Publishing skills

You wrote a skill, you tested it, your teammates want it. This guide walks through promoting a local skill to your workspace’s global catalog and then to the public marketplace.

Pick the right scope

Audience	Where to publish
Just you / one repo	Keep as `local` in `.cmdop/skills/`.
Your workspace teammates	Promote to global via `cmdop skills publish`.
Anyone with CMDOP	Submit to the marketplace.

Versioning

Skills follow semver in skill.md:


---
name: page-title
version: 0.1.0
---

Bump rules:

Patch (0.1.0 → 0.1.1) — bug fix, no behavior change.
Minor (0.1.0 → 0.2.0) — new feature, backward-compatible.
Major (0.1.0 → 1.0.0) — breaking change.

The marketplace and cmdop skills update use semver to decide what to install.

Manifest review

Before publishing, sanity-check the manifest:

name is unique within the target catalog.
description is a single sentence — it shows in cmdop skills list.
keywords cover the obvious search terms.
schedule is set if the skill is a recurring task.
The system prompt is concise and tool-aware.

Skill names cannot collide with built-in tool names (execute_command, read_file, etc.).

Promote to workspace

Workspace global skills are managed by Owners and Admins:


cmdop skills publish ./my-skill --workspace acme-prod

The CLI:

Validates the manifest.
Bundles the directory (skipping .venv, caches).
Uploads to the workspace’s skill catalog.
Triggers cmdop skills sync for online members.

Teammates pull updates with cmdop skills sync (idempotent).

Test in workspace before public release

Pin the skill to a small group via the cabinet’s skill catalog (mark as beta).
Watch the audit log for a week — look for skill_run failures.
Bump version per semver based on findings.

Submit to the marketplace

Once stable in your workspace, propose to the marketplace:


cmdop skills submit ./my-skill

The marketplace flow:

Static analysis — manifest schema, requirements pinning, no obvious eval / exec on user input.
Editorial review — fit, naming, description quality.
Sandboxed test run — the marketplace runs the skill in an isolated VM with synthetic inputs.
Approval — appears in cmdop skills install <name> for everyone.

Approval typically takes 1–2 business days.

Updating a published skill

Bump the version, then:


cmdop skills publish ./my-skill --workspace acme-prod
# Or for marketplace:
cmdop skills submit ./my-skill --update

Major-version bumps require an explicit --breaking flag and a brief migration note that lands in the changelog.

Deprecating

Mark a skill deprecated to keep it installable but discourage new use:


cmdop skills deprecate <name> --reason 'replaced by foo'

Deprecated skills warn on install, fail sync for new members, and are excluded from search.

Marketplace skills run on user machines with the same permissions as the calling agent. Audit your dependencies before publishing — a compromised dependency compromises every install.

Publishing locally to a workspace is reversible — cmdop skills unpublish removes the global entry. Marketplace removal is more involved and may be subject to a deprecation window for existing installs.