# Distribute

Run the CocoBrew marketplace distribution quality gate before publishing or...

- Repository: https://github.com/Snowflake-Labs/cocoplus (727 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-04
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Snowflake-Labs/cocoplus --skill distribute -g -a claude-code -y`
Codex: `npx skills add Snowflake-Labs/cocoplus --skill distribute -g -a codex -y`
Cursor: `npx skills add Snowflake-Labs/cocoplus --skill distribute -g -a cursor -y`
Gemini CLI: `npx skills add Snowflake-Labs/cocoplus --skill distribute -g -a gemini-cli -y`

## Description

Run the CocoBrew marketplace distribution quality gate before publishing or recommending a CocoPod skill.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

Use this skill for `$brew distribute <skill-path>`.

## Objective

Evaluate a CocoPod skill package before marketplace distribution or recommendation. The gate protects users from prompt-dump skills, undeclared permissions, install-time execution, untested behavior, and unjustified network use.

## Five Criteria

1. **Explicit tool permissions:** SKILL.md frontmatter must declare the tools or permissions the skill expects.
2. **Observable evals:** `evals/` must exist and contain at least one runnable evaluation.
3. **Failure behavior:** SKILL.md must document `on_failure:` behavior or an equivalent failure-handling section.
4. **No install-time execution:** The package must not execute code during installation. Execution belongs only to explicit command invocations.
5. **Justified network use:** Any `network:` frontmatter declaration must include `network_justification:`.

## Verdicts

- **Clear:** All quality criteria pass and no security gate fails. Distribution may proceed.
- **Advisory:** One or more quality criteria are incomplete, but no security gate fails. Distribution requires developer acknowledgment and is not recommended automatically by CocoBrew.
- **Block:** A security criterion fails, install-time execution is detected, or the package omits critical permission declarations. Distribution stops. There is no bypass flag.

## Workflow

The rest: https://github.com/Snowflake-Labs/cocoplus/blob/HEAD/.cortex/skills/cocobrew/distribute/SKILL.md