Marketplace skills

Give a seat a specific skill, let it inspect an approved catalog, or let it choose a bounded set of skills for its work. Use Claude marketplace repositories as a source for Claude Code, Codex and Pi.

This feature is available when building from this source revision. It is not a claim that the previously released provider or seat images include it. Build and deploy matching platform, provider and seat-runner versions.

Register a pinned marketplace and select skills

Add skill_marketplaces to the organisation and skills to the relevant seats. Registration is a Steadmesh source declaration, not a call to claude plugin install. A marketplace contains plugins, and a plugin can contain several skills: all three parts of each selection are explicit.

The example below is illustrative. Replace the repository, commit and plugin/skill names with a marketplace you have reviewed. company is your stable alias; it need not equal the marketplace manifest's name. var.reviewed_marketplace_commit must be the full lowercase 40-character Git commit SHA, not a branch or tag.

skill_marketplaces = {
  company = {
    repository = "your-org/agent-skills"
    ref        = var.reviewed_marketplace_commit
  }
}

seats = {
  analyst = {
    # Keep this seat's existing harness, execution and other attributes.
    skills = {
      mode         = "agent_choice"
      marketplaces = ["company"]
      install = [{
        marketplace = "company"
        plugin      = "document-tools"
        skill       = "pdf"
      }]
      max_dynamic_skills = 16
    }
  }
}

The install list is Terraform-owned. The agent cannot remove entries from it. A marketplace declaration alone grants no seat access: each seat has its own explicit marketplaces allowlist.

Choose the amount of autonomy

Omit skills to disable this surface. The dynamic limit defaults to 16 and may be 1–128; it excludes Terraform selections. Up to 128 explicit selections and 32 allowed marketplaces may be declared for a seat, and up to 128 sources for an organisation.

Let the seat inspect and choose

• skills.list lists the permitted catalog and reports terraform or agent ownership for selected skills. Follow pagination. Unsupported plugin sources appear as diagnostic entries, not installable skills.
• skills.read reads a skill's instructions in bounded pages, without installing it.
• skills.install selects a marketplace/plugin/skill triple for the next turn. It validates and fetches the entire candidate selection before recording the choice, checking aggregate size and file limits. Concurrent selection changes return a conflict so the seat can re-read and retry.
• skills.remove removes an agent-owned selection for the next turn. It cannot remove Terraform-owned selections.

Discovery is not an instruction to install everything. A seat should inspect relevant skills, treat their content as untrusted advice, and select only what its task needs. Selecting a skill does not grant credentials, network access or platform tools.

Apply and revocation

Runtime selections live separately from Terraform state. Applying an unchanged declaration preserves them. Removing a marketplace from a seat, changing its pinned source, disabling agent choice, or reducing its cap prunes choices that are no longer allowed. Reducing a cap keeps the lexicographically first eligible references. Promoting an agent selection into install transfers ownership to Terraform; removing it from Terraform later does not resurrect an older agent choice.

The platform checks current committed policy on every tool call and every skill-bundle fetch, including a second check after network work. Mutations are lease-fenced and checked transactionally. Harnesses refresh before each turn. An install or removal made during a turn therefore takes effect on the next turn, not midway through a running reasoning loop. Previously read information cannot be erased from session history.

On a fetch, validation or reload error, the next turn fails rather than running with a stale managed skill set. A missing explicit skill is a configuration error, not a reason to silently run without it. Fix the declaration/source or remove a bad dynamic choice through the authorised tool surface. Disposable task workers do not inherit the parent seat's persistent skill-management authority.

How each harness loads the same files

• Claude Code: managed skills require system_prompt_snapshot = "off" (the default), so resumed turns cannot keep a stale prompt snapshot; generated skill-only plugin directories supplied explicitly with --plugin-dir, including in bare mode. Original plugin manifests are not enabled.
• Codex: extra skill roots and a verified forced skill scan. A changed selection restarts the app-server and resumes the same native thread, so it cannot keep a stale skill catalog.
• Pi: explicit skill paths; a changed selection restarts the harness process and resumes its saved native session.

Native skill names use sm-<skill>-<stable reference hash> so equally named skills from different plugins cannot shadow one another. The generated frontmatter name and directory are changed together; other supported metadata and the instruction body are preserved. Refer to skills by their original marketplace/plugin/skill triple in platform tools. Each turn receives a fresh, bounded snapshot. Removing all selections unloads the managed set. Existing local skills and the harness's own built-in skills are separate; this policy controls marketplace acquisition through Steadmesh, not every file an agent can create using already-authorised workspace tools.

Supported source format and safety limits

Sources must be public GitHub repositories pinned to a full commit. The platform reads a fixed-host HTTPS archive and .claude-plugin/marketplace.json. Plugin sources must be relative paths inside that repository. Standard skills/<name>/SKILL.md layouts and explicit skill paths from supported marketplace/plugin manifests are recognised.

Remote plugin repositories, git-subdir, npm, command, archive and arbitrary-URL sources are not followed. Private repositories and credentialed fetching are not supported. Vendor a reviewed skill directory into the pinned marketplace repository instead. Fetching requires platform outbound access to codeload.github.com; it does not add seat egress permissions.

Only the selected skill directory and its supporting files are copied. Plugin hooks, MCP/LSP servers, agents, commands, dependencies and install scripts are not installed. Skill frontmatter that adds hooks or allowed-tools, and shell preprocessing using bang-backtick commands, are rejected rather than silently executed or stripped. Nested SKILL.md files are rejected to prevent extra skills being loaded implicitly. Supporting scripts are copied as mode 0600, without execute bits; an agent can invoke an explicit interpreter such as Python or Bash using tools it already has. No script runs during acquisition. This is not a sandbox for malicious skill instructions.

Archive fetching rejects redirects, traversal, absolute paths, symlinks and ambiguous entries. Limits are 16 MiB compressed, 64 MiB expanded, 10,000 archive entries and 8 MiB per file. One skill is limited to 8 MiB and 512 files; the entire wire bundle is limited to 16 MiB including base64, and the native snapshot to 4,096 files. Oversized content fails clearly rather than being truncated. Apply validates policy and references structurally without fetching marketplace content. Missing, unsupported or oversized Terraform selections fail closed at turn start and must be corrected in the declaration; dynamic installs validate the complete candidate set before committing.

Format references: Claude marketplace documentation, plugin manifest reference, and skill documentation. Steadmesh intentionally supports the safe, portable subset described above, not every native plugin feature.