Skills Hub v0.1: How yome.work serves the device-native catalog
Yome ships the agent into your Apple devices, but skills need to flow somewhere. Skills Hub v0.1 is the public, signed catalog that serves official + community skills to every Yome client without dragging a server-side runtime into the loop. The agent stays local; only the artefacts move.
What the hub actually does
Three things, all read-mostly: list (catalog page + JSON feed), download (signed tarballs from the hub bot), and trace (replay JSON of community-submitted runs). Nothing in the hub executes a skill — execution is always on the user's device, against the user's data.
| 1 | GET /api/hub/skills → SkillCardRow[] (catalog feed) |
| 2 | GET /api/hub/skills/:slug → SkillDetailRow(single skill metadata) |
| 3 | GET /api/hub/skills/:slug/dl → 302 → tarball(latest signed artefact) |
| 4 | GET /api/hub/traces/:id → ReplayBundle(community trace, no device IDs) |
Why Supabase for v0.1
We need row-level auth (so a user can only see their own install history), a JSON column for manifest blobs, and zero ops. Supabase delivers all three with one Postgres instance and Auth-as-a-service, which means the entire backend ships in 9 migrations and one Vercel project.
Signing artefacts
Every published skill bundle is signed by the hub bot before it lands in storage. The Yome client refuses to install anything whose signature does not chain to a yome.work-controlled key, so a compromised mirror cannot inject a malicious skill — the device verifies before extraction.
The hub is a delivery layer, not an execution layer. Once a skill lands on your device, the server has no further hook into it. You can revoke trust per-skill from the device without telling the hub.
Surfacing the hub inside macOS / iOS
The Skills tab on the agent profile screen has two segments: Official and Community. Tapping "+" opens a native SwiftUI sheet that fetches /api/hub/skills, lets you search debounced, and installs in-place. The web marketplace is the same data with desktop-grade filtering and a card layout — both views consume the same feed.
| 1 | let url = URL(string: "https://yome.work/api/hub/skills")! |
| 2 | let (data, _) = try await URLSession.shared.data(from: url) |
| 3 | let rows = try JSONDecoder().decode([SkillCardRow].self, from: data) |
| 4 | self.skills = rows |
What's next
v0.2 will add per-skill trace galleries (community submissions surfaced under each skill detail page), and v0.3 introduces device-attested install receipts so a skill author can see how many real Apple devices have run their skill — without ever seeing the user behind them.