Skill market

A showcase of the personal skills AutoRune avatars have learned, grouped by family. Only signed-in people can open it; there is no public version. Today it is read-only: nothing is bought, sold or traded. A later market will build on it (see Later: a real market).

Environment	Page
TEST	test.autorune.xyz/skill_market (sign-in required)

Who can see it

• Signed-in people only. Signed out, the page shows the normal sign-in screen; after signing in with Discord you land back on the market. The API behind it answers 401 without a session.
• Never agents. An avatar only ever sees its own family's skills, through its skill library (Skills and learning). The sandbox gate refuses every market address (/skill-market, /skill_market, a /public/… variant, any case or encoding) with 403 before anything is forwarded, and the agent's instructions don't mention the market. See Security.

Families

A family is every avatar of one owner account. On the market it is called "<owner's Discord username>'s family", for example cosmicloud's family.

Privacy

Your Discord username is shown to every other signed-in user as the name of your family, together with your avatars' names and their personal skills. Discord ids, AutoRune user ids and email addresses are never shown. An owner without a stored Discord username shows as "An unnamed family".

• Your family comes first and is marked, even before it has any skills.
• The other families follow, by best score (or average score, your choice).
• The app's settings link to it (🛒 next to 📜 avatar logs and 🏆 hiscores). Works on phones and desktop browsers.
• Filter by topic (the same topic tags as everywhere else, e.g. skill:mining, quest:restless-ghost, place:lumbridge) and search names, descriptions, avatars and families.

What each skill shows

• Name and version (v1, v2, …: a new version each time its script changed).

• What it does: the goal from its @skill header, then Needs (preconditions) and Result when the header has them, each as plain text: secrets scrubbed (the same filter as everywhere else), code, inline code, file paths and links removed (a line that reads like code goes as a whole), at most 300 characters.

• Topics: its topic tags.

• Used by: the family's avatars that ran it.

• Score 0–1000 with its KPI breakdown (points of each KPI's maximum and the figures behind them):

  • Reliability: success rate and the number of uses;
  • Effectiveness: result per minute (XP/min, items/min or goal progress);
  • Confidence: uses, and how many of the family's avatars succeeded with it;
  • Freshness: recent uses count more;
  • Damage: deaths, stuck runs and lost items cost points.

  How the score is computed: Skills and learning → the score.

• Last used.

Only shared skills appear: scripts whose agent gave them an @skill header. Private scripts, execute_code snippets and lab log lessons (even shared ones) never do. A skill whose header was removed leaves the market at the next refresh (privacy by default).

What it never shows

Not even for your own family, on this page:

• scripts or any code (preconditions and results only as cleaned plain text), file paths;
• lessons;
• internal ids (skills, avatars, users, Discord) and emails.

The response schema is strict and a test asserts that no script or code field ever appears in it.

The API

GET /skill-market with the app's normal session (Bearer access token), read-only:

• 401 without a session; rate-limited per user (429 with Retry-After);
• the market is built at most every 30 seconds and cached; each viewer gets it with their own family marked and first;
• response: families[] with name, yours, bestScore, averageScore and skills[] (name, description, preconditions, result, tags, avatars, version, score, kpis, lastUsed).

Later: a real market

A future market will let people list skills and track who owns what. That is why the market is behind sign-in, and why the API keeps every family and skill keyed by the owner's user id internally (the id is never sent to the page). Listings and ownership can attach to those keys later without changing what the page shows today. Nothing is listed or traded yet.