From a GitHub folder to a vetted listing

1. 01

   Become a publisher

   Create your publisher profile and apply for professional verification. A moderator confirms who you are before any of your versions can be submitted for review.

2. 02

   Import from GitHub

   Point SkillPort at a public GitHub folder containing your skill. We fetch and package it server-side into a tarball and record its SHA-256 checksum; you never upload a binary we cannot reproduce.

3. 03

   Automated scan

   Every version runs through the security scanner before a human sees it. The scan produces findings by severity; a critical finding blocks the version from proceeding.

4. 04

   Human review

   A moderator reviews the scanned package and records an approve, reject, or request-changes decision with a reason. Approval is bound to the exact checksum that was scanned.

5. 05

   Published

   Once approved, the version is published and installable via the CLI. The listing shows the date it was reviewed, never a blanket claim that it is safe.

Ready to start? The Publish area walks you through verification and the import wizard.

A skill is a folder with a SKILL.md at its root plus any supporting files (scripts, references, assets). The SKILL.md front matter carries the name and a description that tells an agent when the skill applies; the body is the instructions the agent follows. SkillPort renders that Markdown through a strict sanitising pipeline, so raw HTML, inline scripts, and cross-origin images are stripped on display.

Keep the description specific and trigger-oriented, and avoid the words claude or anthropic in the skill name. A tightly scoped description is what makes your skill discoverable in search and the command palette.

Each release is a version identified by a semver string, unique per skill. A new version goes through the same scan and review path as the first. If a published version is later found to have a problem, it can be yanked; installers are pointed at the version to move to, and skillport update gets them there. This is why the lockfile records the exact version and checksum on every machine.

A skill can be listed free or priced. Paid installs are gated on an entitlement: the CLI resolves whether the caller holds a licence before the download is authorised, and returns a purchase link when they do not. Free skills grant an entitlement automatically on first install.

Before you publish, it is worth knowing exactly what a scan and a review do and do not claim on your behalf. Read Trust and vetting for the honest version.