packages/oracle-runtime/src/plugins/skills/
Summary
Discover IXO skill capsules. Bothlist_skills and search_skills mint an ixo:skills UCAN invocation per call so the registry surfaces the caller’s own published private skills alongside public ones. When minting fails the tools degrade to public-only — they never throw on auth issues. Pairs with sandbox for execution (see Plugin vs Skill).
Environment variables
Depends on
Hard-depends onsandbox — skill execution runs through sandbox_run, which sandbox owns (listing/search is HTTP-only). But sandbox is auto-detect (SANDBOX_MCP_URL) and off by default, while skills is on by default. If sandbox is not loaded — e.g. SANDBOX_MCP_URL is unset — the loader cascades skills off silently (a boot.plugin.cascaded_off warning), it does not fail boot. A true boot failure only occurs if sandbox is removed from the plugin set entirely while skills still requires it.
What it contributes
- Tools:
list_skills,search_skills. - Sub-agents: none.
- Middleware: none.
- HTTP routes: none.
- Shared state: none.
Opt out / Opt in
When to use it
- User asks “what skills are available?” or “what can you do?”.
- User asks the agent to find a skill for a specific task (“a skill for invoices”, “is there a skill for KYC?”).
- Before running a skill via the sandbox, list or search to obtain its
cidand path.
When NOT to use it
- Executing a skill — that goes through
sandbox(sandbox_run), not the skills tools. - General web search — use
firecrawl.
Where to read next
Plugin vs Skill
Why
skills discovers and sandbox executes.Declare dependencies
Pattern used here to require
sandbox.