What is cpv-publish-to-marketplace?

A publishing workflow for sending a validated Claude Code plugin to a GitHub-hosted marketplace.

Use it to publish plugins in separate repositories, a shared monorepo, or a repository that also contains the marketplace.

It handles the repository layout and release connections that otherwise need to be configured by hand.

cpv-publish-to-marketplace — Skill for Claude Code by Emasoft

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Emasoft/claude-plugins-validation --skill cpv-publish-to-marketplace

Clone the repo

git clone --depth 1 https://github.com/Emasoft/claude-plugins-validation

Made for: Claude Code.

Or install claude-plugins-validation, the plugin that ships this one along with the rest of its 52 skills, 14 commands, 14 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace/github.svg)](https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace)

Your own site

<a href="https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace"><img src="https://agentmods.dev/badge/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace"><img src="https://agentmods.dev/badge/skills/emasoft/claude-plugins-validation/cpv-publish-to-marketplace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 39 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,219 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00039	$0.01219
Opus 5.5	$0.00016	$0.00488
Sonnet 5.5	$0.00008	$0.00244
Haiku 4.5	$0.00004	$0.00122

Measured 2mo ago against content hash 19cb9fe76559, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

cpv-publish-to-marketplace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/cpv-publish-to-marketplace/SKILL.md · 114 lines

How it starts

The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Publish Plugin to Marketplace

Overview

Publishes a validated Claude Code plugin to a GitHub-hosted marketplace repo. Configures notification workflow, PAT secret, and publish pipeline.

Handles all three CPV layouts:

Layout A (separate plugin and marketplace repos) — full notify chain with MARKETPLACE_PAT and dispatch
Layout B (nested monorepo) — single repo, single tag, no cross-repo dispatch
Layout C (marketplace-in-plugin self-referential) — single repo with both manifests, single tag, no cross-repo dispatch (skips Phase 1 entirely)

Prerequisites

Plugin repo with valid plugin.json (name, version, description)
gh CLI authenticated (gh auth status)
For Layout A: marketplace repo with marketplace.json
For Layout C: same repo also has marketplace.json with self-entry (source: "./")
uv on PATH, plugin has pyproject.toml

Instructions

Phase 0: Detect layout and discover marketplace

Plugin root has marketplace.json → Layout C (skip Phase 1)
Parent has marketplace.json → Layout B (skip Phase 1)
Otherwise → Layout A: ask the user for <owner>/<marketplace-repo>, verify with gh repo view.

Phase 1: Configure Notification Pipeline (Layout A only)

Skip for Layout B/C — both manifests live in the same repo.

Create PAT: GitHub PAT with repo scope (publish-pipeline-guide §1)
Set secret: gh secret set MARKETPLACE_PAT --repo <owner>/<plugin-repo> --body "$MARKETPLACE_PAT" (MUST use --body)
Install notify-marketplace.yml: Copy from publish-pipeline-guide §2 → .github/workflows/, fill MARKETPLACE_OWNER/MARKETPLACE_REPO
Verify CI: ci.yml consolidated (lint + validate + test) per cpv-canonical-pipeline

Phase 2: Configure Publish Pipeline

Install publish.py: test -f scripts/publish.py
Install pre-push hook: uv run python scripts/publish.py --install-hook
Verify hooks: git config core.hooksPath shows git-hooks

Phase 3: Publish

Read the full file on GitHub · 114 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/publish-pipeline-guide.md 14 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 114 lines · 39 tokens per session scan A 19cb9fe76559

Subscribe to this mod's changes

cpv-publish-to-marketplace is a skill published in the GitHub repository Emasoft/claude-plugins-validation (4 stars, last pushed 15d ago), licensed MIT. It adds 39 tokens to every session and 1,219 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Building agents CI and CD Git and workflow Releases marketplace plugin publish

cpv-publish-to-marketplace next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
cpv-publish-to-marketplaceEmasoft/claude-plugins-validation	Skill	4	15d ago	MIT	A	39	Claude Code
plugin-publishzhinjs/zhin	Skill	137	today	MIT	A	58	Claude Code, Codex
flow-next-landgmickel/flow-next	Skill	717	yesterday	MIT	A	35	Claude Code, Codex
last-tagumputun/cc-thingz	Skill	493	3d ago	MIT	A	50	Claude Code
deploy-pipeline-runbookyeaight7/agent-powerups	Skill	8	1mo ago	Apache-2.0	A	41	Claude Code
pre-release-verificationyeaight7/agent-powerups	Skill	8	1mo ago	Apache-2.0	A	22	Claude Code
shipmartineserios/thebrana	Skill	3	today	MIT	C	29	Claude Code