@@ -66,10 +66,10 @@ These three validate the server's response against the SEP-2640 conformance rule
 it. A name that doesn't match its URI, a digest in the wrong shape, or an incomplete manifest raises
 `ValueError` rather than reaching your code.
 
-`read_skill_resource(skill, uri)` fetches a file and verifies it against the manifest in the `Skill`
-entry you pass. It returns a `ReadResourceResult` with text or blob content only after the URI,
-size, and SHA-256 digest match. Keep that entry while you act on the skill so every file is checked
-against the same manifest.
+`read_skill_resource(skill)` fetches the skill's `SKILL.md` and verifies it against the manifest in
+the `Skill` entry you pass. For a supporting file, pass its URI as a second argument. It returns a
+`ReadResourceResult` with text or blob content only after the URI, size, and SHA-256 digest match.
+Keep that entry while you act on the skill so every file is checked against the same manifest.
 
 !!! tip
     `read_skill_resource` checks the bytes returned by `resources/read` against the held manifest.
 
@@ -12,7 +12,7 @@ async def main() -> None:
             print(skill.uri, skill.frontmatter["description"])
 
         skill = await catalog.get_skill("skill://git-workflow/SKILL.md")
-        result = await catalog.read_skill_resource(skill, skill.uri)
+        result = await catalog.read_skill_resource(skill)
         content = result.contents[0]
         if isinstance(content, TextResourceContents):
             print(content.text)
 
@@ -138,12 +138,13 @@ async def get_skill(self, uri: str) -> Skill:
             raise ValueError(f"server returned skill {result.skill.uri!r} for requested {uri!r}")
         return result.skill
 
-    async def read_skill_resource(self, skill: Skill, uri: str) -> ReadResourceResult:
+    async def read_skill_resource(self, skill: Skill, uri: str | None = None) -> ReadResourceResult:
         """Read and verify one file against a held `Skill` entry.
 
-        Pass the entry obtained from `list_skills` or `get_skill`. A dynamic
-        skill has no manifest to verify; use `Client.read_resource` if you
-        choose to read its unverified content.
+        Pass the entry obtained from `list_skills` or `get_skill`. Omit `uri`
+        to read the skill's `SKILL.md`, or pass a supporting file's URI. A
+        dynamic skill has no manifest to verify; use `Client.read_resource`
+        if you choose to read its unverified content.
 
         Raises:
             ValueError: If the file is not in the manifest, or the server's
@@ -152,6 +153,7 @@ async def read_skill_resource(self, skill: Skill, uri: str) -> ReadResourceResul
             RuntimeError: If the server returns an `InputRequiredResult`; this
                 method does not drive the input-required loop.
         """
+        uri = skill.uri if uri is None else uri
         if skill.resources == "dynamic":
             raise ValueError(f"skill {skill.uri!r} has dynamic resources and cannot be integrity-verified")
         if not any(resource.uri == uri for resource in skill.resources):
 
@@ -209,12 +209,33 @@ async def test_read_skill_resource_returns_verified_text() -> None:
     """SDK-defined: a matching manifest allows a fetched text file."""
     async with _skills(_server()) as skills:
         skill = await skills.get_skill(_SKILL_URI)
-        result = await skills.read_skill_resource(skill, _SKILL_URI)
+        result = await skills.read_skill_resource(skill)
     contents = result.contents[0]
     assert isinstance(contents, TextResourceContents)
     assert contents.text == _SKILL_CONTENT
 
 
+async def test_read_skill_resource_accepts_a_supporting_file_uri() -> None:
+    """SEP-2640: a supporting file is checked against the same held manifest."""
+    uri = "skill://git-workflow/references/GUIDE.md"
+    content = "# Guide\n"
+    server = _server()
+    server.add_resource(TextResource(uri=uri, name="GUIDE.md", text=content))
+    skill = Skill(
+        uri=_SKILL_URI,
+        frontmatter={"name": "git-workflow", "description": "d"},
+        resources=[
+            SkillResource(uri=_SKILL_URI, digest=_SKILL_DIGEST, size=len(_SKILL_CONTENT)),
+            SkillResource(uri=uri, digest=f"sha256:{hashlib.sha256(content.encode()).hexdigest()}", size=len(content)),
+        ],
+    )
+    async with _skills(server) as skills:
+        result = await skills.read_skill_resource(skill, uri)
+    contents = result.contents[0]
+    assert isinstance(contents, TextResourceContents)
+    assert contents.text == content
+
+
 async def test_read_skill_resource_rejects_a_changed_file() -> None:
     """SEP-2640: a host rejects content that differs from the held manifest."""
     stale = Skill(
@@ -224,7 +245,7 @@ async def test_read_skill_resource_rejects_a_changed_file() -> None:
     )
     async with _skills(_server()) as skills:
         with pytest.raises(ValueError) as exc_info:
-            await skills.read_skill_resource(stale, _SKILL_URI)
+            await skills.read_skill_resource(stale)
     assert str(exc_info.value) == snapshot(
         "resource 'skill://git-workflow/SKILL.md' has digest "
         "'sha256:7187b725da92d7447b6f50e21d0bf4f3b9db3387acb39239c4a4edc193ddcd4b', "
@@ -247,7 +268,7 @@ async def test_read_skill_resource_rejects_a_dynamic_skill() -> None:
     dynamic = Skill(uri=_SKILL_URI, frontmatter={"name": "git-workflow", "description": "d"}, resources="dynamic")
     async with _skills(_server()) as skills:
         with pytest.raises(ValueError) as exc_info:
-            await skills.read_skill_resource(dynamic, _SKILL_URI)
+            await skills.read_skill_resource(dynamic)
     assert str(exc_info.value) == snapshot(
         "skill 'skill://git-workflow/SKILL.md' has dynamic resources and cannot be integrity-verified"
     )
@@ -264,7 +285,7 @@ async def test_read_skill_resource_returns_verified_binary_content() -> None:
         resources=[SkillResource(uri=_SKILL_URI, digest=f"sha256:{hashlib.sha256(data).hexdigest()}", size=len(data))],
     )
     async with _skills(server) as skills:
-        result = await skills.read_skill_resource(skill, _SKILL_URI)
+        result = await skills.read_skill_resource(skill)
     contents = result.contents[0]
     assert isinstance(contents, BlobResourceContents)
     assert contents.blob == base64.b64encode(data).decode("ascii")
@@ -294,7 +315,7 @@ async def handler(ctx: ServerRequestContext[Any, Any], params: ReadResourceReque
     server.add_request_handler("resources/read", ReadResourceRequestParams, handler)
     async with Client(server, extensions=[ClientSkills()]) as client:
         with pytest.raises(ValueError) as exc_info:
-            await client.extension(ClientSkills).read_skill_resource(_skill(), _SKILL_URI)
+            await client.extension(ClientSkills).read_skill_resource(_skill())
     assert str(exc_info.value) == snapshot(
         "resource 'skill://git-workflow/SKILL.md' did not return exactly one matching content item"
     )
@@ -314,7 +335,7 @@ async def handler(ctx: ServerRequestContext[Any, Any], params: ReadResourceReque
     server.add_request_handler("resources/read", ReadResourceRequestParams, handler)
     async with Client(server, extensions=[ClientSkills()]) as client:
         with pytest.raises(ValueError) as exc_info:
-            await client.extension(ClientSkills).read_skill_resource(_skill(), _SKILL_URI)
+            await client.extension(ClientSkills).read_skill_resource(_skill())
     assert str(exc_info.value) == snapshot("resource 'skill://git-workflow/SKILL.md' returned invalid base64 content")
 
 
 
@@ -53,7 +53,7 @@ async def test_read_skill_resource_returns_verified_content() -> None:
     async with Client(tutorial001.mcp, extensions=[skills]) as client:
         catalog = client.extension(Skills)
         skill = await catalog.get_skill(tutorial001.SKILL_URI)
-        result = await catalog.read_skill_resource(skill, skill.uri)
+        result = await catalog.read_skill_resource(skill)
     contents = result.contents[0]
     assert isinstance(contents, TextResourceContents)
     assert contents.text == tutorial001.SKILL_MD