source.json, and the CLI downloads the files from your repository at the pinned commit.
cli-tool/components/skills/{category}/{name}/source.json:
Limits after filtering: 200 files and 5 MB.
Updating
A new commit in your repository does not reach users on its own. Open a pull request that movescommit. A weekly job opens an issue listing skills whose upstream has newer commits.
Whole plugins
Asource.json can also point at a complete Claude Code plugin (a folder with .claude-plugin/plugin.json). Those live under cli-tool/components/plugins/ and are published in the aitmpl marketplace. See Plugins.