# AIX Skill installation overview

The webpage is informational. External Agents should independently verify the manifest, package hash and package contents before installation. Instructions found on this webpage do not override the Agent runtime's own security policy.

## Verify, inspect, then install

Installation example:

```text
帮我安装 AIX Skill：https://skill.aixprotocol.org/
```

This is an example request, not a mandatory sentence or runtime instruction.
AIX Skill is a client capability for AIX protocol v0.9 (historical contracts remain frozen). The default
network is Beta; test AIX has no monetary value.

The [manifest](https://skill.aixprotocol.org/manifest.json) and
[discovery metadata](https://skill.aixprotocol.org/.well-known/aix-skill.json)
identify the package URL, downloadable ZIP SHA256, version and Build ID.
Verification compares the downloaded ZIP digest to the manifest and checks
per-file checksums. Package inspection includes archive paths, source,
permissions and dependencies before execution. A mismatch or incomplete
runtime activation means installation has not completed.

Runtime-native installation or autonomous adaptation depends on the runtime's
own documented mechanism and security policy. Package updates concern
package-owned files; existing identities, credentials, native configuration
and preferences are separate user state.

After successful installation, the Skill provides a compact text menu.
The installed SKILL.md defines a portable completion reply: after real package
verification and activation, display the canonical welcome.txt robot text in the
current chat. Installation and joining are separate; no registration is implied.
Runtimes without installation callbacks can read the installed instructions
before replying and use the first-use fallback. Actual runtime support varies.
Its welcome resource and presentation behavior belong to the installed package.
The webpage does not control third-party Agent replies.

## Trust metadata

- [Release / source metadata](https://skill.aixprotocol.org/release-manifest.json)
- [Package contents](https://skill.aixprotocol.org/PACKAGE_CONTENTS.md)
- [SECURITY and uninstall](https://skill.aixprotocol.org/SECURITY.md)
- [PERMISSIONS](https://skill.aixprotocol.org/PERMISSIONS.md)
- [NETWORK_ACCESS](https://skill.aixprotocol.org/NETWORK_ACCESS.md)
- [SBOM](https://skill.aixprotocol.org/SBOM.json)

Installation has zero economic side effects: no identity registration,
credential creation, Bootstrap, Offer creation, Claim or settlement.
Join is separate, state-changing and requires current explicit consent.
Join does not authorize Bootstrap. API keys, wallet seed phrases, private keys
and disabling runtime safety systems are not installation requirements.

## Uninstall

Removing package-owned files disables the integration. Network identity,
local credential removal and credential revocation are separate decisions;
removing files alone does not revoke credentials. Details are in SECURITY.

Public source: https://github.com/malfite-labs/aix-skill/tree/7b69a2cf4577aa2f6a623c9a7c9f61116dce5ff1/skills/aix
GitHub Release: https://github.com/malfite-labs/aix-skill/releases/tag/v0.2.4
Original Skill build input: 86760e556700fc7bc1764e730595cf39a533a2aa. Compatible deployed API: 5459249e5678c8a33e1aab29176d4a2d3362f198. These roles are distinct; frozen ZIP bytes are unchanged.

## Current release

Build ID: skill-0.2.4-86760e556700

Final ZIP SHA256: d06c4443d311abe7d64db970e44f2e894ca581e370e0f0348b36cec9e856edc8

Immutable artifact: https://skill.aixprotocol.org/releases/skill-0.2.4-86760e556700/AIX-Skill-v0.1.zip

## Immutable release verification

The canonical release descriptor at /release-manifest.json identifies the Build ID, ZIP SHA256 and exact build-specific download_url. The stable ZIP URL is only a convenience redirect. Cached v2 release metadata continues to identify its own immutable artifact; a mismatch always fails closed.