List installed skills
Lists the skills in force for work in this repository — name, the one line that says when to reach for one, the file it lives in and the rung it came from. Five origins are merged, nearest winning a name, so a skill listed here is the one that will actually load; the ones a nearer rung shadows are simply absent. The bodies are never here: progressive disclosure means a catalogue carries names, and expandSkill is what reads one. Notices carries whatever the loaders complained about while reading — a package skill something nearer displaces, a file with no description — for a client to show once.
Authorizations
Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation.
Query Parameters
Absolute path of the repository to resolve skills and command files for. A repository's own .claude and .narya directories are read only when it is named here AND it has been trusted; with no repository named, the answer carries the user's own files and the installed packages' only. It also decides where a command's shell blocks run.
4096Opaque pagination cursor from a previous page's nextCursor or prevCursor.
1024Maximum items per page.
1 <= x <= 100Response
One page of installed skills.
One page of installed skills, plus whatever the loaders complained about while reading them.
x >= 1Standing facts about the SKILL files on this machine's disk — a package skill something nearer displaces, a file with no description — in the words a person reads. Scoped to this listing: what the command loaders complained about arrives with listCommands, so a caller walking both receives each complaint once. They repeat on every request because they are conditions rather than events; a client that shows them keeps its own memory of what it has already said.

