Why I Wanted My Own Skill
The built-in skills that ship with LacPointer cover a solid range — Weather, GitHub, Crypto, Hacker News, Currency Converter, and a handful of others. But I kept hitting the same wall: I wanted to query our internal staging API from the LacPointer bar without copy-pasting URLs into a browser tab every single time. No existing skill was going to do that for me.
So I built one. The whole process took about an hour, most of which was me reading the manifest spec too fast and getting the tools array wrong on the first pass. This post is what I wish I'd had before I started.
What a Skill Actually Is
A skill is a zip file. That's it. Inside that zip there's a manifest.json at the root, and that file tells LacPointer everything it needs to know: what the skill does, which domains it talks to, what tools it exposes, and what kind of auth (if any) it requires.
When a user installs your skill, LacPointer adds your tool definitions to the AI's context automatically. The AI reads your tool descriptions in plain English and decides on its own when to call them. You don't wire anything up — you just describe the tools clearly and let the model figure out when they're relevant.
That part is genuinely clever. If your tool description is vague, the AI won't call it at the right time. Good descriptions are the whole game.
The manifest.json
Here's a minimal example for a skill that fetches the status of a deployment environment:
{
"slug": "deploy-status",
"name": "Deploy Status",
"version": "1.0.0",
"author": "yourname",
"description": "Check the live/staging deployment status of your app.",
"domains": ["api.yourapp.com"],
"auth_type": "secret",
"tools": [
{
"name": "get_deploy_status",
"description": "Returns the current deployment status for a given environment. Use this when the user asks about their staging or production deployment, whether a deploy finished, or if something is down.",
"parameters": {
"type": "object",
"properties": {
"environment": {
"type": "string",
"description": "The deployment environment to check. Either 'staging' or 'production'."
}
},
"required": ["environment"]
}
}
]
}A few things worth noting here:
- slug — lowercase, hyphens only. This becomes your skill's unique identifier in the marketplace.
- domains — every external domain your skill calls must be listed here. Miss one and the request will be blocked at runtime.
- auth_type —
none,secret, oroauth. Withsecret, the user enters an API key once after install. LacPointer encrypts it with AES-256 and injects it into your tool calls automatically. You never see it in plaintext. - description on each tool — write this like you're explaining it to a junior developer who has no context. The AI reads this verbatim to decide when to call your tool. "Returns deployment status" is worse than "Returns the current deployment status for a given environment. Use this when the user asks about their staging or production deployment."
The Review Tiers
This is where I got surprised. Submissions go through an automated pipeline before they're visible in the marketplace, and the pipeline is stricter than I expected.
Every submission runs through ClamAV antivirus, static code analysis, npm audit, and a manifest permission check. The permission check slots your skill into one of three tiers:
- Green: single domain, no special permissions. Auto-approved. If your skill talks to one API and doesn't need schedule or panel access, you're here. This was my case.
- Yellow: multiple domains, or you're requesting schedule or panel permissions. Goes to manual review. Expect a few days.
- Red: filesystem access. Auto-rejected, full stop. Skills run in a sandboxed context — they're not supposed to touch the local filesystem, and there's no appeal path for this one.
The static analysis also hard-blocks a few patterns: eval, dynamic imports, child_process, and fs writes. If any of those show up in your code, the submission won't get through regardless of tier. It's a pretty reasonable list.
Submitting
Once your zip is ready — manifest.json at the root, total bundle under 5MB — you submit it one of two ways:
- Via the developer portal at lacai.io/dashboard/skills
- Or with a POST to
/api/skills/submitif you want to integrate it into a release pipeline
The portal gives you a submission status page so you can track where you are in review. For green-tier skills the turnaround has been fast every time I've done it.
Testing Locally Before You Submit
There's no local emulator for the skill runtime right now, which is the one thing I'd ask for as a developer. What I do instead: install the skill on my own LacPointer instance from a local zip before submitting publicly. You can do this from the Skills section of LacPointer settings — there's an option to load from a file. It's not a full sandbox, but it lets you catch manifest errors and test that the AI is calling your tools at the right moments before anyone else sees it.
Open LacPointer with Option+Space, ask something that should trigger your tool, and watch whether it fires. If it doesn't, your tool description is probably not specific enough. Rewrite it, reload the skill, try again.
What Makes a Good Skill
The skills in the marketplace that actually get used have a few things in common. They do exactly one category of thing. They have tool descriptions that are almost embarrassingly specific about when to call them. And they fail gracefully — if the API is down or the key is wrong, the tool returns a clear error message rather than an empty object that leaves the AI guessing.
Keep the bundle small too. There's a 5MB cap, but most skills should be well under 100KB. If you're approaching the limit, something's off.
Worth Building
Once your skill is live, anyone who installs LacPointer can find it in the marketplace and add it in one tap. Your tool definitions get injected into their AI context and it just works — they don't configure anything beyond their API key if you require one.
For internal tools that only you'll use, the local install method is honestly enough. But if you've built something useful for a broader audience — a wrapper around a popular API, a niche data source, a productivity integration — the submission flow is low friction and the review has been reasonable in my experience.
Full developer docs are at lacai.io/docs/skills. The manifest spec is there, along with the full list of blocked patterns and some example skills to crib from. Start with one of the simpler examples, swap in your API, and go from there.