Skip to content
SKILLS

Open publishing

Publish to the registry

Reading and downloading never need an account. Publishing does: every release is authenticated, scoped to a namespace you own, audited and attributable.

  1. 01

    Package

    Put an agent-registry.json wrapper manifest next to your existing files. Your SKILL.md, package.json or pyproject.toml stay exactly as they are.

  2. 02

    Validate

    The CLI checks the manifest, paths, sizes and SKILL.md frontmatter, and scans for credentials and risky patterns. Nothing is executed.

  3. 03

    Dry run

    Review the exact file list, declared permissions, target namespace, visibility and checksum before anything leaves your machine.

  4. 04

    Publish

    A scoped token uploads the archive. The server re-validates it and creates an immutable release, or quarantines it for human review.

  5. 05

    Verify

    The CLI re-downloads the release and compares its SHA-256 with what you built.

From your terminal

Publish a skill
skills login
skills init ./my-skill --type skill --name @you/my-skill
skills validate ./my-skill
skills publish ./my-skill --dry-run
skills publish ./my-skill --visibility public

Full reference: CLI · manifest and validation rules · publishing from Claude Code.

Getting a publisher account

Self-service sign-up is not open yet. Publisher accounts and namespaces are currently created by the registry operator after a short identity check, so that a namespace means something.

To request one, write through the contact page with the namespace you would like and a link that establishes who you are (institutional page, repository host profile or personal site).

Already have an account? Sign in to create artifacts, upload releases from the browser and issue scoped API tokens.

What the registry enforces

  • Immutable releases

    A published version can never be changed or replaced. Corrections are new versions; compromised versions are revoked, not erased.

  • Scoped tokens

    Tokens carry only the scopes and namespaces you grant, expire, can be rotated and revoked, and are stored only as a keyed hash.

  • Static inspection only

    Archives are parsed in memory and scanned. The registry never extracts them to disk or runs their content.

  • Honest trust signals

    Verified identity and verified source are separate badges. Passing static checks is never presented as “secure”.

  • Hard limits

    Archives up to 20 MB, 64 MB unpacked, 2000 files. No symlinks, no path traversal, no VCS data or key files.

  • Blocked on secrets

    A release containing what looks like a private key or an API credential is rejected before publication.

↑↓ to navigate · enter to open · esc to close