SkillPass

Submitting a skill

Listing a skill takes a GitHub URL and a minute of validation. No manifest is required - the pipeline infers everything from the layouts agent tools already use.

The ownership rule

You can only submit repositories you own, or org repositories where your membership is public. That is the anti-impersonation line: nobody can list someone else's work under their own name. (Admin-curated listings of notable third-party skills are the exception, and they are always attributed to the source repo owner, not the curator.)

What you can point at

A single-skill repo - a repository with SKILL.md at its root:

my-skill/
  SKILL.md        <- name + description frontmatter
  reference.md    (any supporting files ship with it)
  scripts/

A skill inside a bigger repo - paste a /tree/ URL pointing at the folder that contains SKILL.md. Only that folder is snapshotted:

https://github.com/you/monorepo/tree/main/skills/my-skill

A workflow pack - a repo whose skills live in the layouts agent tools use. Submit the repo root and it publishes as one listing with every member skill:

my-pack/
  .claude/skills/<name>/SKILL.md    <- entry per member
  .agents/skills/<name>/SKILL.md    <- paired automatically as the codex variant
  skills/<name>/SKILL.md            (single-layout packs work too)

Same-named folders across the two layouts pair automatically as per-tool variants. An explicit root skill.json with a skills[] array stays available as a power-user override - it is never required. The submit form tells you what it detected ("19-skill pack - will list as ...") before you confirm.

What the pipeline does

  1. Pin - the URL resolves to an exact commit; a moving branch is never trusted.
  2. Snapshot - the files are captured to storage with a source hash.
  3. Validate - the snapshot is parsed and scanned; seeValidation & permissions. You watch the steps live on the submit page.
  4. Publish - a passed submission publishes with one click. Warnings publish too (they are advisory); only a hard failure - a leaked secret value - blocks listing.

Versions and immutability

Publishing again creates a new version with its own passport; existing passports never change. Permission changes between versions are diffed on the download pre-flight and in the CLI, so your users see exactly what a new version starts asking for.

Zip fallback

No public repo? Upload a zip. It goes through the identical snapshot-and-validate pipeline, with the same caps (500 files, 1 MB per file, 10 MB total).