Evidence, Not Prompt Dumps: What a Verified Agent Skills Marketplace Must Prove

It is easy to sell a skill on vibes: a confident title, a clean summary, one screenshot, and a button. What a verified agent skills marketplace must prove is the opposite of a vibe: it treats each listing as an evidence record rather than a prompt shelf, and publishes the signals that actually decide a purchase: traceable scope, declared compatibility, declared permissions, source provenance, and a verification run someone can reproduce. The argument compresses to three lines. Self-report fails, because anyone can write a good description of a workflow that does not work. Graded artifacts win, because a claim checked against what a skill produced is a fact. And an honest bench, where in-validation skills are shown and clearly not for sale, beats a padded catalog every time.

The failure mode is easy to picture. A listing reads like a product, so you install it, and it turns out to be a paragraph of instructions with none of the parts that make a workflow dependable. You are putting a bundle of files into an agent that has your shell, which is why “it looks good” is not an answer.

A listing is an evidence record, not a description

Start from what a skill actually is. The Agent Skills specification requires a skill directory to contain a SKILL.md file, YAML frontmatter followed by Markdown, with two required frontmatter fields: name and description. That is the floor, and the floor is exactly what a prompt dump can fake. The evidence lives in the optional structure the spec permits: scripts/, references/, and assets/ directories.

Those directories are the line between a prompt and a workflow. The spec’s own guidance says scripts should document their dependencies, return useful errors, and handle edge cases. A listing that ships scripts is therefore making claims you can check. Do the scripts declare what they need? Do they fail cleanly? Is there a reference file behind the confident sentence in the summary? A marketplace that surfaces the bundle instead of only the prose lets a buyer answer those before installing. A marketplace that surfaces only the prose is asking for trust it has not earned.

Self-report fails; graded artifacts win

This is the heart of it. The weakest evidence is the seller describing their own work, and it is also the most common. “Produces production-ready output” is a sentence, not a result. The fix is not a better sentence. It is to stop grading the description and start grading the artifact.

Concretely: take a representative prompt for the job the skill claims to do. Run it once with a strong general agent and no skill, and once with the skill installed. Then grade both outputs against assertions written in advance, the specific things a correct result must contain. What survives that is not a claim about the workflow. It is the workflow’s output, checked. The difference a buyer cares about is whether the skill reliably standardizes a job the agent would otherwise do inconsistently, and you can only see that in graded runs, never in a summary.

One honesty rule travels with this. A graded run can demonstrate that a workflow is complete and consistent. It does not license a performance number the page cannot back. If a listing tells you a skill is a set percentage faster or better, ask where that number came from, because completeness and standardization are what a bench actually shows, and a fabricated uplift is exactly the vibe this whole approach exists to replace.

Permissions are the signal buyers underrate

The specification includes optional license, compatibility, and metadata fields, and it labels allowed-tools as experimental, noting implementation support may vary. Read allowed-tools as a permissions declaration: the skill telling you what it expects to touch.

That declaration matters because of a lesson the rest of the ecosystem already paid for. Anthropic’s October 2025 guidance still holds: a skill can enable code execution, so stick to trusted sources. The Model Context Protocol’s security model makes the same point from the tool side, warning that a tool path can amount to arbitrary code execution and calling for explicit consent and a clear understanding of what a tool does before you authorize it. Put those together and the buyer question is not whether a skill is impressive. It is what the skill is allowed to do, and whether the listing says so plainly. Treat allowed-tools as scope, not decoration, and keep auditing the bundle regardless, because the field is experimental and support varies.

An honest bench beats a padded catalog

Here is the counterintuitive part for anyone who equates a big catalog with a serious store. A catalog padded with listings nobody graded is a liability, not an asset, because every unverified entry lowers the odds that the next one you click is real. The trustworthy move runs against scale: a small catalog where every listing cleared the same standard, plus an honest bench for the skills that have not cleared it yet.

A bench is where a marketplace shows the work in validation, listed openly and clearly not for sale. It is scarcity through truth. It tells a buyer two things a padded catalog hides: that admission is a real gate with a fail state, and that the store would rather show you an unfinished skill honestly than dress it up as ready. A catalog that only ever grows has no fail state you can see, and a gate with no fail state is not a gate.

The evidence you publish is the evidence a model reads

One more reason to publish evidence in plain text. The specificity that makes a listing trustworthy to a buyer is the same specificity that makes it legible to AI-mediated search. The 2023 paper that formalized generative engine optimization framed the goal as visibility inside answers language models generate, and it was candid about the limits: creators have little control over when and how their content is shown, and effectiveness varies by domain. Treat GEO and AEO as a developing vocabulary for visibility, not a ranking guarantee.

The grounded guidance points the same way. Google’s AI-features documentation says the foundational practices that serve search serve AI Overviews and AI Mode too: crawlable pages, real text instead of words locked in images, useful internal links, and structured data that matches what is visible. It also says plainly that no special AI-specific schema is required. There is no secret file that buys an AI answer. So publish what the skill does, what it requires, what it is allowed to touch, where it came from, and how it was checked, in clear text. That page is legible to a person and to a model composing an answer. The evidence work and the visibility work are the same work.

What that looks like in practice

Aaria keeps a deliberately small catalog for exactly these reasons, and its admission standard is published in full as a house standard, stated openly rather than borrowed from a consensus nobody validated. A product page like Scrolldio is built as an evidence record: the capabilities the workflow requires, the boundaries of what it does and does not include, and a documented demonstration, with no performance number or customer outcome the page cannot support.

That is the whole argument. A marketplace listing is a claim. A verified listing shows its work. When you are deciding whether a skill is a tested workflow or an attractive prompt, you are asking for evidence, and the stores worth your trust are the ones that treat the listing as the place to hand it over. Claims are cheap. Ask every listing, including ours, to prove it.

FAQ

What makes an agent skills marketplace verified? It publishes evidence for each listing rather than a description alone: traceable scope, declared compatibility and permissions, source provenance, and a verification run a buyer could reproduce. A polished SKILL.md on its own is not verification.

What should I check before installing a listed skill? Read the SKILL.md, look for scripts/, references/, and assets/, confirm scripts declare dependencies and fail cleanly, and check what the skill declares it is allowed to touch. Skills can execute code, so treat the source as something you are choosing to trust.

Why prefer a small catalog with a bench over a large one? A large catalog of ungraded listings lowers the odds any given one is real. A small catalog where every listing cleared the same gate, plus an honest bench of in-validation skills that are not for sale, shows the gate has a fail state. That fail state is the trust signal.

Does publishing skill evidence help with AI search visibility? It aligns with the grounded guidance. Google says the same foundational SEO practices apply to AI Overviews and AI Mode and that no special AI schema is required. GEO and AEO describe a developing visibility vocabulary, not a guaranteed ranking, so treat clear evidence as good practice, not a trick.