The Marketplace Goes Both Ways
Most people discover the LacPointer Skills Marketplace by installing something — Weather, GitHub, Crypto Tracker — and moving on. What fewer people realise is that the submission side is open too. If you have an API you use constantly and it isn't in the marketplace yet, you can wrap it into a skill and have it working in LacPointer in an afternoon.
I built a small internal skill for a JSON placeholder API we use in testing, mostly to see how the process works. The whole thing took about two hours including reading the docs. Here's what I learned.
What a Skill Actually Is
A skill is a zip bundle. That's it. At the root of the zip you need a manifest.json that tells LacPointer everything it needs to know: what the skill does, which domains it's allowed to call, what tools it exposes, and how authentication works.
When a user installs your skill, its tool definitions get added to the AI's context automatically. The user doesn't have to do anything extra after installation. When they ask a question your skill handles, the AI calls the right tool and responds naturally. That's the part worth appreciating — you're not building a UI, you're just describing capabilities and the AI figures out when to use them.
The manifest.json Breakdown
Here's the core shape of a manifest:
- slug — unique identifier for your skill, lowercase and hyphenated
- name — display name shown in the marketplace
- version — semver string, e.g.
1.0.0 - author — your name or handle
- description — what the skill does, shown on the marketplace card
- domains — array of allowed outbound domains, e.g.
["api.openweathermap.org"] - tools — array of tool objects (more on this below)
- auth_type — one of
none,secret, oroauth
The max bundle size is 5MB. Keep it lean — you're shipping a manifest and some lightweight handler logic, not a full Node app.
Writing Good Tool Definitions
This is the part that actually determines whether your skill works well in practice. Each tool needs three things: a name, a description, and a parameters block in JSON Schema format.
The description is not just documentation for humans. The AI reads it to decide when to call your tool. If the description is vague, the AI will either call the wrong tool or skip yours entirely. Be specific about what kind of input triggers this tool and what it returns.
Bad description: "Gets weather data."
Better description: "Returns the current temperature, conditions, and wind speed for a given city name. Use this when the user asks what the weather is like or whether they need an umbrella."
That extra sentence — "use this when..." — makes a real difference. It's essentially a hint to the model about intent matching.
For parameters, standard JSON Schema applies: type, properties, required. Keep the parameter surface small. If your tool needs a city and a unit preference, declare both. Don't over-engineer it with optional flags the AI will never reliably populate.
Handling Auth
If your skill calls an API that needs a key, set auth_type to secret. When a user installs the skill, LacPointer will prompt them to enter the key once. It's stored encrypted with AES-256 and injected into your tool calls automatically from that point on. The user never has to paste it again.
If the API uses OAuth, set auth_type to oauth and define the flow in the manifest. LacPointer handles the redirect and token storage.
If the API is public with no auth required, none is fine and makes for the simplest possible skill to build and install.
The Security Tier System
Before your skill goes live, it goes through a review pipeline. Understanding the tiers saves you from a rejection you didn't expect.
- Green tier — single domain, no special permissions. Auto-approved. This is where you want to land if you can.
- Yellow tier — multiple domains, or schedule/panel permissions. Goes to manual review. Not a problem, just slower.
- Red tier — filesystem access. Auto-rejected, full stop.
The static analysis also blocks specific patterns: eval, dynamic imports, child_process, and fs writes. If any of those are in your bundle, it won't pass. These aren't arbitrary restrictions — skills run on users' machines and the trust model has to be strict.
The bundle also goes through ClamAV antivirus and npm audit before anything reaches the manual review queue. Build clean and you won't have any surprises.
Submitting
Once your zip is ready, you have two options: submit through the developer portal at /dashboard/skills, or POST directly to /api/skills/submit if you want to script the process. The portal gives you a status page where you can track where your submission is in the review queue.
Full developer documentation lives at lacai.io/docs/skills.
What Makes a Skill Worth Building
The skills that work best in LacPointer are the ones that remove a context switch. Weather works because you'd otherwise open a browser tab. GitHub works because you'd otherwise leave your current task to check a PR. The question to ask before building is: "Is there an API I reach for multiple times a day that I could just ask about instead?"
Internal tools are a strong use case here. If your team has a private API — a deployment status endpoint, a feature flag service, a metrics dashboard — you can build a private skill for it and distribute the zip bundle directly to teammates. They install it locally, add their API key once, and then just ask LacPointer "is the staging deployment healthy?" or "what's the flag value for new-onboarding?" without opening another tab.
That's the real unlock: you're not limited to what's in the public marketplace. The format is open enough to wrap anything.
Quick Start Checklist
- Create a folder, add
manifest.jsonat the root - Set
slug,name,version,author,description - List your outbound
domains— keep it to one if you can (Green tier) - Define your
tools— write descriptions that tell the AI when to use each tool, not just what it does - Set
auth_typetonone,secret, oroauth - Zip the folder, stay under 5MB
- Submit at lacai.io/dashboard/skills
If you want to test before submitting, install the zip locally via LacPointer's skill settings — you don't need marketplace approval to use a skill on your own machine. That's how I validated mine before sending it in.