Conversation
The skyflow-skills plugin moves to a dedicated skills-only marketplace
(SkyflowFoundry/skyflow-skills) so a security team can authorize the
skills without authorizing the MCP servers. Allowlisting a marketplace
authorizes every plugin in it, so the skills-only guarantee requires a
source that contains no MCP servers.
This repo becomes the MCP-only marketplace:
- Remove the skyflow-skills-plugin/ directory
- Drop skyflow-skills from marketplace.json and add renames:
{"skyflow-skills": null} so existing users get a clean migration notice
- Remove the skills-only validate/package CI (moved to the skills repo)
- Rewrite README/CONTRIBUTING as MCP-only and point skills users at the
new marketplace
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EM64x84NsCFmy44MGYUeEx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The security team is happy to authorize a Claude Code marketplace that contains only the
skyflow-skillsplugin, but not one that also carries the MCP servers (which they haven't yet approved for global internal use).In Claude Code, allowlisting a marketplace (
strictKnownMarketplaces) authorizes every plugin listed in it — there's no per-plugin gate. So a "skills-only" guarantee requires the authorized source to physically contain no MCP servers. The cleanest way to achieve that is a dedicated skills-only marketplace repo, with this repo slimmed down to just the MCP plugins.The skills now live in
SkyflowFoundry/skyflow-skills(marketplace nameskyflow-skills-marketplace).What changed in this repo
skyflow-skills-plugin/directory (moved to the new repo, unchanged).marketplace.json: dropped theskyflow-skillsentry (now listsskyflow-developer-mcpandskyflow-runtime-mcponly), added a marketplacedescription, and addedrenames: { "skyflow-skills": null }so existing users get an automatic "removed from this marketplace" notice instead of aplugin-not-founderror. (Automatic migration requires Claude Code v2.1.193+.)validate-skills/package-skillsworkflows + scripts) — these moved to the skills repo, which is now the source of truth for the standalone skill.zipreleases.The
draft/directory is left in place (it isn't part of the published plugins).Sequencing
Merge this after the new
SkyflowFoundry/skyflow-skillsmarketplace is live, so there's no window where the skills aren't installable from any marketplace. The MCP plugins and theirSKYFLOW_*environment variables are unchanged.Validation
claude plugin validate .→ passes.marketplace.jsonparses; both MCP plugin sources resolve.🤖 Generated with Claude Code
https://claude.ai/code/session_01EM64x84NsCFmy44MGYUeEx
Generated by Claude Code