SkillPass

Submitting a skill

Listing a skill takes a GitHub URL and a minute of validation. No manifest is required - the pipeline infers everything from the layouts agent tools already use. Each account can submit up to 20 times an hour.

The ownership rule

You can only submit repositories you own, or org repositories where your membership is public. That is the anti-impersonation line: nobody can list someone else's work under their own name. (Admin-curated listings of notable third-party skills are the exception, and they are always attributed to the source repo owner, not the curator.)

What you can point at

A single-skill repo - a repository with SKILL.md at its root:

my-skill/
  SKILL.md        <- name + description frontmatter
  reference.md    (any supporting files ship with it)
  scripts/

A skill inside a bigger repo - paste a /tree/ URL pointing at the folder that contains SKILL.md. Only that folder is snapshotted:

https://github.com/you/monorepo/tree/main/skills/my-skill

A workflow pack - a repo whose skills live in the layouts agent tools use. Submit the repo root and it publishes as one listing with every member skill:

my-pack/
  .claude/skills/<name>/SKILL.md    <- entry per member
  .agents/skills/<name>/SKILL.md    <- paired automatically as the codex variant
  skills/<name>/SKILL.md            (single-layout packs work too)

Same-named folders across the two layouts pair automatically as per-tool variants. An explicit root skill.json with a skills[] array stays available as a power-user override - it is never required. The submit form tells you what it detected ("19-skill pack - will list as ...") before you confirm.

What the pipeline does

  1. Pin - the URL resolves to an exact commit; a moving branch is never trusted.
  2. Snapshot - the files are captured to storage with a source hash. Text files only, up to 500 files, 1 MB per file, and 10 MB in total; anything that is not text is left out and flagged asbinary-dropped.
  3. Validate - the snapshot is parsed and scanned; seeValidation & permissions. You watch the steps live on the submit page.
  4. Publish - a passed submission publishes with one click. Warnings publish too (they are advisory); only a hard failure - a leaked secret value, or a package the validator cannot read - blocks listing.

Versions and immutability

Publishing again creates a new version with its own passport; existing passports never change. Permission changes between versions are diffed on the download pre-flight and in the CLI, so your users see exactly what a new version starts asking for.

The version is the one you declare: metadata.version in the SKILL.md frontmatter (the agentskills.io convention) or version in skill.json, as long as it is semver. A republish has to carry a version you have not published before. Without a declaration, SkillPass numbers versions itself: 1.0.0, then 2.0.0, and so on.

After you publish

Your listing appears in the directory immediately; no rebuild is involved. Thedashboard shows your skills with their status, your submissions and how their validation went, and any reports filed against your skills. You can unlist a skill there and relist it later; its published passports stay immutable either way. Your public profile at /u/<username> lists your published skills and your reputation, which grows with each publish.

Anyone can flag a listing with "Report this skill" on its page. Reports go to the admin queue, and a report never changes a passport.

README badge

Show the passport where people find the skill. The badge is an SVG the API renders from the latest published version's validation status and risk level; it links back to the skill page and never shows install counts:

[![SkillPass](https://api.skillpass.dev/skills/your-skill/badge.svg)](https://skillpass.dev/skills/your-skill)

Every skill page has this snippet with the slug filled in and a copy button, under "README badge". GitHub caches badge images for a few minutes, so a new version shows up shortly after it publishes. Unlisting a skill takes the badge with it: the image stops resolving until you relist.

Zip fallback

No public repo? Upload a zip. It goes through the identical snapshot-and-validate pipeline, with the same caps and rules as a repository.