The marketplace already has 12 skills. Yours could be 13.
I've been using the LacPointer Skills Marketplace since it launched — Weather, GitHub, Crypto Tracker, the usual suspects. They're all useful. But the thing that actually got my attention was when I realized the submission pipeline is wide open to anyone. You write a zip bundle, pass the security checks, and your skill shows up alongside the official ones.
So I built one. A dead simple skill that queries a public REST API and surfaces the result through LacPointer's bar. Here's exactly how it works.
What a skill actually is
A skill is a zip file with a manifest.json at the root. That's it. No framework, no SDK, no boilerplate generator. The manifest declares what your skill does, what domains it's allowed to call, and what tools it exposes to the AI. Once a user installs it, LacPointer injects those tool definitions into the AI's context automatically. The user doesn't configure anything else.
When a user says something that matches what your tool does, the AI calls it. Naturally, mid-conversation. No slash commands, no special syntax.
The manifest structure
Here's a minimal manifest.json:
{
"slug": "my-skill",
"name": "My Skill",
"version": "1.0.0",
"author": "your-name",
"description": "One sentence about what this skill does.",
"domains": ["api.example.com"],
"auth_type": "none",
"tools": [
{
"name": "get_data",
"description": "Fetches X from api.example.com given a query. Call this when the user asks about X.",
"parameters": {
"type": "object",
"properties": {
"query": {
"type": "string",
"description": "The search term"
}
},
"required": ["query"]
}
}
]
}Every field matters. slug is your unique identifier in the marketplace — pick it carefully because it's permanent. domains is a whitelist of every external host your skill is allowed to call. If you try to call a domain not listed here, the request gets blocked.
The tool description is the most important line you'll write
I cannot stress this enough: the AI reads your tool's description field to decide when to call it. It's not a human-facing label. It's an instruction to the model.
Bad description: "Gets weather data."
Good description: "Returns current temperature, conditions, and humidity for a given city. Call this when the user asks about weather, temperature, rain, or what to wear."
The second version tells the AI when to use it, not just what it does. Those few extra words make the difference between a skill that fires reliably and one that the AI ignores half the time. Spend most of your authoring time here.
Handling auth
The auth_type field has three options:
- none — no credentials needed. Works for public APIs.
- secret — the user enters an API key once after installing. LacPointer encrypts it with AES-256 and passes it to your tool at call time. Your manifest gets a
secretsarray listing what keys to prompt for. - oauth — for services that need a proper OAuth flow. LacPointer handles the redirect and token exchange.
For my first skill I used a public API so auth_type: "none" was fine. If you're building something on top of a private API — your company's internal service, a paid data provider — go with secret. The user experience is still one-tap install, then one key entry. After that it just works.
Security tiers and what they mean for approval speed
Every submission goes through automated checks before a human ever sees it: ClamAV antivirus, static analysis that blocks things like eval, dynamic imports, child_process, and filesystem writes. Then your skill lands in one of three tiers:
- Green tier — single domain, no special permissions. Auto-approved. Fastest path to publication.
- Yellow tier — multiple domains, or schedule/panel permissions. Goes to manual review. Still reasonable turnaround.
- Red tier — filesystem access. Auto-rejected. Not allowed, full stop.
If you want fast approval: keep your domains array to one entry and don't request exotic permissions. The GitHub skill and Weather skill are both green tier — one domain each, clean manifests. Model your first skill after that pattern.
Bundle size limit: 5MB
You've got 5MB for the whole zip. This is actually generous for a JSON manifest, but keep it in mind if you're tempted to bundle helper scripts or assets. Keep it lean. The skill's job is to declare tools and make API calls — not to ship a dependency tree.
Submitting
Two ways to submit:
- Upload your zip through the developer portal
- POST it directly:
POST /api/skills/submit
The portal is the easier path for a first submission. You get a status page that shows where your skill is in the review pipeline. Once it clears, it shows up on the marketplace and any LacPointer user can install it in one tap.
A workflow that actually makes sense
Here's how I built my first skill from scratch:
- Find a public API I actually use. I picked one I was already querying manually through the browser.
- Create a folder, add
manifest.json. Write the slug, name, domain, and one tool. - Write the tool description like I'm briefing a junior dev on when to use the function.
- Zip the folder — just the contents, not the folder itself.
manifest.jsonshould be at the root of the zip. - Submit via the developer portal.
- Install it myself through LacPointer's marketplace and test it in conversation.
Step 6 is important. Even before the skill is public, you can install it from your own submission to test it. Hit Option+Space, ask something that should trigger your tool, and see what fires. If the AI isn't calling your tool, your description probably isn't specific enough. Rewrite it and resubmit.
Why bother building one?
Honestly? The installed skills I use most are the ones that cover workflows specific to me — not the generic ones. The generic ones are already in the marketplace. If you have an internal API, a niche data source, or you just want LacPointer to know how to talk to a service you use daily, building a skill is the right move. It takes less than an hour for a simple one and the result is that LacPointer starts handling that workflow mid-conversation, without you switching to a browser or writing a script.
Full developer docs are at lacai.io/docs/skills. The manifest spec is short — you can read the whole thing in ten minutes.
Practical tip: Start with a public no-auth API — something like a trivia API, a quotes API, or an exchange rate feed. Get one tool approved, learn what the review process feels like, then build the skill you actually care about. Your second submission will take half the time.