The Skills Marketplace Is a Two-Way Street
I wrote a few weeks ago about the Skills I use daily inside LacPointer. GitHub, Weather, Crypto Tracker — all solid. But the thing I didn't mention is that the marketplace isn't a closed garden. Anyone can build and submit a skill. The docs exist, the developer portal exists, and the approval process is actually pretty fast for simple tools.
I had a use case that nothing in the marketplace covered: I wanted to query an internal status API we run for our deployments and ask LacPointer things like "is the staging server up?" without leaving the bar. So I built a skill for it. This post walks through the whole thing.
What a Skill Actually Is
A LacPointer skill is a zip bundle. Inside that zip there's a manifest.json at the root and whatever JS files your tools need. That's it. No framework, no package to install, no build step unless you want one.
When a user installs your skill, the AI gets your tool definitions added to its context automatically. The AI reads your tool descriptions in plain English and figures out when to call them. When a user asks something your skill handles, the AI calls the tool and responds naturally. The user doesn't have to say "use the status skill" — they just ask and it figures it out.
That last part matters. Write your tool descriptions well and the experience feels native. Write them lazily and the AI will miss calls or call the wrong thing.
The Manifest
Here's the manifest.json for the skill I built:
{
"slug": "deploy-status",
"name": "Deploy Status",
"version": "1.0.0",
"author": "Godspower Patrick",
"description": "Check the live status of any deployment environment via our internal status API.",
"domains": ["status.lacai.internal"],
"auth_type": "secret",
"tools": [
{
"name": "get_environment_status",
"description": "Returns the current status of a deployment environment (staging, production, etc). Use this when the user asks if a server is up, whether a deployment succeeded, or what the current environment health is.",
"parameters": {
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The environment to check. One of: staging, production, preview."
}
},
"required": ["environment"]
}
}
]
}A few things worth noting here:
- slug must be unique across the marketplace. Keep it short and lowercase with hyphens.
- domains is what determines your approval tier. One domain with no special permissions is a green tier — auto-approved. Multiple domains or schedule access goes to manual review. Filesystem access gets auto-rejected, full stop.
- auth_type is set to
secrethere because the status API needs a bearer token. The user enters it once on install, it gets encrypted with AES-256, and your tool receives it at call time. You can also usenoneoroauth. - The tool description is the most important field in the whole file. This is what the AI reads to decide when to invoke your tool. Treat it like a well-written function docstring, not a label.
The Tool Implementation
Next to manifest.json you put your tool logic. LacPointer calls your tool with the parameters the AI extracted from the user's message, plus any secrets the user configured. A simple implementation looks like this:
// tools/get_environment_status.js
export async function get_environment_status({ environment }, { secrets }) {
const res = await fetch(
`https://status.lacai.internal/api/${environment}`,
{
headers: {
Authorization: `Bearer ${secrets.API_KEY}`,
Accept: "application/json"
}
}
);
if (!res.ok) {
return { error: `API returned ${res.status}` };
}
const data = await res.json();
return {
environment,
status: data.status,
last_deployed: data.last_deployed,
uptime: data.uptime_percent
};
}Return a plain object. The AI takes that object and turns it into a natural language response. You don't need to format the output for humans — the AI handles that. Just make sure the keys are descriptive so the AI knows what each value means.
There are a few hard limits on what your code can do. No eval, no dynamic imports, no child_process, no writing to the filesystem. The static analysis will catch all of those and reject your submission. These aren't arbitrary restrictions — skills run inside LacPointer on the user's machine, so the security bar has to be real.
Zipping and Submitting
Your zip structure should look like this:
deploy-status.zip
├── manifest.json
└── tools/
└── get_environment_status.jsMax bundle size is 5MB. In practice, most skills are a few kilobytes.
Submit via the developer portal or POST directly to /api/skills/submit if you want to wire it into a release script. The portal gives you a review status page so you can see where your submission is in the queue.
Every submission goes through ClamAV, static analysis, and npm audit before a human ever looks at it. Green tier skills (single domain, no special permissions) skip the manual review entirely and get auto-approved. Mine was green tier and it was live within minutes of submission.
Testing Before You Submit
You can sideload a skill locally before submitting it. Drop the zip into LacPointer's skill directory, reload, and it shows up in your installed skills list. Test the full conversation flow — ask questions that should trigger your tool and a few that shouldn't, to make sure the AI is making the right call on when to invoke it.
If you find the AI is missing calls, go back to your tool description and make it more specific. If it's calling your tool when it shouldn't, tighten the description or add a note about when not to use it. The description is a prompt, not a label — treat it that way.
Making It Public
Once your skill is approved, it shows up in the Skills Marketplace with your name on it. Users install it in one tap, configure any secrets, and it works immediately inside every chat and voice session. No update step, no version management on the user's end.
If you build something you're proud of — a niche API wrapper, a domain-specific tool, something that fills a gap in the marketplace — submit it. The marketplace is more useful the more depth it has, and right now there's a lot of room for developer-facing skills in particular.
The Practical Tip
Start with auth_type: none and a public API to get your first skill shipped. Something like a Wikipedia lookup or a timezone converter. The feedback loop is fast, you learn how the AI handles your tool descriptions, and you get a feel for what "good" looks like before you build something more complex. Once you've done one, the second one takes about ten minutes.
Developer docs live at lacai.io/docs/skills and the submission portal is at lacai.io/dashboard/skills.