marketplace

What the Skill Store repo holds

The Skill Store repository is the open source content repository behind skillstore.io. The README states it stores every approved Agent Skill, the records that go with it, and the automated security audits published with each skill. An Agent Skill here follows the Agent Skills specification, which defines how a skill is described and what files it contains. The repository is a companion to the Skill Store platform, not the place where skills are submitted.

The README is explicit that this repo is not where you add a skill. Skills are added through skillstore.io, and its review pipeline writes to this repository automatically. A contributor is told not to open a pull request here to add a skill, and the README warns that pull requests adding skills will be closed. This separation keeps the published catalog in sync with the platform's review process rather than with ad hoc edits. The page then points readers to the contributing section for the correct path. The framing is unusual for an open source project because the source of truth for content is the platform, and the git repository is the public, auditable output of that pipeline rather than a place for direct contribution. For a reader browsing GitHub, this means the folder contents are best treated as a mirror of the marketplace rather than a development tree to fork.

Installing and contributing skills

Installing a skill uses the skillstore CLI. The README recommends one command that works for both Claude Code and Codex: npx skillstore add author/skill-name. A concrete example adds aiskillstore/code-review. The CLI downloads the skill and drops it into the right skills directory for the tool. Claude Code auto discovers it, while for Codex the session must be restarted. For people who prefer to install by hand, or who use Claude Web, the README links full installation guides covering the CLI, manual steps, and ZIP upload, plus the scope directories such as the various skills folders used by each tool.

Contributing a skill also goes through the platform. The steps are to visit skillstore.io/submit, enter the GitHub repository URL that contains the SKILL.md file, let the submission run through automated security analysis, wait for a maintainer to review and approve it, and on approval see the skill published in the repo and on skillstore.io. A valid skill needs a SKILL.md as the required definition per the Agent Skills spec, may include supporting files it references, and should carry a LICENSE. The README stresses that the review pipeline writes the approved skill into this repository, so the public catalog reflects what passed review rather than what was merged directly.

Security audits and repository layout

Security is a core part of the submission flow. Every submission is scanned automatically before it can be published. The audit flags dangerous code patterns such as eval, exec, and raw system commands. It looks for file access outside the project scope, network calls to external hosts, obfuscated or minified code, and credential or secret handling. The README notes that the security analysis is report only: findings inform maintainers and users, but a risk result does not automatically block an otherwise approved skill from being published. The methodology, limitations, and risk level definitions are documented in a Security Trust Center linked from the page, and a live security passport badge example is shown.

The repository layout reflects this automated maintenance. A skills directory holds the approved, published skills, one folder each with its SKILL.md. A pending directory holds submissions awaiting review. A packages directory contains the CLI and the skillstore package. A schemas directory holds JSON schemas for skill records, and a scripts directory holds maintenance and scoring scripts. GitHub workflow files under .github/workflows handle submission, audit, and sync automation. The README says the contents are maintained by Skill Store's automated pipeline and that manual changes are limited to maintainers. The marketplace catalog itself is MIT licensed, while individual skills carry their own licenses, which a user checks in each skill's LICENSE file.

Editorial conclusion

The marketplace catalog is published under the MIT license, with the repository at github.com/aiskillstore/marketplace.