The Prompt Boot Format — v1

A Prompt Boot is an AI-native install button: instead of a shell one-liner, software ships as a natural-language prompt the user pastes into their AI agent. The agent fetches the software, places it, and starts onboarding — with the user approving each step.

The canonical example:

Download https://cos.team/dist/cos.zip and unzip it into this folder. Then read AGENTS.md and start the onboarding.

This document defines the format for registry entries and the recommendations software authors should follow. The concept comes from "Prompt Boot: the AI-native install button".

1. The entry format

A Prompt Boot entry is a single JSON document conforming to the schema at https://promptboot.ai/schema/v1.json (source). Entries live in this repository under boots/<slug>.json, where the filename equals the slug field.

Field	Req	Meaning
`$schema`	✓	Always `https://promptboot.ai/schema/v1.json`
`slug`	✓	URL-safe id, 3–64 chars, `kebab-case`. Equals the filename.
`name`	✓	Human-readable name, ≤80 chars
`description`	✓	One plain-text sentence, ≤200 chars
`category`	✓	One id from `categories.json`
`tags`		Up to 8 kebab-case tags
`boot.prompt`	✓	The prompt itself, 10–4000 chars
`boot.targetDir`		`new-empty-folder` \| `current-project` \| `anywhere`
`boot.variants[]`		Per-agent prompt overrides (`agent`, `prompt`)
`artifacts[]`	*	Every URL the prompt downloads: `url` (https only), `sha256`, `kind`. Required for verified entries.
`agents[]`	✓	`claude-code`, `cursor`, `codex-cli`, `gemini-cli`, `copilot`, `generic`
`requirements`		`os[]` and free-form `tools[]` prerequisites
`security`	✓	Honest behavior declaration — see below
`author`	✓	`name`, optional `github`, `url`
`source`		`website`, `repo`, `docs` links (https only)
`license`		SPDX id of the installed software, or `proprietary`
`dateAdded`	✓	ISO date the entry was added
`updated`		ISO date of last material change

The `security` block (required)

Every entry must declare what its boot actually does:

executesCode — does the boot run downloaded code?
networkAccess — the list of domains contacted ([] if none)
writesOutsideTargetDir — does it write outside its target directory?
notes — optional free-text clarification, ≤500 chars

The registry renders this as the "What this does" panel next to every prompt. A prompt whose behavior contradicts its declaration will be removed.

2. Authoring guidance

Prompt Boots succeed through legibility, not obscurity. Recommendations for authors:

Inspectability. The prompt must state, in plain language, every URL it fetches and everything it writes. Indirection ("run the script at X, which does the rest") is discouraged; verified entries that execute code must link their source.
Approval gates. Include an explicit gate in the prompt, e.g. "Before executing anything you downloaded, show me a summary of what it will do and wait for my confirmation." Agents keep their own permission prompts, but asking for one in the prompt makes intent unmistakable.
Scoping. Prefer "into this folder" or a named new folder. Never write home-directory-wide. Declare writesOutsideTargetDir honestly.
Pinning. Version your artifact URLs and publish sha256 checksums. The prompt may tell the agent to verify the checksum after download.
Idempotence. Pasting the prompt twice should be safe.
Agent-neutral wording. Write the main prompt for generic; use boot.variants for agent-specific syntax.

3. The "Install with your AI" button

Authors can put an install button on their own site that links to their canonical Prompt Boot page:

<a href="https://promptboot.ai/boots/YOUR-SLUG" rel="noopener">
  <img src="https://promptboot.ai/badge.svg" alt="Install with your AI — Prompt Boot" height="32">
</a>

Every entry's detail page shows this snippet pre-filled under "Get the button."

4. Trust model

Format-checked: every merged entry passed schema validation and automated lints (https-only URLs, no invisible/bidirectional Unicode, red-flag pattern review) plus human PR review.
Verified (badge): a maintainer additionally walked through the boot, confirmed the prompt matches its security declaration, artifact checksums are present and correct, and source is linked. Verification is a review, not a security audit.
Everything else is a community entry — not reviewed for safety beyond format checks.

The user-side rule is always the same: read the prompt before you paste it — your agent will do what it says.

Report bad entries via the report issue template. Confirmed-malicious entries are removed immediately and the site redeploys automatically.

5. Versioning

This is v1. The $schema URL is the version marker. Within v1, changes are additive only (new optional fields); anything breaking becomes v2.json with a documented migration. Propose format changes via issues on this repository.