<!-- SPDX-License-Identifier: MIT --> <!-- SPDX-FileCopyrightText: Netresearch DTT GmbH -->

Netresearch Agentic Skills Marketplace

You ship code. Your agent should know your stack.

40 curated catalog entries for TYPO3, PHP, Go, Docker, Jira, security, and documentation. Each entry points to a source package; some packages contain several Agent Skills. Instructions follow the Agent Skills format, while tools and client-specific components depend on the package and installer.

Browse the full catalog → netresearch.github.io/claude-code-marketplace — per-skill detail pages, grouped by stack and category, in English and German.

What are Agentic Skills?

Agentic Skills are portable packages of procedural knowledge that work across any AI coding agent supporting the Agent Skills specification.

Source packages may include several skills and additional components such as hooks or commands. Agent Plugins standardizes portable packaging; component support and installation remain client-specific. The per-package detail pages link to the source README and explain available installation routes.

Supported Platforms:

• Claude Code (Anthropic)
• Cursor
• GitHub Copilot
• OpenAI Codex
• Gemini CLI
• Amp, Goose, Roo Code, OpenCode, and 30+ more

Installation

Claude Code (Marketplace)

/plugin marketplace add netresearch/claude-code-marketplace
/plugin install typo3-conformance@netresearch-claude-code-marketplace

The first command registers the catalog; the second installs one example plugin. Use /plugin to browse and choose other packages. Adding the marketplace does not install all entries.

ChatGPT workspace (GitHub marketplace sync)

Workspace admins can import https://github.com/netresearch/claude-code-marketplace under Admin > Plugins > Add > Import marketplace. Leave Path empty and select main to follow catalog updates. After merging a catalog update, choose Sync now under Plugins > Marketplaces to request an import without waiting for the daily sync.

The native catalog is .agents/plugins/marketplace.json. It references the same source repositories using ChatGPT-supported URL sources; the Claude catalog remains available for Claude Code. The GitHub account authorizing import must be able to read every referenced repository. Review the per-plugin import results and configure workspace installation policies after import. See the official workspace import documentation.

ChatGPT requires each catalog entry name to match the referenced plugin manifest. The generator maps jira-integration to the package name jira and orocommerce to orocommerce-skills. The Claude catalog and website keep their established IDs.

npx (Skill Instructions)

npx skills add https://github.com/netresearch/{repo-name} --skill {skill-name}

Browse all skills at skills.sh/netresearch.

Use a skill name from the source repository, which can differ from its catalog entry ID. For example, the Jira package contains jira-communication and jira-syntax; OroCommerce contains multiple oro-* skills. The skills CLI installation guide currently requires Node.js 22.20+.

A skill-only installer does not install a plugin's extra hooks or commands, and registration does not set up external runtime tools. Check the package's detail page and source installation guide. Composer skill registration uses the Composer skill installer; an engine-only installation may deliberately disable it. Package availability and direct-source setup differ by entry.

Available Skills

Skill-skills

A small family of skills whose subject matter is other skills. At the center runs a loop — Harness, Assessment, Retro — and around it sit authoring tools that feed the loop.

Host-side tooling (not Agent Skills themselves, but part of the same family):

• composer-agent-skill-plugin — Composer plugin that pulls Agent Skills into PHP projects.
• node-agent-skill-coordinator — Discovers skills shipped via npm packages and registers them in the project's AGENTS.md.

TYPO3 Development

OroCommerce

Code Quality & Security

DevOps & Infrastructure

Productivity & Integration

Brand & visual identity

Architecture

This marketplace uses source references: marketplace.json points to source package repositories. Claude Code fetches a selected plugin from its source repository when installed. A plugin can contain several skills and additional components.

The GitHub Pages site is built from site/; the design decisions behind it are recorded as ADRs in docs/decisions/.

Adding a Skill

Add an entry to .claude-plugin/marketplace.json (the canonical catalog):

{
  "name": "my-skill",
  "description": "What it does and when to use it",
  "source": {
    "source": "github",
    "repo": "netresearch/my-skill-repo"
  },
  "category": "development"
}

Regenerate the ChatGPT/Codex catalog, then validate both catalogs:

./scripts/sync-codex-marketplace.sh
./scripts/validate.sh

Commit both manifest files. The validator checks that the native catalog matches the canonical catalog after applying the documented package-name aliases, including categories, repository URLs and any source revision pins. Generation fails if aliases produce duplicate native plugin names.

Internal Marketplace

Netresearch also maintains an internal marketplace for proprietary skills:

/plugin marketplace add [email protected]:coding-ai/marketplace.git

Organization sync

The private copy netresearch/claude-code-marketplace-P feeds the Claude organization marketplace. A workflow force-pushes this repository's main there after every push, and an update of its main may start an organization plugin sync. The catalog carries no version fields, so each sync resolves every plugin to the current commit of its source.

Discover

Browse the full catalog with per-skill detail pages on the marketplace website:

[netresearch.github.io/claude-code-marketplace](https://netresearch.github.io/claude-code-marketplace/) — DE + EN, canonical landing per skill, grouped by stack and category.

Governance and policies

This repository follows the organisation-wide policies of netresearch:

• Governance: roles, how changes are decided and disputes resolved, and who controls access to sensitive resources.
• Roadmap: the maintenance work planned and excluded for the coming year.
• Handling of dependency and code analysis findings: which vulnerability, licence and static-analysis findings block a change, the deadlines for the others, and how exceptions are recorded.
• Secret management: where CI secrets are stored, who can access them, and when they are rotated.
• Access roster: the accounts with admin, maintain and write access to this repository.

Checks that run on every pull request to main:

• Dependency review (.github/workflows/security.yml): fails on a known vulnerability of severity high or critical in a dependency the pull request adds or changes.
• Betterleaks (.github/workflows/security.yml): scans the Git history and fails on a committed secret.
• CodeQL (.github/workflows/codeql.yml): static security analysis of the GitHub Actions workflows, the JavaScript of site/ and the Python in scripts/; results go to code scanning.
• DCO (.github/workflows/dco.yml): every commit carries a Signed-off-by line.
• Site build (.github/workflows/pages.yml): installs site/ with npm ci --ignore-scripts, runs the catalogue checks and the unit tests (npm run check), builds the site and checks the language pairs; Lighthouse and Playwright visual regression then test the built site.

scripts/validate.sh and the advisory overlap report (.github/workflows/validate.yml) run on pull requests that change either marketplace manifest, the validation, catalog generation or overlap-report scripts, or that workflow. The pre-commit hook (.githooks/pre-commit, enabled by .envrc) runs scripts/validate.sh.

A ruleset on main requires the DCO check, and branch protection of main requires signed commits. The other checks run on every pull request but are not required checks.

What you can and cannot expect from this repository in terms of security, with its threat model: docs/SECURITY-ASSURANCE.md.

Maintained by: Netresearch DTT GmbH, Leipzig