oceanskill

Inspiration

AI agents like Claude Code, Codex, Cursor, and Antigravity can only work well based on the skills and context they're given. However, finding trustworthy, well-written skills today means digging through scattered repos on GitHub or app marketplaces. I wanted to build a better solution: a single trusted source containing skills that have been content-moderated and rigorously security-reviewed, so any AI assistant can retrieve them instantly.

What it does

oceanskill is a platform that provides vetted skills for AI agents. Instead of manually downloading and inspecting skill files, developers simply connect their AI assistant to nskill through a single MCP connection. From there, they can:

• Search and discover a catalog of hand-curated, strictly quality-controlled skills.
• Upload their own private skills to the platform, which still go through the same moderation process.
• Organize skills into collections (public or private) to share setups with teammates or the community.
• Connect to the platform's MCP via an MCP key, allowing their agent to call skills on demand. ## How we built it The platform runs on Next.js (App Router) combined with Supabase for database management, storage, and authentication, deployed on Vercel. The MCP server is implemented as a Supabase Edge Function, exposing JSON-RPC 2.0 tools (search, fetch skill content, manage collections), authenticated via hashed bearer tokens.

Every skill — whether uploaded as a zip file or sourced from GitHub — goes through a strict 6-step security pipeline before it's ever served to an AI: size limits, zip-bomb detection, structure validation, extension whitelisting, path-traversal checks, malware scanning, and AI-based content scanning.

Challenges we ran into

Building a reliable pipeline that treats every skill the same way, regardless of whether it comes from an uploaded zip file or GitHub, required a huge amount of system design effort. I didn't want any compromise on security based on where a skill originated from.

Accomplishments that we're proud of

What we learned

Curation and trust matter more than the size of the catalog. A smaller set of thoroughly verified skills with complete documentation delivers more value to developers than an unmoderated free-for-all marketplace. Building the security pipeline from the very beginning let us scale content without increasing risk.

What's next for oceanskill

We're focused on validating the beta with real paying users: polishing the collections feature for public sharing, integrating a lightweight rating system based on real usage data, and expanding the skill catalog based on what developers actually ask for.

Built With

• codex
• next.js
• postgresql
• supabase
• typescript