diff --git a/skills/brand-kit/SKILL.md b/skills/brand-kit/SKILL.md
index 509fe9d..7ae5334 100644
--- a/skills/brand-kit/SKILL.md
+++ b/skills/brand-kit/SKILL.md
@@ -67,6 +67,16 @@ root returns a small usage document (not the data endpoint). Append `.json` for
 the machine-readable readback; the human-facing route may render an HTML brand
 page.
 
+## Producer/host boundary and attribution handoff
+
+A host without an explicit header-capable integration must omit attribution
+rather than infer it. For the existing Brand host request only, the exact
+eligible read-only/public `GET`/`HEAD` handoff is exactly one header value,
+`X-ReplyNodes-Skill: brand-kit`, with a maximum of 64 bytes. Handling is
+fail-closed: malformed, duplicate, unknown, case-mismatched, or oversized
+values are unattributed. This handoff grants no credentials or write
+capability.
+
 The JSON response is the canonical Brand Intelligence retrieve object (for
 example `identity`, `brand_kit`, `quality`, and `provenance`) plus an optional
 merged `styleguide` object and a `meta` object:
diff --git a/skills/brand-logo/SKILL.md b/skills/brand-logo/SKILL.md
index 0441174..76d43a6 100644
--- a/skills/brand-logo/SKILL.md
+++ b/skills/brand-logo/SKILL.md
@@ -50,6 +50,15 @@ When the caller needs structured JSON instead of image bytes, the canonical
 curl --fail-with-body 'https://api.replynodes.com/v1/brand/logo?domain=replynodes.com'
 ```
 
+## Producer/host boundary and attribution handoff
+
+A host without an explicit header-capable integration must omit attribution
+rather than infer it. For the existing public logo `GET`/`HEAD` surfaces
+documented above only, the exact eligible read-only/public handoff is exactly one header value, `X-ReplyNodes-Skill: brand-logo`, with a maximum of 64 bytes.
+Handling is fail-closed: malformed, duplicate, unknown, case-mismatched, or
+oversized values are unattributed. This handoff grants no credentials or write
+capability.
+
 ## Limits and errors
 
 The `GET /v1/brand/logo` route is admitted through the shared anonymous quota at
diff --git a/skills/url-to-markdown/SKILL.md b/skills/url-to-markdown/SKILL.md
index 8afd658..3168bca 100644
--- a/skills/url-to-markdown/SKILL.md
+++ b/skills/url-to-markdown/SKILL.md
@@ -61,6 +61,16 @@ required. Never ask the user for credentials for this workflow. Keep the exact
 input URL alongside the returned Markdown; do not rewrite, shorten,
 canonicalize, or replace the source URL.
 
+## Producer/host boundary and attribution handoff
+
+A host without an explicit header-capable integration must omit attribution
+rather than infer it. For the existing Markdown host request only, the exact
+eligible read-only/public `GET`/`HEAD` handoff is exactly one header value,
+`X-ReplyNodes-Skill: url-to-markdown`, with a maximum of 64 bytes. Handling is
+fail-closed: malformed, duplicate, unknown, case-mismatched, or oversized
+values are unattributed. This handoff grants no credentials or write
+capability.
+
 A longer response can be saved:
 
 ```bash