diff --git a/candy/layer-nerdctl/.agents/skills/layer-nerdctl/SKILL.md b/candy/layer-nerdctl/.agents/skills/layer-nerdctl/SKILL.md
new file mode 100644
index 0000000..3228fe2
--- /dev/null
+++ b/candy/layer-nerdctl/.agents/skills/layer-nerdctl/SKILL.md
@@ -0,0 +1,41 @@
+---
+name: layer-nerdctl
+description: 'nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack
+  — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu,
+  nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working
+  with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys.'
+---
+
+# layer-nerdctl
+
+nerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI
+stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`
+engine.
+
+## What it installs
+
+- **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,
+  `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,
+  `crun`, `iptables-nft` (arch) / `iptables` (alpine).
+- **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,
+  sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which
+  supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +
+  buildkit + rootlesskit in one archive.
+- `/etc/nerdctl/nerdctl.toml` (charly namespace + CNI path) and
+  the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.
+- The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,
+  `/dev/net/tun`, `unmask=/proc/*`.
+
+## Engine capability
+
+The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`
+(out-of-process) or compiled in; every engine op delegates to
+`container.InvokeEngineOp("nerdctl", …)` in the spec module. nerdctl has no
+`--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the
+host user under rootless), guaranteeing uid-identical sharing; a non-zero uid
+needs the subuid caveat.
+
+## Use when
+
+Working with the nerdctl engine, the layer-nerdctl candy, or an
+`engine: nerdctl` deploy.
diff --git a/candy/layer-nerdctl/charly.yml b/candy/layer-nerdctl/charly.yml
index 1ed2c0d..434fa32 100644
--- a/candy/layer-nerdctl/charly.yml
+++ b/candy/layer-nerdctl/charly.yml
@@ -142,38 +142,3 @@ layer-nerdctl-skill:
         family: distros
         owner: layer-nerdctl
         description: "nerdctl (containerd CLI) + the rootless containerd/buildkit/CNI stack — native Arch/Alpine packages, the pinned sha256 nerdctl-full tarball on Fedora/Debian/Ubuntu, nerdctl.toml + the charly CNI conflist + the nested-pod posture. Use when working with the nerdctl engine, the layer-nerdctl candy, or engine: nerdctl deploys."
-        content: |
-            # layer-nerdctl
-
-            nerdctl (the containerd CLI) plus the rootless containerd + buildkit + CNI
-            stack, as ONE candy. Composed by a box that wants the opt-in `engine: nerdctl`
-            engine.
-
-            ## What it installs
-
-            - **Native packages** on Arch/CachyOS/Omarchy and Alpine: `nerdctl`,
-              `cni-plugins`, `rootlesskit`, `slirp4netns`, `buildkit`, `fuse-overlayfs`,
-              `crun`, `iptables-nft` (arch) / `iptables` (alpine).
-            - **Non-native distros** (Fedora/Debian/Ubuntu) install the pinned,
-              sha256-verified `nerdctl-full` tarball (step `nerdctl-full-tarball`), which
-              supplies nerdctl + containerd + `containerd-fuse-overlayfs-grpc` + CNI +
-              buildkit + rootlesskit in one archive.
-            - `/etc/nerdctl/nerdctl.toml` (charly namespace + CNI path) and
-              the `charly` CNI network conflist at `/etc/cni/net.d/charly.conflist`.
-            - The **nested-pod posture**: userns-scoped `cap_add: ALL`, `/dev/fuse`,
-              `/dev/net/tun`, `unmask=/proc/*`.
-
-            ## Engine capability
-
-            The `engine: nerdctl` word is served by `opencharly/plugin-nerdctl`
-            (out-of-process) or compiled in; every engine op delegates to
-            `container.InvokeEngineOp("nerdctl", …)` in the spec module. nerdctl has no
-            `--keep-id`, so the start-plan runs the workload as `--user 0:0` (uid 0 == the
-            host user under rootless), guaranteeing uid-identical sharing; a non-zero uid
-            needs the subuid caveat.
-
-            ## Use when
-
-            Working with the nerdctl engine, the layer-nerdctl candy, or an
-            `engine: nerdctl` deploy.
-