what it does
ai skills are starting to look like real software artifacts: instructions, workflow rules, permissions, tool assumptions, scripts, and setup requirements packaged for agents like Codex, Claude Code, Cursor, and similar tools.
SkillPass is the public surface for finding and inspecting those skills:
- browse skills by tool, category, risk, status, and maintainer
- submit a github url or zip into a validation flow
- validate the package before it becomes a trusted listing
- show a skill passport with schema, permissions, findings, risk, and source
- publish warnings clearly without pretending a skill is risk-free
the first production seed shipped with 17 real Anthropic skills, all validated through the same submit, validate, and publish path that normal listings use.
why i built it
the useful part of an agent skill is also the risky part. a skill can ask the agent to read files, run shell commands, use connectors, send data elsewhere, or make changes in a repo. that should not be copied around as random markdown with no inspection layer.
i wanted a place where skills can be shared, but the default posture is still skeptical. every skill starts untrusted. SkillPass earns confidence by showing what was checked, what was declared, what was detected, and what still needs human judgment.
how it’s built
a quick tour:
- astro + react islands: fast public pages with interactive submission and validation surfaces
- astro ssr: dynamic skill, version, and maintainer pages stay fresh after publish
- hono api: github sign-in, authenticated submissions, ownership rules, and publish routes
- drizzle + neon: users, submissions, validation jobs, versions, and public listing data
- cloudflare r2: content-addressed snapshots and uploaded zip archives
- skill schema package: shared zod contracts for manifests, reports, passports, submission enums, and wire types
- validator package: checks structure, secrets, risky instructions, and undeclared permissions
what’s next
the public directory is live. next up is making the passport more useful:
seed larger source waves, add the AI review layer, improve workflow packs, and
ship the CLI path that makes skillpass add feel native.
discovery is useful only if the install step gets more skeptical, not less.