Installation

Start with All if you are unsure. For a smaller native Claude Code or Codex plugin, replace govisit@govisit-toolkit in the selected command with one of these:

For a single portable skill, replace '*' in the selected portable command with its name, such as govisit-search-places. Audience selections reuse some of the same skills; you do not need to install overlapping copies.

This example verifies the downloaded archive before writing its complete files to a new local skill directory. Point your host at that directory or use its configured project skill location. Use the installer for updates to an existing installation.

from hashlib import sha256
from io import BytesIO
import json
from pathlib import Path
import re
import tarfile
from urllib.request import Request, urlopen

request_headers = {"User-Agent": "GoVisitToolkit/0.2.0 (+https://github.com/inhotel-io/govisit-toolkit)"}
with urlopen(Request("https://govisit.ai/.well-known/agent-skills/index.json", headers=request_headers), timeout=30) as response:
    index = json.load(response)
skill = next(item for item in index["skills"] if item["name"] == "govisit-search-places")
if not re.fullmatch(r"govisit-[a-z0-9]+(?:-[a-z0-9]+)*", skill["name"]):
    raise ValueError("Invalid skill name")
if not skill["url"].startswith("https://github.com/inhotel-io/govisit-toolkit/releases/download/"):
    raise ValueError("Unexpected package source")
with urlopen(Request(skill["url"], headers=request_headers), timeout=30) as response:
    archive_bytes = response.read(10 * 1024 * 1024 + 1)
if len(archive_bytes) > 10 * 1024 * 1024:
    raise ValueError("Archive exceeds the download limit")
if "sha256:" + sha256(archive_bytes).hexdigest() != skill["digest"]:
    raise ValueError("Archive digest differs from the discovery index")

expected = {"LICENSE", "SKILL.md", "references/contract.json"}
with tarfile.open(fileobj=BytesIO(archive_bytes), mode="r:gz") as archive:
    members = archive.getmembers()
    if len(members) != len(expected) or {m.name for m in members} != expected:
        raise ValueError("Unexpected archive contents")
    if any(not m.isfile() or m.size > 2 * 1024 * 1024 for m in members):
        raise ValueError("Unsafe or oversized archive entry")
    files = {m.name: archive.extractfile(m).read() for m in members}
header = "---\nname: " + json.dumps(skill["name"]) + "\n"
if not files["SKILL.md"].decode("utf-8").startswith(header):
    raise ValueError("Package identity differs from the discovery index")
target = Path("skills") / skill["name"]
target.mkdir(parents=True, exist_ok=False)
for name, contents in files.items():
    destination = target / name
    destination.parent.mkdir(parents=True, exist_ok=True)
    destination.write_bytes(contents)