RFC: skill.yaml Manifest Schema — What fields are essential?

[echoVic]

The skill.yaml manifest is the foundation of STOP. It declares what a skill is, what it needs, and what it does.

Current draft includes:

• inputs / outputs with types and constraints
• tools_used — which tools the skill may invoke
• side_effects — filesystem, network, message, exec, state
• requirements — env vars, files, capabilities
• assertions — pre/post-conditions

Open questions

1. Are the current field types sufficient? (string, number, boolean, file_path, dir_path, url, json, array, enum)
2. Should we add a permissions field? e.g. declaring that a skill needs write access to specific directories
3. How should we handle versioning? When the manifest schema evolves, how do we maintain backward compatibility?
4. Should tools_used be strict or advisory? Should runtimes block undeclared tool usage, or just warn?
5. Is side_effects granular enough? Do we need sub-types (e.g. network.http vs network.websocket)?

Share your thoughts! What fields would you add or remove?