An open source agent skills marketplace that hands you a change request

A directory finds skills; your repository runs them

A marketplace is a discovery channel. The directories a searcher lands on are good at discovery: Agent Skills counts 63,000+ skills lifted from public repositories and files them by category, LobeHub lists 334,415 and lets a publisher ship SKILL.md bundles with version releases, and Awesome Skills browses SKILL.md files from GitHub with a security score on each skill page. Supply stopped being the constraint a while ago. Anthropic reported 1 million skills published and nearly 280 million installed in the October 2026 announcement that handed the format to a foundation.

Then the page stops. Two directories hand you a folder to copy into .claude/skills/. The third hands you a CLI command. None of them describes what happens to the repository your agents load from, which stays exactly as it was. A directory decides where a skill is found. Your repository decides what runs.

What an install should leave in the repository

Kortix's guide answers that with one sentence: "More skills are in the marketplace. Installing one starts a session that adds the skill to your project and opens a change request for you to review." The install is a session on a branch. It ends in a diff, and the person who approves that diff owns the repository. Session work reaches main through a change request. Merge is default-deny for agents.

What is left behind is what the guide names: the skill added to your project, and a change request for you to review. A skills-lock.json is the file the npx skills CLI's sync tracks its skills in. Kortix's own repository holds one as the project's own practice, recording each skill's source, path and content hash. (Kortix's file, the CLI's docs)

Kortix's marketplace also carries project packs: a Kortix Starter project and a use-case pack, which the page offers as a project to install or a whole pack to clone. Those arrive as a ready-made project you work in from the first session. A skill install grants an agent nothing: the skill arrives as files, and an agent loads it only when its skills grant in kortix.yaml names it or is all.

Reading a directory page before you trust it

Three things a directory shows decide whether an install from it can be reviewed. The first is the repository. Agent Skills prints the owner and repo above every description, LobeHub tags a skill's origin as GitHub and names the publisher, and Awesome Skills links the source repo and dates the last update. A listing that hides the upstream repository is telling you something.

The second is the description line, because the agent reads it to decide whether to load the skill at all. Kortix's guide is blunt: "The agent reads each skill's description and decides when to load it. Write the description as 'when to use this', not only 'what this is'." A summary invented by a scraper reads like a description and behaves like a dead one.

The third is the license terms, read at the source rather than at the label. LobeHub prints a license beside each skill, and the Anthropic pptx skill there reads "Proprietary" next to a GitHub origin. The label is whatever the publisher chose. The repository carries the terms that bind you, and the install copies those bytes into your project.

The copy in your repository does not follow upstream

A copy that lives in your repository does not move when the upstream skill moves, which is the point of installing rather than linking. A folder pasted into a hidden directory fails quietly: a later update either never arrives or arrives unannounced. In a repository the update is a diff somebody can read. How to pin a copy and keep the pin honest belongs to skills in your repository.

When to publish your own skill there

Publishing belongs on the list for one kind of skill: generic, no company data, and the same meaning at another company. A diff review, a browser driver, a document converter. A directory puts it in front of people who would never find your repository. What the reader gets back depends on the directory: Agent Skills and Awesome Skills hand over a folder to copy into .claude/skills/, and LobeHub's CLI installs the skill for the agent they name. Files pasted by hand or written by a CLI stay outside your repository's review, which is why a directory whose install opens a change request is the exception.

Internal skills stay internal. A skill that encodes your approval thresholds, queue names or escalation order belongs in skills/<name>/, granted by name. The registry is one line, refund-policy: skills/refund-policy, and the grant sits in the agent block beside it, skills: [refund-policy, kortix-cli]. An omitted skills key grants nothing. The Kortix skills (kortix-*) are always registered, so the names you add are the ones a reviewer will look at.

The test is the same whether you install or publish: can a person see the bytes before an agent loads them? A directory whose install opens a change request answers yes. A copy button answers half of it.