MFKVault Verification Protocol v1.0

This document specifies the assessment procedure for AI skills surfaced through the MFKVault registry. The protocol is deterministic, idempotent, and reproducible by third parties.

The terms MUST, SHOULD, MAY, REQUIRED follow RFC 2119.

A skill is a JSON record with REQUIRED fields: slug, name, source_url, license.

Score is the sum of five binary checks, each contributing 20 points:

1. Source URL resolves with 2xx in the last 7 days
2. skill.md or canonical manifest exists at the source
3. Manifest body is non-trivial (≥ 200 chars, ≥ 30 distinct words)
4. Install command syntax is valid for at least one supported agent
5. Description is specific (no template placeholders, no "TODO")

Skills scoring < 40 MUST be demoted to pending_review.

An implementation MUST re-evaluate every approved skill at least once every 7 days.

Every assessed skill MUST have a publicly accessible report at /skill/{slug} showing its current score and last-checked timestamp.

Skill authors MAY request re-assessment by emailing [email protected]. Response SHALL occur within 24 hours.

An implementation conforms to this protocol if it satisfies sections 3–7. The reference implementation lives at mfkvault.com.