: preview first, install after confirmation. Downloads, extraction, validation, and writing are all done by the desktop host; the Agent and the interface can only start requests through controlled entry points.
Supported sources
| Source | In the installer | Notes |
|---|---|---|
| Local folder | Choose folder | The folder can contain one or more Skills. The source folder itself is not modified. |
| Local ZIP | Choose ZIP | Preview first, then extract and install. |
| HTTPS archive | Enter an HTTPS address | An HTTPS address pointing to a ZIP file. Only HTTPS and standard ports are accepted, and the address after any redirect must meet the same requirements, with at most 5 redirects followed. |
| GitHub repository | Enter a Git address | Only https://github.com/<owner>/<repo> is supported; you can specify a branch, tag, or commit (default HEAD), and the host downloads the ZIP archive of that version. |
Two-phase installation: preview → commit
- preview: the host puts the source into a temporary directory for the current account and applies source restrictions, safe extraction, and path and size validation; it then validates each candidate's
SKILL.mdby StablEdge's parsing rules. The preview result contains the list of candidate Skills, a file list for each candidate (path, size, SHA256), risk notices, the target install path, and a single-use preview token. - Choose a candidate: when one source contains several Skills, the user or the Agent picks the one to install.
- commit: the host checks the preview token, its validity period, the candidate ID, and the content hash, confirming that the source has not changed since the preview; it then backs up the existing directory of the same name and switches to the new directory atomically.
- Refresh: the host has the Agent runtime reload Skills and sync the registry. On success the backup is deleted; if any step fails, the old directory is restored and refreshed again.
- A preview token can be used only once and expires after 10 minutes by default; when it expires, preview again.
- Installs started by the Agent need user confirmation when the global security confirmation is on, and official sources are not exempt automatically.
Checks during preview
| Check | Rule |
|---|---|
| Archive size | The ZIP or download must not exceed 32 MB |
| Total size after extraction | Not more than 64 MB |
| Single file | Not more than 8 MB |
| File count | Not more than 2000 |
| Paths | Only plain relative paths are allowed; entries containing .. or absolute paths are rejected |
| Symbolic links | Any symbolic link in the source or the archive means rejection |
SKILL.md | At least one is required; one directory cannot hold several SKILL.md files that differ only in case; a Skill directory cannot nest another Skill |
| Metadata | SKILL.md must parse correctly; a Progressive Skill's sections and resource declarations must all pass validation |
| Risk notice | Candidates that contain scripts or executable files are marked high-risk; check the content before installing |
Install directory
Skills are installed in the single install directory for the current account:
<StablEdge data directory>/skills/user/<skill-name>/The directory name is converted from name (spaces become -); for the rules, see Naming rules. Installing a Skill with the same name replaces the original directory, which amounts to an update.
Earlier versions used other Skill directories, and directories of other Agent products may also be detected. StablEdge only detects them and never merges or overrides them automatically at startup; when you need them, select these directories in the installer to import them explicitly, and the import is previewed the same way.
Hot sync
StablEdge continuously watches the install directory and the Skill directories bundled with plugins, so changes take effect automatically without a restart:
- The paths, sizes, and modification times of files are checked once per second, and a content hash of the directory is computed when a change is found;
- Once the content has been stable for about 0.75 seconds, Skills are reloaded and the host rescans and syncs the registry;
- Every 60 seconds a full content comparison runs as well, to catch changes that left both size and modification time unchanged;
- The whole directory is watched, not just
SKILL.md: editing scripts or reference documents also triggers a sync.
You can therefore edit Skills directly in the install directory to debug them. A broken SKILL.md makes that Skill temporarily unloadable, and StablEdge records the specific reason (for example, frontmatter that is not valid YAML, or a missing name) to tell you what broke.
Editing the install directory directly skips the installer's preview checks. Before you distribute a Skill for real, install it again from the folder or ZIP with the installer and confirm that it passes preview.
Updating and reinstalling
- Reinstall from the source: run preview → commit again on the same source; the new version replaces the old directory atomically, and the old version is restored automatically on failure.
- Edit in place: edit the install directory directly and let hot sync apply the change; good for development and debugging.
- Version number: it is worth maintaining
versionin the frontmatter; it appears in the preview result along with the candidate metadata, so you can confirm which version you are installing.