The watch

How a skill gets into the market, who checks it at the gate, and what that does and does not prove.

The road to the market

Requested. Someone adds quarantine/<name>.yaml with three things: the repository, the folder, and an exact git tag. After that, a daily check moves it to each newer release.
Fetched. The tag is cloned and its commit recorded. Symlinks are refused, the SKILL.md must be valid, and its name must match.
Chartered. The repository's charter (license) at that commit must be a recognised SPDX license, or one of the few source-available licenses the market knows by their exact text (their terms are on the charters page). With no license, or an unclear one, the skill waits at the gate. The LICENSE, and the NOTICE if there is one, travel with it.
Watched. Three watchmen read every file, offline and without an LLM. If any of them blocks, the skill waits at the gate until a new tag clears.
Recorded. A pull request copies the files unchanged into approved/<name>/<tag>/ with their provenance and every watchman's report (or, for a skill held at the gate, only its provenance and reports into gate/). CI checks the records again (schemas, content hashes, tests and the build), and a person merges it.
Served. The site pins every skill to the commit it was built from, and the marketplace file it writes for your harness points there, so what you install is what was checked.

The watchmen

SkillSpector

by NVIDIA, version 2.9.6

71 vulnerability patterns in 17 categories: prompt injection, data exfiltration, privilege escalation, supply chain, tool misuse, dangerous code, taint tracking and YARA signatures. Static analysis only; its optional LLM stage is off.

Turns a skill away on a risk score above 20, or any high or critical finding.

Source

Skill Scanner

by Cisco AI Defense, version 2.1.0

Pattern rules (YAML and YARA-X) plus AST and dataflow analysis for prompt injection, data exfiltration and malicious code. Its optional LLM judge is off.

Turns a skill away on any high or critical finding.

Source

Agent Threat Rules

by the ATR project, version 4.0.0

An open rule set for AI agent threats (hundreds of rules across the OWASP Agentic Top 10), run offline with its telemetry reporting switched off.

Turns a skill away on any high or critical match.

Source

What the watch cannot promise

Watchmen find known patterns. A clean report means none of them matched, not that a skill is safe. Their makers say so too.
The scans are static: nothing is run. A skill's instructions can still steer an agent badly, so read the recipe before you install.
Each version is checked once. The market looks for newer upstream releases every day; each is a new version and goes through the watch again, while the version already here stays until the new one clears.
The charter is the upstream repository's license at the pinned commit, as GitHub reports it. It is not legal advice.
Skills that bring scripts are marked on their page. Scripts only run if your agent runs them.

How the market is kept

Guilds are put together by hand, for a kind of work, not by popularity.
Nothing here is paid for: no sponsored places, no bought badges.
There are no install counts or rankings, because there is no honest way to count them.
An admitted version never changes. New releases come in by themselves; to remove a skill, delete it in a pull request.

For machines

/catalog.json: every skill and guild with provenance, license and scan results.
/llms.txt: a plain-text map of the market for language models.
/badges/<name>.svg: a README badge for each admitted skill.