Install the AbleTrace skill

Only text files: the skill instructions, a catalogue of the compliance frameworks InfoPol supports, and working methods such as risk assessment and control mapping. No program runs from the skill.

The skill never writes to InfoPol on its own. Every change it proposes needs your approval for that item, and the assistant works with your own InfoPol permissions.

Version kb-2026.6, 29 files.

Give your AI assistant (for example Claude Code) this instruction. It reads the runbook, runs the verifier and installs the skill.

Install the AbleTrace skill for me. Fetch https://infopol.ee/ai/connect.md and follow it exactly. Stop and tell me if any check fails.

To do it yourself, you need Node.js 18 or newer. Save the verifier from the link below, then run:

curl -fsSLO https://infopol.ee/ai/skills/abletrace/abletrace-verify.mjs
node abletrace-verify.mjs --base https://infopol.ee --expect-version kb-2026.6 --install ~/.claude/skills/abletrace

• Download the verifier (abletrace-verify.mjs)
• Open the runbook as plain text (connect.md)

After that, connect the InfoPol MCP server and sign in with your own account. The steps are on the MCP page. The MCP server page

All addresses are on infopol.ee and are stable.

• Pointer to the current version
  https://infopol.ee/ai/skills/abletrace/latest.json
• Manifest of the current version: every file with its sha256 and size
  https://infopol.ee/ai/skills/abletrace/kb-2026.6/manifest.json
• Files: the same folder, one path per manifest entry
  https://infopol.ee/ai/skills/abletrace/kb-2026.6/
• MCP server card (identity and connection only)
  https://infopol.ee/api/mcp/server-card

sha256 of the current manifest: 57885094f39f964bac56c0c73d2ec5b3084b5c9cbaccb5a30786726a74db132d

The verifier reads the pointer, downloads the manifest and checks its sha256 against the pointer. It then downloads every file and checks each file’s sha256 and size against the manifest. Only when all of them match does it write the files into your skills folder. If any check fails, nothing is written and the verifier reports which file failed.

It also refuses paths that would leave the skills folder and refuses addresses that are not HTTPS.

It detects a corrupted, truncated or half-updated download, a file that does not match the manifest, and a wrong version.

It does not protect against infopol.ee itself being compromised: the manifest comes from the same address as the files, and there is no separate signature. If that matters to you, read the files before use, or compare the manifest sha256 above with a copy you obtained another way.

We chose HTTPS and published checksums over signing keys because a single address is easier to keep correct and to audit, and the skill contains only text that you can read.

Can I update the skill later?

Yes. Run the same instruction again. The pointer always names the current version, and the verifier replaces the files only after all checks pass.

Does the skill send my data anywhere?

The skill itself is text. Your data is read from InfoPol through the MCP connection with your own permissions, and your assistant provider processes it as part of your conversation.