App Marketplace Review Skill: What It Does and How to Install It

Helps the operator of an app marketplace design how third-party apps are reviewed, approved, re-reviewed and removed.

Installs: 9.6K; on skills.sh
Stars: 9; on GitHub
Files: 4; besides SKILL.md
Updated: Nov 2026; last repo commit

app-marketplace-review makes Claude act as a marketplace-trust advisor and write a review-process design document. It covers pipeline shape scaled to data sensitivity, permission and data-access audits, automated pre-screening with human triage, re-review triggers on app updates, publish-channel hardening, appeals, and a severity-tiered revocation policy.

It loads when you mention app review, approval criteria, permission audits, re-review after an update, appeals or delisting. It asks ten interview questions and drafts in eight steps. It is operator side only and bundles three reference files and no scripts.

Good for

Marketplace teams building a security review for third-party apps
Teams whose review takes weeks and frustrates partners
Platform owners tightening what happens when an installed app updates

Install app-marketplace-review

Claude Code

Copy this prompt.

Install the app-marketplace-review skill in Claude Code. Run this command:

/plugin marketplace add samber/developer-platform-skills
/plugin install developer-platform-skills@developer-platform-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The README installs every skill in the repo (61 skills/*/SKILL.md in the git tree), because skills here reference each other. app-marketplace-review is one of them. Pick one route, not both.

From the project README. Source.

What's in the skill

When it loads

Design the operator-side review and approval process for third-party apps on a B2B SaaS marketplace - review-pipeline shape scaled to data sensitivity, permission and data-access audit checkpoints, automated pre-screening with human triage, objective re-review-on-update triggers, publish-channel hardening against supply-chain attacks, appeal paths, and a severity-tiered revocation policy. Use whenever the user mentions app review, marketplace approval criteria, third-party app permission audits, re-review after an app update, rejection appeals, or delisting and revocation - even if they never say "app review". Operator side only. Do NOT use for submitter onboarding - use samber/developer-platform-skills@partner-app-onboarding instead.

Sections in SKILL.md

Interview
Data sensitivity
Workflow
1. Review-pipeline shape
2. Permission and data-access audit
3. Re-review-on-update policy
4. Publish-channel hardening
5. Appeal path
6. Revocation and post-approval enforcement
Failure modes
Measurement
Invocation examples
References

Key facts

Author: Samuel Berthe
Repo: samber/developer-platform-skills, which holds 61 skills
License: MIT (LICENSE, README, plugin.json and SKILL.md all say MIT)
Version in SKILL.md: 1.0.4
Installs on skills.sh: 9,630 (Nov 2, 2026)
GitHub stars (repo): 9 (Nov 2, 2026)
Last commit (repo): Nov 1, 2026
What installs: 5 files including SKILL.md: 3 reference files and evals/evals.json; no scripts
Needs: The other skills in the repo; the README says to install all of them
Works in: Claude.ai, Claude Code, Codex, Cursor, Gemini CLI, and tools that read skills.sh installs

What it includes

Asks ten questions and sets data-sensitivity tiers.
Try: “An installed app just leaked customer data through an auto-update. Rewrite our re-review and revocation policy so that can't happen again.”
Interview
Settles sensitivity tiers, volume, propagation model and curation rung.
1. Fix the design inputs
Chooses the pipeline shape and review depth per tier.
2. Review-pipeline shape and depth
Specifies permission audit, data-access review, security testing and functional review.
3. Admission review
Sets objective triggers for re-review.
4. Re-review on update
Hardens the update channel against supply-chain attacks.
5. Harden the publish channel
Designs how a rejected partner appeals.
6. Appeal path
Writes severity-tiered revocation and post-approval enforcement.
7. Revocation and enforcement ladder
Sets measurement and checks the document against the gates.
8. Measurement and gate check

From the official docs

Permissions

Low risk

This skill writes design advice and bundles no scripts, so the main thing to watch is where your agent saves notes.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

It may save notes to developer-platform-context.md
SKILL.md says that when your agent keeps memory in a file, it should consider using this file name. Our advice: keep it out of commits if it holds company plans. github.com

Technical details

Scopes	Asks you interview questions and writes a design document from your answers

Questions

How do I install app-marketplace-review?

Use the install box at the top of this page. The README says to install every skill in samber/developer-platform-skills, not one, because the skills hand work to each other. Pick one route per agent.

Does app-marketplace-review work in Claude, Codex and Cursor?

The README documents install routes for Claude.ai (plugin marketplace), Claude Code, Codex, Cursor, Gemini CLI and the skills.sh CLI. The install box lists each one.

What does it ask me before it designs anything?

SKILL.md lists ten questions to ask first, and the answers change the later steps. Have your current setup and constraints ready.

Does it run scripts or need an API key?

It bundles no scripts. The folder holds SKILL.md, reference Markdown files and an evals file, and the skill works by asking you questions and writing advice.

Is app-marketplace-review safe to install?

It bundles no scripts, so installing it adds instructions and reference files rather than programs. SKILL.md also suggests that, if your agent keeps notes in a file, it uses developer-platform-context.md. Our advice: keep that file out of public commits if it holds company plans, and check any figures the skill cites against their sources before quoting them to customers.

Is this for developers submitting an app?

No. SKILL.md says it is operator side only and points submitter onboarding to partner-app-onboarding.

Information

updated Nov 2, 2026

Repository: samber/developer-platform-skills
Folder: skills/app-marketplace-review

samber/developer-platform-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2

samber/developer-platform-skills README · github.com
app-marketplace-review SKILL.md · github.com