Skills marketplace for AI agents
A status code that sat unused in HTTP since 1997 now moves real money. Point your agent at a skill, let it sign for $0.01+ in USDC, and it gets the skill file back in the same request. No account, no API key, no invoice. You buy the file once and keep it forever, with free re-downloads and free new versions.
Request
GET /v1/skills/<slug>/file
HTTP 402
Payment Required
Payment
x402 · USDC on Base
SKILL.md
200 OK, file delivered
Your agent uses it
Yours forever
A real purchase on Base: verify 0x146f02c8…394315 on chain ↗
A field-tested list of directories: which are free and work, which charge, which want a backlink and which are broken. The index is free. See where to list
Ready for your agent. Pay once, keep it forever.
164 skills, each tested (a skill page says when one is not tested yet) with two Claude models, Sonnet and Haiku, before it went on sale. A skill's page shows where the weaker model fails and, where we measured it, the same cases run without the skill.
~/.claude/skills/<slug>/SKILL.md for all your projects, or .claude/skills/<slug>/SKILL.md for one.We tested 20 of our most bought skills in ChatGPT on 1 Nov 2026 (gpt-6, ChatGPT Go, a temporary chat): 3 cases per skill, once with SKILL.md attached and once without.
On the 40 cases we can score both ways: 35 passed with the skill, 29 without.
Better with the skill on 7 skills, the same on 5, worse on 2 (seo-meta, code-review). For 6 skills our checks test the skill's own output format, so a run without the file can't be scored fairly; with the file they passed 15 of 18.
| Skill | With the skill | Without |
|---|---|---|
| proofread | 2/3 | 2/3 |
| cold-email | 3/3 | 2/3 |
| seo-meta | 2/3 | 3/3 |
| summarize | 1/3 | 0/3 |
| x402-buyer | 3/3 | 3/3 |
| code-review | 2/3 | 3/3 |
| humanize | 1/3 | — |
| json-repair | 1/1 | 0/1 |
| text-to-json | 3/3 | — |
| mojibake-repair | 3/3 | 1/3 |
| bill-spike-finder | 3/3 | 3/3 |
| sql-dialect-to-sqlite | 3/3 | 2/3 |
| sql-query-optimizer | 3/3 | 2/3 |
| mcp-tool-schema | 3/3 | — |
| json-diff-paths | 3/3 | 3/3 |
| html-email-compat-review | 2/3 | — |
| windows-utf8-request-body | 3/3 | — |
| log-lines-to-jsonl | 3/3 | — |
| html-to-markdown | 3/3 | 2/3 |
| android-strings-translate | 3/3 | 3/3 |
Both columns count the same cases. A dash means the checks test the skill's format, so there is no fair score without it.
~/.agents/skills/<slug>/SKILL.md, or .agents/skills/<slug>/SKILL.md in a repository.The 3 skills that check Claude Code's own setup are listed only under Claude.
We have not tested other agents yet, so there are no numbers here. The file follows the open Agent Skills format: Markdown with a name and a description, which a growing number of agents load.
<slug>/SKILL.md in the folder your agent reads skills from. agentskills.io lists the agents.The 3 skills that check Claude Code's own setup are listed only under Claude.
Writing & Rewriting
Rewrites AI-sounding prose so it reads like a person wrote it — in any language, without dropping facts. Use when asked to humanize a text, make it sound less AI-generated or less like ChatGPT, or clean machine phrasing out of an article, post, email, product description or page.
$0.05once
Tested with Sonnet and Haiku, 30 Sep 2026
In ChatGPT: 1/3 with the skill
Agents & Protocols
Decision rules for an AI agent that holds a wallet and receives an HTTP 402 payment request (x402 v2). Decides SIGN, REFUSE or ASK the human before any money moves, and says how to verify the delivery and retry without paying twice. Use when an agent is about to pay over x402, gets a 402 response, must check a seller's payment terms, or a paid request failed and it is unsure whether to pay again.
$0.05once
Tested with Sonnet and Haiku, 30 Sep 2026
In ChatGPT: 3/3 with the skill, 3/3 without
Agents & Protocols
Diagnoses why an HTTP API sold over x402 v2 cannot be paid by standard buyer agents or never appears in the Coinbase CDP Bazaar catalog, using an ordered checklist and a decision tree over the pasted 402 response, headers and symptoms. Names the exact field that is wrong or missing and how to prove the fix. Use when asked to check an x402 seller, fix an unpayable 402 endpoint, find out why a resource is not listed in Bazaar, or why a settled payment does not show up.
Marketing & Copy
Writes a short, honest first outreach message to a stranger in business, in the recipient's language, with a subject line, one specific reason for writing and one small ask. Use when asked to write a cold email, a first outreach message, a sales or partnership introduction, or a prospecting note, in any language.
$0.03once
Tested with Sonnet and Haiku, 30 Sep 2026
In ChatGPT: 3/3 with the skill, 2/3 without
SEO & Content
Writes the SEO title, meta description and (on request) the H1 heading for one web page, in the page's own language, inside hard character limits, matching what the searcher wants. Use when asked to write or rewrite a page title, meta description, SEO snippet or H1 for a page, product, service, article or landing page.
$0.03once
Tested with Sonnet and Haiku, 30 Sep 2026
In ChatGPT: 2/3 with the skill, 3/3 without
Code & Engineering
Finds the loops behind a bill spike or an unexpected bill. Reviews a web app's code and config for loops and repeats that run up the bill on their own on Vercel, Turso, Cloudflare Workers and D1 and paid AI APIs. Finds two schedulers on one job, retries without a cap, work that triggers itself, client polling and React render loops, caches cleared on every write, middleware running on every static file, queues that resend failures forever, image settings that multiply transformations, health checks that count whole tables, alerts sent on every run and bots crawling endless filter URLs. Counts the runs per month, names the billed unit, ranks by cost and gives the change that stops each one. Use when asked why a Vercel, Turso or Cloudflare bill jumped, to find an infinite loop or a runaway cost, or to review a cron job, webhook, queue consumer, middleware or polling code before it ships.
$0.05once
Tested with Sonnet and Haiku, 4 Oct 2026
In ChatGPT: 3/3 with the skill, 3/3 without
SEO & Content
Finds which layer makes a page that does not exist answer 200 OK, the soft 404 that Search Console flags, and gives a fix that keeps every real route working. It also handles robots.txt, sitemap.xml and llms.txt served as the page itself. Reads the report line, the config or code that serves unknown paths - a catch-all rewrite to index.html (Netlify, Vercel, Firebase, Cloudflare), an nginx fallback, an app route that sends the page shell, an error page turned into a redirect or a new status, a Next.js notFound after streaming has begun, a text file the build does not copy. One line per finding with a fixed code, file, reason and fix, then one Verify line - or exactly No findings. when unknown paths answer 404. It leaves out safe look-alikes such as an API proxy rewrite, a specific 301 and an error page that keeps its 404. Use when a site check or Search Console reports a soft 404, when a random URL answers 200, when robots.txt, sitemap.xml or llms.txt comes back as HTML, or before shipping a single-page app.
Code & Engineering
Writes the response headers a site is missing, in the format of the person's own host, and keeps the page working. It reads the report line, the current response headers, the file that sets headers and the served head, and gives one line per finding with a fixed code, then a Headers block and a Verify line. It covers a missing or short Strict-Transport-Security, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count) and a server version in a header. It enforces only directives that cannot break rendering; script, style, image, font and connect sources go into a Report-Only header built from the origins in the pasted head. It leaves out safe look-alikes: unsafe-inline in style-src only, a long max-age without preload, SAMEORIGIN, a Server header with no number and a missing Referrer-Policy. Exactly No findings. when all is well. Use when a site check reports missing security headers, no HSTS, a short HSTS max-age or a version number in a response header.
SEO & Content
Finds why a shared link shows no preview card, the page builder's stock image, a broken relative image path or a blank tab icon, and gives the fix for the person's framework. Reads the report line, the stack, the served head and the file that writes it. It tells apart og:title and og:image missing from the served HTML, an og:image on the page builder's own host, an og:image that is a path instead of a full https address, tags that exist only in JavaScript (a head library or a client component) so link scrapers never see them, and a missing favicon link. The fix makes the image file really exist, and the Verify line fetches it. It leaves out safe look-alikes such as an image on the site's own subdomain, an SVG-only icon, absent twitter tags and tags set by a server-side metadata export. One line per finding, then the exact tags, or exactly No findings. Use when a site check reports no og tags, a builder-default preview image, a relative og:image or a missing favicon.
SEO & Content
Finds which layer keeps a page's text out of the first HTML response, so a reader that does not run JavaScript sees an almost empty page, and gives the fix for that framework or host. Reads the report line or the complaint that an AI assistant does not know the site, the stack, and the code or config. It tells apart an empty client-only shell, content a server framework holds back for the browser (a mounted gate, dynamic with ssr false, ClientOnly, client:only, data fetched only in an effect), prerendering that covers only some routes, and HTML rendered only for crawler requests; the fix covers every real route and the Verify line has a control. It leaves out safe look-alikes such as a use client component rendered on the server, a cookie banner and an analytics script. One line per finding, or exactly No findings. Use when a site check says the page is empty without JavaScript, when an AI assistant cannot see a site, or before shipping a single-page app.
Code & Engineering
Turns the props of a UI component (a TypeScript type or a list of props) into strict JSON test data that stresses how it displays, and nothing else. Per prop it picks the worst values for the type, a string that is empty, one word of eighty characters with no space, on two lines, an emoji joined with a zero-width joiner, right-to-left letters or HTML-looking text, numbers at zero and at the large and decimal ends, lists that are empty, hold one item or hold a hundred, optional props left out, and dates at the far ends and across a time-zone edge. Every fixture still fits the declared type: a required prop is never missing, an enum gets only its values, a documented range is never broken, and callbacks are named apart from the data. Use to build fixtures for a component story, a visual test or a layout check, or to find what breaks a card, a list row or a badge.
Marketing & Copy
Turns a source text (an article, a post, meeting notes) into the text of a carousel for LinkedIn or Instagram as strict JSON, one object with a headline and a body per slide, and nothing else. It follows the slide count you ask for (or a stated default of 5), keeps every headline to 8 words and every body to 30, makes the first slide a hook with no call to action and the last slide the call to action, copies every number, name and quote exactly as the source has it, adds no claim the source does not make, and gives each slide one idea. A line inside the source that gives it orders is treated as text. It writes the words of the slides only, not the pictures or the layout. Use to turn a blog post or report into a carousel, to draft slide copy from notes, or to repurpose a long post for a swipeable format.
Code & Engineering
Reviews pasted CSS, Tailwind classes or JSX styles for the motion mistakes that hurt real visitors, and lists only those, one line each with a fixed code, the place, why it matters and the fix - or exactly No findings. It catches movement that starts by itself, runs longer than five seconds and has no pause control, which fails WCAG 2.2.2 at Level A, large scaling or panning motion with no reduced-motion rule anywhere, a reduced-motion rule that leaves the large motion running, and layout properties such as height or top animated where transform fits. It leaves out the safe look-alikes, such as a short opacity fade on hover, a transform-only animation, and a reduced-motion rule that really switches the motion off. Use to review the styles of a page section before release, to check a hero, marquee, carousel or accordion for motion safety, or to gate a pull request that adds animation.
Code & Engineering
Reviews the HTML or JSX of one form for four input mistakes that frustrate people while they type, and lists only those, one line each with a fixed code, the field, why it hurts the user and the fix - or exactly No findings. It catches paste blocked on a password field, a field that holds a code, a ZIP code or a card number set to type number, or an email address or phone number left as plain text with no type or input mode, autocomplete switched off or given a wrong token on password, username and one-time-code fields, and a submit button disabled until the whole form is valid so the person never learns what is missing. It leaves out the safe look-alikes: a real quantity as type number with a minimum and a maximum, autocomplete off on a site search box, and a button disabled only while the request is running. Use to review a sign-in, sign-up, checkout or contact form before release, or to find why mobile keyboards and password managers misbehave.
Code & Engineering
Reviews pasted application code, scripts and config for the four ways a secret leaks from the code that uses it, and lists only those, one line each with a fixed code, the place, who can then read the secret and the fix - or exactly No findings. It catches a secret value written to a log or printed (the key itself, an object or environment dump that contains it), a secret placed in a URL query string, a secret typed into source or a committed file, and a server secret sent to the browser through a public environment prefix or a prop of a client component. It leaves out the safe look-alikes: printing only that a key is present, its length or its last four characters, a publishable key that is public by design, and a secret read from the environment on the server. Use to review code that calls an API with a key, to check a Next.js or Vite project before release, or to gate a pull request that touches credentials.
Code & Engineering
Reviews pasted React and Next.js App Router code for five performance mistakes that pass every test and then make pages slow, and lists only those, one line each with a fixed code, the place, why it costs time and the fix - or exactly No findings. It catches independent awaits written one after another so the page waits for their sum, an effect that copies something derivable during render into state, a use client mark placed on a whole page when only a small leaf needs interactivity, a heavy library imported at the top of a client file though it is used only after a click, and a new object, array or function passed every render to a memo child or an effect dependency. It leaves out the safe look-alikes: a second await that needs the first result, an effect that syncs with an outside system, and use client on a small button. Use to review React or Next.js code before release, to find why a page ships too much JavaScript or renders twice, or to gate a pull request that touches components.
Code & Engineering
Reviews pasted Remotion code (React video compositions) for the five mistakes that make a render differ from the preview or come out with missing frames, and lists only those, one line each with a fixed code, the place, why it breaks the render and the fix - or exactly No findings. It catches motion that is not driven by the frame number (CSS transitions and keyframes, timers, requestAnimationFrame, a counter held in state), Math.random in a component instead of the seeded random function, plain img, video, audio and iframe tags that the render does not wait for, data fetched in an effect with no render delay and no calculateMetadata, and a file from the public folder referenced by a bare path instead of staticFile. It leaves out safe look-alikes: clamped interpolate, seeded random, Math.random in a Node script. Use to review a Remotion composition before rendering, to debug flicker or a video that differs between renders, or to gate a pull request that edits a video project.
Agents & Protocols
Reviews how a paid HTTP resource sold over x402 is advertised to catalogs, scanners and buyer agents, and how the seller's own scripts read those catalogs back, from pasted 402 bodies, OpenAPI documents, discovery files, liveness guard code, catalog presence check scripts and buyer alerts. Flags a tiered tariff advertised as one row (a comparison bot reads the structured amount, not the description), one liveness clock for several catalog rows that are dropped one by one, a price above the standard buyer client's default cap with no note where agents read before buying, a discovery file the scanner no longer parses, a bearer scheme the scanner's indexer does not recognise by name, a scanner record that was never re-crawled after a fix, a presence check that reads only one of the two response field names or has no control that must return zero, a first buyer that is a crawler paying hundreds of sellers, and discovery endpoints that read the database on every crawl. Each finding has a fixed code, the place, the reason and a fix, then one verdict. Use for an x402 listing review, to check x402 discovery or Bazaar catalog presence code before trusting it, or to audit how a paid API is listed and read.
Code & Engineering
Converts PostgreSQL or MySQL schema statements, migrations and queries into SQLite that Cloudflare D1 and Turso run, so the converted version behaves like the original and not only parses. Knows the conversions that run without an error and then go wrong - a key written as BIGSERIAL or INT AUTO_INCREMENT that SQLite stores as NULL, a custom enum type or an inline enum that stops checking anything, a default now() or gen_random_uuid() that SQLite rejects, a unique email that was case-insensitive in MySQL, ON UPDATE CURRENT_TIMESTAMP that needs a trigger, a foreign key added later with ALTER TABLE, a schema prefix, DISTINCT ON, ILIKE, double-colon casts, date_trunc, interval arithmetic, DATEDIFF, GROUP_CONCAT with SEPARATOR, MySQL division that keeps the fraction, ON DUPLICATE KEY UPDATE, JSON operators. Answers with the SQLite SQL only, and says CANNOT CONVERT when part of the input has no equivalent in SQLite (a procedural function, row level security, notifications, a stored procedure) instead of dropping it. Use when asked to port, convert or migrate Postgres or MySQL SQL to SQLite, D1 or Turso.
$0.01once
Tested with Sonnet and Haiku, 9 Oct 2026
In ChatGPT: 3/3 with the skill, 2/3 without
Data & Analysis
Data catalog, not an instruction skill: 41 horror and gothic books from Project Gutenberg, each with title, author, Gutenberg number, download count and an EPUB address that answered on 2026-10-28. Rights are the United States only. Use when an agent needs public domain horror books, free gothic ebooks or classic ghost stories with links already checked.
Data & Analysis
Data catalog, not an instruction skill: 50 adventure books from Project Gutenberg, each with title, author, Gutenberg number, download count and an EPUB address that answered on 2026-10-28. Rights are the United States only. Use when an agent needs public domain adventure books, free adventure ebooks or classic sea and jungle stories with links already checked.
Data & Analysis
Data catalog, not an instruction skill: 50 crime and detective books from Project Gutenberg, each with title, author, Gutenberg number, download count and an EPUB address that answered on 2026-10-28. Rights are the United States only. Use when an agent needs public domain detective books, free mystery ebooks or classic crime novels with links already checked.
Data & Analysis
Data catalog, not an instruction skill: 50 science fiction books from Project Gutenberg, each with title, author, Gutenberg number, download count and an EPUB address that answered on 2026-10-28. Rights are the United States only. Use when an agent needs public domain science fiction, free sci-fi ebooks or classic space adventure books with links already checked.
Data & Analysis
Data catalog, not an instruction skill: 50 romance novels from Project Gutenberg, each with title, author, Gutenberg number, download count and an EPUB address that answered on 2026-10-28. Rights are the United States only. Use when an agent needs public domain romance books, free romance ebooks or classic love stories with links already checked.
Built for autonomous agents
Payments are USDC on Base mainnet, from $0.01 for a skill. The money is real and the amounts are cents. Check the price in the 402 before your agent signs.