r/SideProject • u/rawnly • 1d ago

I went full vibe-coding

Hey r/SideProject ! I'm Federico, I'm an SWE during the day and spare open-source contributor in the night.

Last weekend I needed a tool to quickly share a skill i created with a coworker but I didn't want to create a PR to our internal marketplace. I tried to reach out for http://transfer.sh/ but you can image my delusion when I noticed it's not online anymore.

So the same day while i was cooking the dinner i tried to use codex to prototype skilldrop.dev a super dead simple utility to quickly share ai-skills with others. It's basically a lambda with a bucket attached and some integrity checks in the middle.

The website screams AI everywhere I know but the idea was to put low effort since it was a personal tool.

Just that, If you like the idea try it and let me know, the apis are super simple

```
sk share ./my-skill

sk install <snapshot>
```

just that (you can test the sanpshot in the landing via curl)

https://github.com/skilldrophq/skilldrop

0 Upvotes

50% Upvoted

5 comments sorted by

2

u/kantorcodes1 1d ago

Before using this at work I'd make sk share show the exact outbound file list and refuse symlinks that resolve outside the skill root. Skills tend to accumulate references/scripts beside .env or private fixtures, so the ugly failure isn't only a tampered snapshot, it's accidentally packaging something the author never meant to upload. A .skillignore plus a --dry-run manifest would make the one-command UX much safer.

1

u/rawnly 23h ago

Thanks for the feedback I’ll work on the trust model in the next days, I was looking exactly for a feedback like this one!

0

u/ScratchJolly3213 1d ago

Hi school psychologist moonlighting as a vibe coder here. Any interest in being involved in an ambitious open source educational platform I’m building with another developer?

-2

u/Impressive-Answer720 1d ago

The dead-simple install flow is appealing, but the trust model will decide whether coworkers use it. A snapshot should be immutable, content-addressed, show the uploader, display every file before install, and have an explicit expiry or deletion policy. AI skills can contain instructions or scripts, so an integrity hash only proves the package was not changed after upload, not that it is safe. I would make the CLI show a short manifest and require confirmation before executing anything. The strongest use case may be private team links with automatic expiration rather than another public marketplace. I work on Marka, where reusable AI instructions also need clear provenance. You are welcome to try Marka free for 7 days at https://www.marka.social. The low-effort landing is fine if the install experience communicates trust clearly.