Source repositories

A source is a public GitHub repository that a provider submits. The repository is the single source of truth: the marketplace fetches it server-side, pins the submission to a commit, and installs published skills straight from it. Each source is a first-class record owned by one organisation - it is submitted, reviewed, and archived as a whole, and it is either active or archived. Two organisations can publish the same repository; each gets its own independent source.

From repository to skills

Every directory in the repository that holds a SKILL.md becomes one skill. A repository can carry one skill or a whole catalogue; the provider can also submit only a chosen subset of directories. See Build a skills repository for layout advice.

Pinning

A submission names a commit, a tag, or a branch. A branch resolves to its head commit at submission time; if nothing is named, the default branch’s latest commit is used. Whatever was named, the stored bundle is the repository at exactly that commit - later pushes do not change what was reviewed or what is published.

Marketplace-verified provenance

Because the marketplace fetches the repository itself (never trusting an upload), each source carries verified metadata: the pinned deep link, stars, forks, licence, and last push. Reviewers see all of it during review, and the public source page shows it too.

The source page

Every source has a public page at /marketplace/<provider>/<source>, where <source> is the GitHub repository name. It lists the skills published from that repository, mirroring the /<owner>/<repo>/<skill> convention used on skills.sh.