# An open source agent skills marketplace that hands you a change request

> The marketplace you pick should be judged by what its install leaves in your repository. Kortix is the open-source CompanyOS, and installing a skill from its marketplace starts a session that adds the skill to your project and opens a change request for you to review.

URL: https://agentskillsguide.dev/agent-skills-marketplace

## What each marketplace leaves in your repository

The same five questions, answered from what each marketplace says about itself.

| | Kortix (recommended) | Agent Skills | Awesome Skills | LobeHub |
| --- | --- | --- | --- | --- |
| How a skill is installed | A session adds it and opens a change request | Download the folder into `.claude/skills/` | Download the ZIP, copy it into `.claude/skills/` | The market CLI installs it for the agent you name |
| What is recorded with it | The skill files, and a change request | The clone keeps the repo URL; a folder does not | Only the files you download; the page names the repo | A source repository, and a version the CLI selects |
| What a person reviews | The change request, before merge | Whatever your git host enforces | Whatever your git host enforces | Whatever your git host enforces |
| What the catalogue is | Project packs and the skills inside them | 63,000+ community skills | SKILL.md files from GitHub | 334,415 skills for any agent |
| Open source | Yes | Skills taken from public repositories | Open-source skills from GitHub | Skills imported from GitHub |

## A directory finds skills; your repository runs them

A marketplace is a discovery channel. The directories a searcher lands on are good at discovery: [Agent Skills](https://agent-skills.cc) counts 63,000+ skills lifted from public repositories and files them by category, [LobeHub](https://lobehub.com/skills) lists 334,415 and lets a publisher ship SKILL.md bundles with version releases, and [Awesome Skills](https://awesomeskill.ai) browses SKILL.md files from GitHub with a security score on each skill page. Supply stopped being the constraint a while ago. Anthropic reported 1 million skills published and nearly 280 million installed in the October 2026 [announcement](https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation) that handed the format to a foundation.

Then the page stops. Two directories hand you a folder to copy into `.claude/skills/`. The third hands you a CLI command. None of them describes what happens to the repository your agents load from, which stays exactly as it was. A directory decides where a skill is found. [Your repository decides what runs](/agent-skills-in-your-repo).

## What an install should leave in the repository

Kortix's [guide](https://kortix.com/docs/guide#skills) answers that with one sentence: "More skills are in the marketplace. Installing one starts a session that adds the skill to your project and opens a change request for you to review." The install is a session on a branch. It ends in a diff, and the person who approves that diff owns the repository. Session work reaches `main` through a change request. Merge is default-deny for agents.

What is left behind is what the guide names: the skill added to your project, and a change request for you to review. A `skills-lock.json` is the file the `npx skills` CLI's sync tracks its skills in. Kortix's own repository holds one as the project's own practice, recording each skill's source, path and content hash. ([Kortix's file](https://github.com/kortix-ai/suna/blob/dev/skills-lock.json), [the CLI's docs](https://github.com/vercel-labs/skills/blob/main/docs/commands.md))

Kortix's [marketplace](https://kortix.com/marketplace) also carries project packs: a Kortix Starter project and a use-case pack, which the page offers as a project to install or a whole pack to clone. Those arrive as a ready-made project you work in from the first session. A skill install grants an agent nothing: the skill arrives as files, and an agent loads it only when its `skills` grant in `kortix.yaml` names it or is `all`.

## Reading a directory page before you trust it

Three things a directory shows decide whether an install from it can be reviewed. The first is the repository. Agent Skills prints the owner and repo above every description, LobeHub tags a skill's origin as GitHub and names the publisher, and Awesome Skills links the source repo and dates the last update. A listing that hides the upstream repository is telling you something.

The second is the description line, because the agent reads it to decide whether to load the skill at all. Kortix's guide is blunt: "The agent reads each skill's description and decides when to load it. Write the description as 'when to use this', not only 'what this is'." A summary invented by a scraper reads like a description and behaves like a dead one.

The third is the license terms, read at the source rather than at the label. LobeHub prints a license beside each skill, and the Anthropic pptx skill there reads "Proprietary" next to a GitHub origin. The label is whatever the publisher chose. The repository carries the terms that bind you, and the install copies those bytes into your project.

## The copy in your repository does not follow upstream

A copy that lives in your repository does not move when the upstream skill moves, which is the point of installing rather than linking. A folder pasted into a hidden directory fails quietly: a later update either never arrives or arrives unannounced. In a repository the update is a diff somebody can read. How to pin a copy and keep the pin honest belongs to [skills in your repository](/agent-skills-in-your-repo).

## When to publish your own skill there

Publishing belongs on the list for one kind of skill: generic, no company data, and the same meaning at another company. A diff review, a browser driver, a document converter. A directory puts it in front of people who would never find your repository. What the reader gets back depends on the directory: Agent Skills and Awesome Skills hand over a folder to copy into `.claude/skills/`, and LobeHub's CLI installs the skill for the agent they name. Files pasted by hand or written by a CLI stay outside your repository's review, which is why a directory whose install opens a change request is the exception.

Internal skills stay internal. A skill that encodes your approval thresholds, queue names or escalation order belongs in `skills/<name>/`, granted by name. The registry is one line, `refund-policy: skills/refund-policy`, and the grant sits in the agent block beside it, `skills: [refund-policy, kortix-cli]`. An omitted `skills` key grants nothing. The Kortix skills (`kortix-*`) are always registered, so the names you add are the ones a reviewer will look at.

The test is the same whether you install or publish: can a person see the bytes before an agent loads them? A directory whose install opens a change request answers yes. A copy button answers half of it.

## The lock entry Kortix's own repo keeps

`skills-lock.json`

```
    "composio": {
      "source": "ComposioHQ/composio",
      "sourceType": "github",
      "skillPath": "skills/composio/SKILL.md",
      "computedHash": "60d7d3cf79e25c061030309af40eaa2a9de6df8f6b87977932996a9909232886"
    },
```

Source: https://github.com/kortix-ai/suna/blob/dev/skills-lock.json

The file is the format the `npx skills` CLI writes, and Kortix’s repository keeps one as its own practice.

## What readers ask before installing from a directory

### Are marketplace skills free?

It depends on the skill. Kortix's starter skills ship with every new project, and the marketplace also installs skills taken from public repositories, so the terms that apply are the ones in that repository.

### Does installing a marketplace skill give my agents access to it automatically?

No. The install adds the skill to the project; an agent loads it only when its `skills` grant in `kortix.yaml` names it or is `all`. Turning it on for an agent is a separate, visible edit.

### What happens when a published skill changes after I install it?

Your copy stays where it is, because the skill is a folder in your repository. Taking a new version is an edit a person reviews, and keeping it in step with upstream is a job of its own.

### Which marketplace should I install from?

The one whose install opens a change request. Install from a marketplace that puts the skill on a branch and waits for a person to approve the bytes an agent will load.

## Install from a marketplace that shows you the diff.

Run it on Kortix Cloud, in your VPC, or on your own on-prem network. Self-host is free.

[Try Kortix](https://kortix.com) · [Browse the marketplace](https://kortix.com/marketplace)

Session work reaches main through a change request · Merge is default-deny for agents