feat(skills): Skills Registry & Hub — register skills, browse in AI Hub, public skill hub

[ishaan-berri]

Relevant issues

Closes #skills-registry

What this does

Adds a Skills Registry to LiteLLM — a way for teams to register Claude Code skills, browse them in the AI Hub, and expose a public skill hub for agents and developers.

Backend:

• /public/skill_hub endpoint (no auth) — returns all enabled skills
• domain and namespace fields stored in manifest_json (no schema change)

UI changes:

• Skills moved to top-level nav (was buried under Experimental)
• Smart URL input in Add Skill form — paste any GitHub URL, source type and name auto-detected
• Skill detail view (Guardrail Garden pattern) — Overview + How to Use tabs, install command, source link
• "Select Skills to Make Public" button in AI Hub → 2-step checklist modal
• Skill Hub tab in AI Hub: stats row, domain dropdown filter, browsable table
• Skill Hub tab on public AI Hub page (no auth required)

Pre-Submission checklist

• No breaking changes to existing /claude-code/plugins endpoints
• /public/skill_hub added to no-auth whitelist in _types.py
• domain/namespace stored in existing manifest_json column — no migration needed

Type

• Bug fix
• New feature
• Refactor

Changes

• litellm/types/proxy/claude_code_endpoints.py — domain/namespace fields
• litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py — persist domain/namespace
• litellm/proxy/public_endpoints/public_endpoints.py — /public/skill_hub
• litellm/proxy/_types.py — whitelist new public endpoint
• ui/ — 15 UI files across nav, forms, hub table, detail view, public page

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
litellm	Ready	Preview, Comment	Apr 4, 2026 0:13am

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 16 untouched benchmarks

---

_{Comparing worktree-magical-puzzling-tide (5579b82) with main (48d4dec)}

[greptile-apps]

Greptile Summary

This PR introduces a Skills Registry & Hub — a way for teams to register Claude Code skills, browse them in the AI Hub dashboard, and expose a public, unauthenticated GET /public/skill_hub endpoint. The backend changes are minimal (no schema migration: domain/namespace are stored inside the existing manifest_json column), and the UI adds a top-level Skills nav item, a smart GitHub URL parser in the Add Skill form, a detail view, and a 2-step "Make Public" modal. The feature follows the established patterns for /public/agent_hub and /public/mcp_hub.

Key findings:

• Inline imports in public_skill_hub() (public_endpoints.py) — _get_prisma_client, ListPluginsResponse, and PluginListItem are imported inside the handler body, violating the project's "no inline imports" rule from CLAUDE.md. Neither import creates a circular dependency, so they can move to the module-level import block.
• SkillDetail silently drops props — isAdmin, accessToken, and onPublishClick are declared in the interface and passed by both callers, but are never destructured or used in the component. The onPublishClick={fetchPlugins} callback therefore never fires, leaving parent lists stale after any action taken from the detail view.
• Unbounded find_many in the public endpoint — find_many(where={\"enabled\": True}) has no take limit; at scale this will load all enabled skills into memory on every public page load.
• Redundant URL parser condition in add_plugin_form.tsx — parts.length === 2 || (parts.length === 2 && repoBase) always reduces to parts.length === 2.
• No unit tests added — CLAUDE.md asks for at least one test when adding new features; no test covers the new /public/skill_hub endpoint.

Confidence Score: 4/5

Safe to merge after addressing the dropped SkillDetail props (which silently breaks the intended refresh callback) and moving inline imports to module level.

One P1 finding (SkillDetail props not destructured, causing onPublishClick to never fire) should be fixed before merge. The remaining findings are P2 style/quality issues (inline imports, missing pagination cap, redundant condition, no tests) that don't break the primary happy path.

ui/litellm-dashboard/src/components/claude_code_plugins/skill_detail.tsx (dropped props) and litellm/proxy/public_endpoints/public_endpoints.py (inline imports, missing pagination).

Important Files Changed

Filename	Overview
litellm/proxy/public_endpoints/public_endpoints.py	Adds /public/skill_hub endpoint; uses inline imports inside the handler (violates CLAUDE.md) and imports the private _get_prisma_client across module boundaries.
litellm/proxy/anthropic_endpoints/claude_code_endpoints/claude_code_marketplace.py	Persists domain and namespace fields in manifest_json; change is minimal and correct. list_plugins now returns domain/namespace from manifest.
litellm/proxy/_types.py	Adds /public/skill_hub to the no-auth whitelist; correct placement consistent with other public hub routes.
litellm/types/proxy/claude_code_endpoints.py	Adds optional domain/namespace fields to RegisterPluginRequest and PluginListItem; backward-compatible, no migration required.
ui/litellm-dashboard/src/components/claude_code_plugins/skill_detail.tsx	Declares isAdmin, accessToken, onPublishClick in SkillDetailProps but does not destructure or use them; onPublishClick callback wired by both callers will never fire from within this view.
ui/litellm-dashboard/src/components/claude_code_plugins/MakeSkillPublicForm.tsx	2-step modal for selecting and confirming which skills appear in the public hub; logic is sound but uses NotificationsManager.fromBackend() for client-side validation errors (minor semantic mismatch).
ui/litellm-dashboard/src/components/AIHub/SkillHubDashboard.tsx	Stats row, domain dropdown filter, and skill table; client-side filtering is correct and concise.
ui/litellm-dashboard/src/components/claude_code_plugins/add_plugin_form.tsx	Smart GitHub URL parser added; logic is mostly correct but the condition parts.length === 2
ui/litellm-dashboard/src/components/networking.tsx	Adds skillHubPublicCall() — uses proxyBaseUrl with correct fallback to relative URL; no auth header sent, consistent with other public calls.
ui/litellm-dashboard/src/components/public_model_hub.tsx	Adds Skill Hub tab to public AI Hub; fetches skillHubPublicCall() independently alongside model/agent/MCP fetches, correct pattern.

Sequence Diagram

sequenceDiagram
    participant User as Public User / Agent
    participant UI as Public AI Hub Page
    participant NET as networking.tsx
    participant EP as /public/skill_hub
    participant MKT as claude_code_marketplace.py
    participant DB as Prisma DB

    User->>UI: Load public AI Hub
    UI->>NET: skillHubPublicCall()
    NET->>EP: GET /public/skill_hub (no auth)
    EP->>MKT: _get_prisma_client() (inline import)
    MKT->>EP: prisma_client
    EP->>DB: find_many(where={enabled: True})
    DB->>EP: List[Plugin records]
    EP->>EP: parse manifest_json for each record
    EP->>NET: ListPluginsResponse{plugins, count}
    NET->>UI: response.plugins
    UI->>User: Render SkillHubDashboard (filter by domain, search)

    Note over UI,NET: Admin flow — Make Skills Public
    User->>UI: Click Select Skills to Make Public
    UI->>UI: Open MakeSkillPublicForm modal (2-step)
    User->>UI: Select skills and Confirm
    UI->>NET: enableClaudeCodePlugin / disableClaudeCodePlugin per skill
    NET->>MKT: POST /claude-code/plugins/{name}/enable or disable
    MKT->>DB: update(enabled=True or False)
    DB->>MKT: updated record
    MKT->>NET: success
    NET->>UI: Refresh skills list

Loading

_{Reviews (1): Last reviewed commit: "docs(skills): add loom walkthrough video..." | Re-trigger Greptile}

[greptile-apps]

Inline imports violate project style guide

CLAUDE.md says: "Avoid imports within methods — place all imports at the top of the file (module-level). The only exception is avoiding circular imports where absolutely necessary."

Neither import here creates a circular dependency — public_endpoints.py already imports from litellm.proxy.auth.user_api_key_auth (which touches proxy_server) and litellm.types.* freely at module level, so these two can move up as well.

Additionally, _get_prisma_client carries a leading underscore that conventionally marks it as module-private. Importing a private symbol across module boundaries is a design smell; consider exposing a public helper or duplicating the two-line guard inline.

Move both lines to the top-level import block alongside the other litellm.types.* imports already present (lines 20–30).

Context Used: CLAUDE.md (source)

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

[greptile-apps]

No pagination guard on unbounded find_many

CLAUDE.md states: "Bound large result sets. Prisma materializes full results in memory."

find_many(where={"enabled": True}) has no take limit. If an organisation registers thousands of skills, every call to the public hub endpoint will load them all into memory. The other public hub endpoints (/public/agent_hub, /public/mcp_hub) have the same pattern, but that doesn't make it correct here.

Consider adding a reasonable take cap (e.g. 500) and documenting it, or at minimum noting it as a known limitation in a follow-up ticket.

Context Used: CLAUDE.md (source)

[greptile-apps]

isAdmin, accessToken, and onPublishClick props are silently dropped

SkillDetailProps declares three props that both callers (claude_code_plugins.tsx lines 84-86 and SkillHubDashboard.tsx) explicitly wire up, but the component only destructures skill and onBack — the other three are silently ignored.

The most concrete consequence: onPublishClick={fetchPlugins} is passed from claude_code_plugins.tsx so the parent list refreshes after an action on the detail page. Because onPublishClick is never called inside the component, that refresh never happens — any publish/unpublish action started from the detail view will leave the parent list stale.

If admin actions on the detail page are intentionally deferred, remove the unused props from the interface and the two call sites. If they are meant to be used, destructure them and wire up the admin UI.

[greptile-apps]

Redundant condition in URL parser

The condition parts.length === 2 || (parts.length === 2 && repoBase) simplifies to parts.length === 2 because the second disjunct is always a strict subset of the first. The comment says "exactly 2 parts, or ends with .git" but the .git stripping already happens earlier via repo.replace(/\.git$/, "") — so both branches produce the same result.

More importantly, a URL like https://github.com/org/repo/tree/branch (4 parts, no file path) returns null from this parser since parts.length >= 5 is not satisfied. Consider whether that case needs a fallback to the plain github source type.

[codecov]

Codecov Report

❌ Patch coverage is 75.00000% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...s/claude_code_endpoints/claude_code_marketplace.py	50.00%	2 Missing ⚠️

📢 Thoughts on this report? Let us know!