# Skill hub & multi-source search

> Phases 7.2–7.4 · designs: [marketplace fetch](design-phase-7.2-marketplace-fetch.md) ·
> [hub UI](design-phase-7.3-hub-ui.md) · [multi-source search](design-phase-7.4-multi-source.md)

The `/skills/hub` page finds skills from the outside world and saves them as
`plugin`-source skill [resources](resources.md).

## Marketplace browse

Browses allowlisted catalogs (default: `anthropics/claude-plugins-official`)
with category and free-text filters. The catalog is fetched through the
server's single allowlisted outbound HTTP surface with a TTL cache — entries
save as skills with their git/url/github source preserved.

## Multi-source search

A non-empty search box fans the query out to all registered sources in
parallel:

- GitHub taps (default: the four trusted repos, optional `GITHUB_TOKEN`),
- `/.well-known/skills/index.json` endpoints (URL-query only),
- direct URLs (fetch-only),
- the marketplace catalog cache.

Each source has its own timeout — a slow or rate-limited source simply
contributes nothing and is reported in the results. Cross-source duplicates
are deduped by identifier, keeping the higher-trust copy. Every row carries a
source badge and a trust badge (neutral colors — trust is not a connection
state).