spawn.json

[
  {
    "mob": "minecraft:skeleton",
    "result": "allow",
    "helditem": ["minecraft:stick"],
    "nbt": {"Health": 2.0,"Attributes":[{"Base":2.0,"Name":"generic.maxHealth"}],"HandItems":[{"id":"minecraft:bone"}, {}],"ArmorItems":[{},{},{},{}],"CanPickUpLoot":1,"PersistenceRequired": 0}
  },
  {
    "result": "deny"
  }
]

this should make only skeletons spawn, with 2 health, no armor and a bone on their hand
instead it makes only skeletons with 2 health, but a bow on their hand
if it's changed the zombie, the zombies hold a stick
the CanPickUpLoot tag is also not respected
CustomName has no effect either

Hmm this might actually be partially a vanilla limitation. I think skeletons can only hold bows. Not exactly sure about the others. I have to check it out

using the summon command you can get them to hold any item and none at all, and the CustomName etc works there
there must be a difference between summon and whatever you use, but I don't know whose blame it would be, maybe Forge?

hm, figured out using "onjoin": true makes this work