CLI

One stable ID in. A safe Skill folder out.

.copilotkit/project.json supplies the Project ID. The command names a developer-set Learning Container ID and downloads only that Project’s published Skills.

Command

The whole user path

terminal · project root

$ copilotkit skills download support-quality \
  --output .agents/skills/support-quality

Downloading Skills for support-quality…
Verified bundle sha256:3cc8…e91a
Installed 3 Skills in .agents/skills/support-quality

Scope and rollout

The command cannot cross a Project boundary

PROJECT

Require local selection

The CLI stops before the request when the current folder has no valid selected Project. The API route includes that Project ID and authorizes access again.

FLAG

Hide both help and dispatch

learning.platform-v1 gates the command in help output and command dispatch, matching app-api and app-frontend.

Safety

The ZIP never writes unchecked paths

Validate the stable ID.

The CLI accepts 1–64 lowercase letters or numbers separated by single hyphens.

Fetch raw bytes.

The API client keeps the response body as bytes and reads the SHA-256 ETag instead of passing through JSON.

Verify the full bundle.

The CLI hashes the response and rejects a missing or mismatched digest before extraction.

Scan every ZIP entry.

Absolute paths, traversal, symbolic links, duplicate names, malformed records, and unsupported compression fail closed.

Stage before replace.

Files extract into a sibling temporary directory. The requested output changes only after the complete bundle passes.

Bundle shape

Plain files fit every agent

.agents/skills/support-quality/
├── confirm-account-region/
│   └── SKILL.md
├── explain-payment-processing/
│   └── SKILL.md
└── bundle.json