How it works

The marketplace runs an app-store style pipeline: providers publish from source, the marketplace verifies, humans review, and agents install. No vendor, model, or tool lock-in at any step.

The pipeline

1. A provider publishes. The provider names a public GitHub repository. Every directory that holds a SKILL.md becomes one skill, and the submission is pinned to a commit, tag, or branch head. The marketplace fetches the repository server-side, so the stored files, stars, licence, and commit are marketplace-verified provenance. See Publish and update skills.
2. Automated checks run. Each skill bundle is validated at submission: manifest present and parseable, required fields, valid OpenAPI 3.x specs, valid JSON schemas, resolvable dependencies. The report travels with the submission as evidence - failing checks inform the reviewer, they never auto-reject. See Automated checks.
3. A human reviews. A reviewer claims the submission, inspects the bundle, the check report, and the source repository, and approves, rejects, or requests changes. See The review process.
4. The skill is published. Approved skills appear in the public catalog under their provider, with a public review trail.
5. Anyone installs. One command adds a provider’s skills to Claude Code, Codex, opencode, or Pi, straight from the source repository. See Install skills.

Updating a published skill

Updating a listing is resubmitting the repository at a new commit or tag. The new version goes through a fresh review while the published one stays live; on approval the new version supersedes the old one. Nothing is edited in place.

Why source-pinned publishing

Skills instruct AI agents, so their provenance matters. Because the marketplace fetches the repository itself and pins the submission to a commit, a published skill is exactly what was reviewed - not what the repository happens to contain later.