Skill hub & multi-source search

Phases 7.2–7.4 · designs: marketplace fetch · hub UI · multi-source search

The /skills/hub page finds skills from the outside world and saves them as plugin-source skill resources.

Marketplace browse

Browses allowlisted catalogs (default: anthropics/claude-plugins-official) with category and free-text filters. The catalog is fetched through the server's single allowlisted outbound HTTP surface with a TTL cache — entries save as skills with their git/url/github source preserved.

Multi-source search

A non-empty search box fans the query out to all registered sources in parallel:

• GitHub taps (default: the four trusted repos, optional GITHUB_TOKEN),
• /.well-known/skills/index.json endpoints (URL-query only),
• direct URLs (fetch-only),
• the marketplace catalog cache.

Each source has its own timeout — a slow or rate-limited source simply contributes nothing and is reported in the results. Cross-source duplicates are deduped by identifier, keeping the higher-trust copy. Every row carries a source badge and a trust badge (neutral colors — trust is not a connection state).