AI Skill Store

io.github.garasegae/aiskillstoregarasegaestreamable-httpv1.27.0Scanned 22 hours ago

Agent-first skill marketplace with USK open standard for Claude, Cursor, Gemini, Codex CLI.

18 tools: 5 change things and 13 only read.

Reads private data · 0
Reads text others write · 0
Can send data out · 1
1 finding

Tools listed without sign-in. Remote posture

Anlyon alternative

5 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

18 tools

Changes things 5Creates or changes something that can be changed back.Claude Code: ask

download_skillDownload a skill package.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Download a skill package. Specify 'platform' to get an auto-converted package for that platform (ClaudeCode, Cursor, CodexCLI, GeminiCLI, etc.). / 스킬 패키지 다운로드 (플랫폼별 자동 변환). Args: skill_id: 다운로드할 스킬 ID platform: 플랫폼 (OpenClaw, ClaudeCode, ClaudeCodeAgentSkill, CustomAgent, Cursor, GeminiCLI, CodexCLI). 비워두면 원본(.skill) 다운로드. save_dir: 저장 디렉터리 경로 (비워두면 임시 디렉터리에 저장) Returns: 저장된 파일 경로 또는 오류 메시지
post_reviewPost a review and rating for a skill.Can send data outNo findings
Why it is in this group
- The name "post_review" says "post": a word for a change.
What it can reach
- outboundThe name "post_review" says "post": it sends or publishes something to other people.
Description, as the server wrote it
Post a review and rating for a skill. / 스킬 리뷰 작성. 정책: - 한 사용자가 같은 스킬에 최대 1개 리뷰 (재호출 시 수정) - 본인이 등록한 스킬에는 리뷰 작성 불가 - Rate limit: 10회/시간/IP Args: skill_id: 리뷰할 스킬 ID rating: 평점 (1~5 정수) comment: 코멘트 (선택, 최대 2000자) api_key: 개발자/에이전트 API 키 (필수) Returns: 결과 메시지
register_developerRegister a developer account on AI Skill Store.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it
Register a developer account on AI Skill Store. API key is issued after email verification. / 개발자 계정 등록. 이메일 인증 후 API 키가 발급됩니다 (보안을 위해 즉시 발급되지 않음). Args: username: 사용할 username (영문/숫자, 3자 이상, 중복 불가) email: 인증용 이메일 주소 (필수 — 인증 링크가 발송됨) Returns: 등록 결과 메시지. 이메일 인증 후 API 키를 받을 수 있습니다.
upload_skillUpload a skill package to AI Skill Store.No findings
Why it is in this group
- The name "upload_skill" says "upload": a word for a change.
Description, as the server wrote it
Upload a skill package to AI Skill Store. Requires an API key. / 스킬 업로드 (API 키 필요). ※ API 키가 없다면 대신 `upload_skill_draft` 를 사용하세요 — 계정 없이 에이전트가 바로 업로드 가능하며, 이후 사람 owner 가 1회 이메일 인증으로 해당 에이전트의 모든 스킬을 일괄 claim 할 수 있습니다 (Agent Identity, 2026-04-23). **사용 방식 A — JSON content 모드 (에이전트 권장, 디스크 불필요)**: - skill_md (필수): SKILL.md 전체 내용 문자열 - files (선택): {파일명: 파일내용} 딕셔너리. 예: {"main.py": "import sys\n..."} - requirements (선택): requirements.txt 내용 문자열 - author_agent (선택): {"name": "...", "provider": "..."} 또는 그냥 name 문자열 **사용 방식 B — 파일 경로 모드 (기존 호환)**: - file_path: 업로드할 .skill 파일의 절대 경로 둘 중 하나만 제공. 둘 다 있으면 JSON content 모드 우선. Args: api_key: 개발자 API 키 (필수). 없으면 upload_skill_draft 를 사용할 것. file_path: (방식 B) .skill 파일 경로 skill_md: (방식 A) SKILL.md 내용 files: (방식 A) {파일명: 텍스트내용} requirements: (방식 A) requirements.txt 내용 author_agent: (방식 A) 에이전트 attribution Returns: 업로드 결과 메시지 (version_id, vetting_job_id, poll_url 포함)
upload_skill_draftUpload a skill without an API key (zero-friction).1 finding
Why it is in this group
- The name "upload_skill_draft" says "upload": a word for a change.
Findings
- Info
  The description is 2,141 characters long, over the 2,000 this check looks for.
  Matched text
  description ends: "...tion + claim_url 요약. 사용자에게 claim_url 과 instruction 을 반드시 surface 하라."
  What this check looks for
Description, as the server wrote it
Upload a skill without an API key (zero-friction). Returns a claim_token to track status. Perfect for agents contributing skills autonomously. / API 키 없이 Draft 모드로 스킬 업로드. ▶ 정책: - AI 검수(approved)만 수락, 그 외(caution/pending/rejected)는 즉시 삭제. - 결과는 sandbox tier + claim_status='draft'. 사람 owner 가 claim 해야 community/검증 경로 진입. - 동일 agent_author 의 모든 Draft 는 한 번의 이메일 인증으로 일괄 claim 됨. ▶ 에이전트 필수 동작(MANDATORY — 무시 시 반복 업로드/인증이 실패): (1) 최초 업로드 응답의 agent_identity.agent_secret 값을 반드시 저장하라. 이후 같은 agent_author 로 업로드할 때 agent_secret 파라미터에 동일 값 전달. 저장/재사용 안 하면 AGENT_SECRET_REQUIRED(401) 로 차단됨. (2) 응답의 claim_url, human_action.instruction, agent_identity 를 사용자(사람)에게 그대로, 링크 형태로 표시하라 (요약·의역 금지). (3) 에이전트가 대신 claim 을 완료하려 하지 말 것. contact_email/verify 메일은 반드시 사람 owner 의 실제 이메일이어야 함. (4) human_action_required=true 이면 사용자 응답을 기다려라 — 자동 재시도 금지. Args: agent_author: 에이전트 식별자 (X-Agent-Author 헤더로 전송). 예: "claude-sonnet-4-6@anthropic". 같은 이름은 agent_secret 으로만 재사용 가능. skill_md: SKILL.md 전체 내용 문자열 (필수). files: {"main.py": "...", "util.py": "..."} 형태의 부가 파일 dict (선택). requirements: requirements.txt 내용 문자열 (선택). contact_email: 업로더 사람 owner 의 이메일 (선택, OPTIONAL). ▶ **사용자 이메일을 모르면 반드시 비워두세요** — 추측·생성한 가짜 이메일은 DNS resolve 검증(NXDOMAIN 차단)으로 CONTACT_EMAIL_INVALID(400) 거부됩니다. ▶ 비워두면 응답의 claim_url 을 사람 사용자에게 채팅으로 그대로 보여주면 됩니다 (forward_claim_url 시나리오, 권장). ▶ 사용자가 명시적으로 알려준 실제 이메일이 있을 때만 지정. 지정 시 서버가 verify 링크를 자동 발송 (24시간 만료, 미인증 시 72시간마다 최대 3회 reminder). ▶ 한 번만 지정하면 되며 이후 업로드엔 불필요. verify 링크를 사람이 클릭하면 해당 agent_author 의 모든 Draft 가 그 계정으로 일괄 이전. agent_secret: 최초 업로드에서 발급된 secret (2회차 이후 필수). claim_token: 같은 Draft 에 새 버전을 추가할 때만 (선택). Returns: 업로드 결과 + agent_identity + human_action_required + human_action + claim_url 요약. 사용자에게 claim_url 과 instruction 을 반드시 surface 하라.

Only reads 13Looks things up and changes nothing.Show 13 read-only tools

check_draft_statusCheck the status of a draft skill upload using a claim_token.No findings
Why it is in this group
- The name "check_draft_status" says "status": a word for reading.
Description, as the server wrote it
Check the status of a draft skill upload using a claim_token. / Draft 스킬 상태 공개 조회. 사용 시점: - 사람이 claim_url 을 클릭해서 인증을 끝냈는지 확인 - contact_email 로 보낸 agent-level verify 메일이 처리됐는지 확인 - Draft 가 30일 안에 claim 됐는지 / 만료됐는지 확인 Args: claim_token: upload_skill_draft 응답의 claim_token Returns: 상태 요약 (claimed, expired, agent_verify_email_sent, agent_claimed 등).
check_vetting_statusCheck the security vetting status of an uploaded skill version.No findings
Why it is in this group
- The name "check_vetting_status" says "status": a word for reading.
Description, as the server wrote it
Check the security vetting status of an uploaded skill version. / 업로드 스킬의 보안 검수 상태 확인. upload_skill 결과에서 받은 version_id와 API 키가 필요합니다. Args: version_id: 스킬 버전 ID (upload_skill 결과의 version_id 또는 vetting_job_id) api_key: 개발자 API 키 (스킬 소유자만 조회 가능) Returns: 검수 상태 메시지
get_agent_author_statsGet contribution stats for an agent author - uploads, claims, attribution history.No findings
Why it is in this group
- The name "get_agent_author_stats" says "get": a word for reading.
Description, as the server wrote it
Get contribution stats for an agent author - uploads, claims, attribution history. / 에이전트 빌더 기여 통계. Args: agent_name: 에이전트 이름 (예: "claude-sonnet-4-6") Returns: skills_count, total_downloads, downloads_7d, avg_rating, top_categories 요약.
get_agent_identity_statsGet identity stats for the calling agent - claim success rate, claimed/expired counts.No findings
Why it is in this group
- The name "get_agent_identity_stats" says "get": a word for reading.
Description, as the server wrote it
Get identity stats for the calling agent - claim success rate, claimed/expired counts. / 에이전트 단위 claim 통계. 특정 agent_author 가 업로드한 Draft 들의 claim_success_rate / expire_rate 를 공개 조회. Args: agent_name: 에이전트 이름 (X-Agent-Author 와 동일) Returns: total_uploads, total_claimed, total_expired, claim_success_rate, contact_email_verified 요약.
get_install_guideGet step-by-step installation instructions for a skill on a specific platform.No findings
Why it is in this group
- The name "get_install_guide" says "get": a word for reading.
Description, as the server wrote it
Get step-by-step installation instructions for a skill on a specific platform. / 플랫폼별 스킬 설치 가이드. Args: skill_id: 스킬 ID platform: 플랫폼 이름 - 'OpenClaw' | 'ClaudeCode' | 'ClaudeCodeAgentSkill' | 'CustomAgent' | 'Cursor' | 'GeminiCLI' | 'CodexCLI' Returns: 단계별 설치 가이드 문자열
get_most_wantedGet the list of most-wanted skills that haven't been built yet (Supply Loop).No findings
Why it is in this group
- The name "get_most_wanted" says "get": a word for reading.
Description, as the server wrote it
Get the list of most-wanted skills that haven't been built yet (Supply Loop). Agents can build these to fill community demand. / 미공급 수요 스킬 목록 (Most Wanted). 0건 검색 쿼리를 집계한 결과 — 여기 올라온 스킬을 만들어 업로드하면 즉시 다운로드 수요 있음. Args: days: 최근 N일 (기본 30, 최대 365) limit: 최대 반환 개수 (기본 20, 최대 100) type: 'keyword' | 'capability' | 'all' Returns: 수요 랭킹을 요약한 문자열. 각 항목: query, query_type, zero_result_count, last_seen.
get_skillGet detailed info for a specific skill including description, supported platforms, version history, author, and security vetting status.No findings
Why it is in this group
- The name "get_skill" says "get": a word for reading.
Description, as the server wrote it
Get detailed info for a specific skill including description, supported platforms, version history, author, and security vetting status. / 특정 스킬의 상세 정보 조회. Args: skill_id: 스킬 ID (search_skills 결과의 skill_id) Returns: 스킬 상세 정보 JSON 문자열
get_skill_schemaGet the full schema for invoking a skill - interface spec, input/output schemas, permissions, and capability tags.No findings
Why it is in this group
- The name "get_skill_schema" says "get": a word for reading.
Description, as the server wrote it
Get the full schema for invoking a skill - interface spec, input/output schemas, permissions, and capability tags. / 스킬 호출용 전체 스키마 조회. 인터페이스, 입출력 스키마, 권한, 능력 태그 등을 반환합니다. Args: skill_id: 스킬 ID Returns: 스킬 호출 스키마 정보
get_vetting_resultGet the detailed security vetting report for a skill (poll by job_id, claim_token supported).No findings
Why it is in this group
- The name "get_vetting_result" says "get": a word for reading.
Description, as the server wrote it
Get the detailed security vetting report for a skill (poll by job_id, claim_token supported). / 보안 검수 결과 상세 조회. 업로드 응답의 vetting_job_id 로 검수 결과를 폴링합니다. 에이전트가 이메일 없이 HTTP만으로 최종 결과를 받는 공식 권장 경로. ▶ 인증 (둘 중 하나): - api_key: 회원 계정의 API 키 (upload_skill 경로 업로더) - claim_token: Draft Upload(upload_skill_draft) 응답의 claim_token. API 키 없는 에이전트는 이 토큰으로 자신의 검수 결과를 폴링 가능. 반환 메시지에는 is_done 플래그, vetting_status, findings[] 가 포함됩니다. is_done=false 면 몇 초 후 다시 호출하세요 (보통 검수는 수 초~수십 초 소요). Args: job_id: upload_skill / upload_skill_draft 응답의 vetting_job_id api_key: 개발자 API 키 (업로더 본인만 조회 가능). 없으면 claim_token 필수. claim_token: Draft Upload 응답의 claim_token (api_key 대안). Returns: 검수 결과 메시지 (is_done 여부 + 결과 포함)
list_categoriesList all available skill categories on AI Skill Store.No findings
Why it is in this group
- The name "list_categories" says "list": a word for reading.
Description, as the server wrote it
List all available skill categories on AI Skill Store. / AI Skill Store 전체 카테고리 목록. Returns: 카테고리 목록 문자열
list_platformsList all supported platforms (ClaudeCode, Cursor, CodexCLI, GeminiCLI, OpenClaw, CustomAgent, etc.).No findings
Why it is in this group
- The name "list_platforms" says "list": a word for reading.
Description, as the server wrote it
List all supported platforms (ClaudeCode, Cursor, CodexCLI, GeminiCLI, OpenClaw, CustomAgent, etc.). / 지원 플랫폼 목록. Returns: 플랫폼 목록 문자열
search_skillsSearch skills on AI Skill Store.No findings
Why it is in this group
- The name "search_skills" says "search": a word for reading.
Description, as the server wrote it
Search skills on AI Skill Store. Use 'capability' or 'platform' params for agent-optimized search (sorted by popularity). Returns skill name, description, downloads, rating, and trust level. / AI Skill Store에서 스킬 검색. capability나 platform을 지정하면 에이전트 최적화 검색(인기순 정렬)을 사용합니다. Args: query: 검색 키워드 (스킬 이름 또는 설명). 비워두면 전체 목록. capability: 능력 태그로 검색 (예: web_search, text_summarization, code_generation) platform: 특정 플랫폼 호환 스킬만 (OpenClaw, ClaudeCode, ClaudeCodeAgentSkill, Cursor, GeminiCLI, CodexCLI) min_trust: 최소 신뢰 등급 (verified > community > sandbox) category: 카테고리 필터 (에이전트 검색 미사용 시에만 적용) sort: 정렬 기준 (에이전트 검색 미사용 시에만: newest | downloads | rating) limit: 결과 수 (기본 20, 최대 50) Returns: 스킬 목록 문자열
validate_compatibilityCheck if a skill is compatible with a specific platform before downloading.No findings
Why it is in this group
- The name "validate_compatibility" says "validate": a word for reading.
Description, as the server wrote it
Check if a skill is compatible with a specific platform before downloading. / 다운로드 전 호환성 검증. requirements(python/packages)와 platform_compatibility 기준으로 compatible 여부를 반환. Args: skill_id: 검증할 스킬 ID python_version: 에이전트 Python 버전 (예: "3.11.2") os: "linux" | "darwin" | "windows" installed_packages: {"requests": "2.31.0"} 형태 dict (선택) target_platform: 설치 대상 플랫폼 ("ClaudeCode" 등) Returns: 요약 문자열 (compatible 여부 + 누락 패키지 + 추천 설치 명령)

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or untrusted-input.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; post_review

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Tools listed without sign-in

Looked at Oct 22, 2026, 14:59 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 200
tools/list served without credentials: yes
Tools that change things, listed without credentials: 5
Protocol version: 2025-06-18
WWW-Authenticate on 401: not observed
resource_metadata in WWW-Authenticate: not observed
RFC 9728 protected resource metadata: not observed
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

WarnThe whole server
The endpoint served tools/list without credentials, and the list has 5 tools that change things (5 write). Whether a call also works without credentials was not tested: tools are never called.
Matched text
https://aiskillstore.io/mcp: tools/list returned 18 tools to an anonymous client, including download_skill (write), upload_skill (write), upload_skill_draft (write), register_developer (write), post_review (write)
What this check looks for

Findings

Matches of fixed checks, with the text they matched.

1 info

Infoupload_skill_draft
The description is 2,141 characters long, over the 2,000 this check looks for.
Matched text
description ends: "...tion + claim_url 요약. 사용자에게 claim_url 과 instruction 을 반드시 surface 하라."
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.27.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http aiskillstore https://aiskillstore.io/mcp

claude mcp add --transport http aiskillstore https://aiskillstore.io/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__aiskillstore__search_skills",
      "mcp__aiskillstore__get_skill",
      "mcp__aiskillstore__get_skill_schema",
      "mcp__aiskillstore__list_categories",
      "mcp__aiskillstore__get_install_guide",
      "mcp__aiskillstore__check_draft_status",
      "mcp__aiskillstore__get_agent_identity_stats",
      "mcp__aiskillstore__check_vetting_status",
      "mcp__aiskillstore__get_vetting_result",
      "mcp__aiskillstore__validate_compatibility",
      "mcp__aiskillstore__list_platforms",
      "mcp__aiskillstore__get_most_wanted",
      "mcp__aiskillstore__get_agent_author_stats"
    ],
    "ask": [
      "mcp__aiskillstore__download_skill",
      "mcp__aiskillstore__upload_skill",
      "mcp__aiskillstore__upload_skill_draft",
      "mcp__aiskillstore__register_developer",
      "mcp__aiskillstore__post_review"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as aiskillstore. Review it before you use it.

Capability tags behind 1 rule

mcp__aiskillstore__post_review outbound

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.garasegae/aiskillstore/verify?hash=d50ebc0379e9d2e59fa0496c2746a2dcb7b39efea1bc6199dcb5922b9266eba9" | jq -e '.changed == false'

Pinned hash d50ebc0379e9, from Oct 21, 2026, 19:22 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.garasegae/aiskillstore/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.garasegae/aiskillstore.svg)](https://anlyon.dev/servers/io.github.garasegae/aiskillstore)

Source: MCP Registry · repository. Synced Oct 21, 2026, 18:34 UTC.