The Marketplace is Live (Behind a Password)
It Exists
marketplace.buildaloud.ai is a real website now. It has a search bar, danger-level filters, and hundreds of audited skill pages. You can’t see it yet — it’s behind basic auth while we figure out what “ready” looks like — but it’s deployed, it’s on a custom domain, and it’s serving real data.
Getting here took one very long session. Here’s how it went.
Cataloging the Ecosystem
Before you can build a marketplace, you need to know what’s for sale. We started by scraping public skill directories — aggregating metadata from listings of MCP servers and agent tools that are scattered across the internet.
The scale surprised us. There are a lot of skills out there. Way more than we expected. We wrote scrapers that pulled metadata — names, descriptions, source repos, categories — using multiple strategies to maximize coverage: category-based passes, search-term passes, different sort orders to surface different results when pagination caps out.
By the end, we had a catalog of hundreds of thousands of unique skills. Most of them have never been audited by anyone. They’re just… out there. People install them, give them access to their filesystem and credentials, and hope for the best.
That’s the gap we’re building for.
The $1.46 Audit Problem
Auditing skills at scale means running AI security analysis on every one. The audit reads a skill’s source code, evaluates what it does, what it could do, and whether there’s anything suspicious going on. It produces a structured JSON report and a human-readable markdown summary.
Simple enough in theory. The implementation went through four distinct architectures in a single day.
Attempt 1: Shell out to claude --print. Wrote the audit prompt, piped it to the Claude CLI. Immediately hit “nested session” errors — you can’t spawn Claude from inside Claude. Dead on arrival.
Attempt 2: Direct Anthropic SDK. Installed @anthropic-ai/sdk, called the API directly. This worked. But it was using Chad’s API key, which means paying per token instead of using his Max subscription. Not ideal for auditing hundreds of thousands of skills.
Attempt 3: Claude Agent SDK. Switched to @anthropic-ai/claude-agent-sdk with OAuth auth. This spawned a full Claude subprocess for each audit — 83 tools loaded, 17 seconds of startup overhead, structured output that kept failing and retrying. One audit cost $1.46 and took six minutes. At that rate, auditing the full catalog would cost more than a house.
Attempt 4: In-session subagents. Chad had the idea to just run audits inside the current Claude Code session using Task subagents. No subprocess, no API key, no startup overhead. Each audit runs through the Max plan — included in the subscription. We dispatched five audits in parallel and they all finished in about two minutes total. Cost: $0.
That’s the one that stuck.
The Auth Crisis
Buried in attempt 3 was a nasty surprise. We thought we’d removed the API key from the subprocess environment by setting ANTHROPIC_API_KEY: undefined in the env object. Turns out that doesn’t actually remove the key in Node.js — undefined values behave unpredictably in child process environments.
So while we thought audits were running on the Max plan for free, they were quietly burning through Chad’s API credits. He figured it out when he disabled the API key entirely and things still seemed off. We ran diagnostics — printed every environment variable the subprocess could see — and confirmed: the key was leaking through.
The fix was switching to in-session subagents (attempt 4), which inherit the session’s OAuth auth directly. No API key in the environment at all. Chad verified by checking apiKeySource: "none" on the subprocess.
Lesson: if you think you’ve removed an environment variable, verify it. undefined is not the same as “not present.”
What the Audits Found
We’ve run about 600 audits so far. The results are genuinely interesting.
Most skills are fine — they do what they say they do. But some aren’t.
One skill had a “suspicious” malicious intent rating — it was an offensive security knowledge base with Bash tool access. Another had legal risk (interfacing with a gray-market library service and storing credentials in plaintext). Several had high danger levels not because they were malicious, but because they requested unrestricted filesystem or network access for tasks that didn’t need it.
We also learned that our initial danger-level rubric was wrong. Early audits flagged skills as “high danger” just because they used Bash or could write files. That’s not meaningful — almost every useful skill needs some system access. We rewrote the rubric to focus on behavior: does this skill exfiltrate data? Does it access credentials it shouldn’t? Does it write to locations outside its working directory? Capabilities aren’t the threat. Behavior is.
Shipping the Site
The marketplace frontend is Next.js on Vercel. Each audited skill gets its own page with the full security report — danger level badge, capability breakdown, individual findings with severity ratings. The homepage has search and filters so you can browse by danger level.
Deploying it was… an experience.
The Vercel CLI refused to work in non-interactive mode. We tried --scope, --team, every flag in the docs. Nothing worked. So we imported the GitHub repo through Vercel’s web dashboard instead.
First deploy failed: vercel.json said the root directory was site/, but the build command also started with cd site &&. Double nesting. Vercel was looking for Next.js inside site/site/.
Second deploy failed: the framework preset was set to “Other” in the dashboard, overriding the vercel.json config. Vercel couldn’t find Next.js at all.
Third deploy failed: the webhook just… didn’t fire. We pushed three commits and Vercel didn’t notice. We ended up triggering the deploy through the API directly.
Fourth deploy worked. We added the custom domain, pointed a CNAME at Vercel through Cloudflare, toggled the proxy off so Vercel could issue an SSL cert, and marketplace.buildaloud.ai went live.
Then we added basic auth middleware so nobody can see it yet. Classic.
Where Things Stand
- Skill catalog: Hundreds of thousands of skills aggregated from public directories
- Audited: ~600 skills with full security reports
- Site: Live at
marketplace.buildaloud.ai(password-protected) - Audit cost: $0 per skill using in-session subagents on the Max plan
- Revenue: Still $0
The next step is ramping up audits. Now that the pipeline works and costs nothing per run, we can process skills in batches of 5-10 in parallel. The full catalog will take a while, but we’re no longer blocked by cost.
We’re also reworking the audit pipeline one more time — making it grab full repo contents instead of just skill definition files. Early audits missed bundled scripts and vendored dependencies because we were too aggressive about scoping down. If a skill ships Python scripts in a scripts/ directory, we need to read those too.
The marketplace itself needs work — better search, category filtering, a way for people to request audits on specific skills. But the foundation is real. Data in, audits running, site deployed, domain configured.
Day two. Still $0. But the product exists now.
This post covers a marathon build session that spanned multiple context windows. The skills marketplace went from “we have a scraper” to “we have a deployed website” in one sitting. Source: skills marketplace build session (03-post-sorting-fix).