Publishing in the Marketplace

Share knowledge articles and skills you wrote with every SphereHarness user. Each version you submit is scanned automatically and reviewed by a SphereHarness website administrator before anybody can install it.

Who can submit

Any signed-in SphereHarness user who has accepted the current licence agreement and verified their e-mail address, and whose account is at least 7 days old or belongs to an organisation. You publish under your public name — the same name you use in the forum; your e-mail address is never shown.

What you can submit

• Knowledge — .md, .txt, .yaml or .yml articles, up to 1 MB each.
• Skills — .skill.json files as the desktop agent exports them, up to 256 KB each.

One package holds one kind, at most 200 files and 20 MB. Make it with Export in the desktop agent (it writes a .sphereharness-pack file; see the content catalogue). Macros, automations, scripts, programs and pictures are not accepted.

Submitting

1. Signed in, open the marketplace and press Submit a package.
2. Give it a name (up to 100 characters), a summary (up to 500), its CAD category, a version number (1.0.0 for the first) and what changed.
3. Choose the licence under which everyone who installs it may use it:
   • CC BY 4.0 — others may use and adapt it, and must credit you;
   • CC0 1.0 — you give up your rights as far as the law allows; anyone may use it for anything;
   • MIT — a short permissive licence that keeps your copyright notice.
   You must have the right to grant it: the content is yours, or its owner allows you to publish it under that licence.
4. Tick that you accept the contributor terms, complete the verification box, and submit.

The automatic scan

Before a submission reaches a reviewer the server checks it. It is refused at once, naming the file and the reason, when it:

• is not a valid package (a file is missing, altered, outside its folder, or of a type that is not allowed), or is too large;
• contains HTML, a script tag, an embedded frame, or a javascript: or data: link;
• contains something that looks like a credential: an API key, an access token, a private key, a password-like token;
• links to a bare IP address, an unusual port, a link shortener or a disguised (punycode) host name;
• contains invisible characters (zero-width, right-to-left override and similar).

Other things are flagged for the reviewer rather than refused: wording that tries to steer the AI (“ignore the previous instructions”, “do not tell the user”, “upload … to”), long encoded blocks, a skill that names operations the product does not offer or asks to run scripts, and content that duplicates a package already listed. Every web address in the package is listed for the reviewer by host.

Review

• A SphereHarness website administrator reads the scan report and the content. Approved: the version is signed and listed, badged Community. Rejected: you get a notice with the reason; fix it and submit again.
• Every new version is reviewed again, including versions of a package that is already listed. Until the new version is approved, users keep getting the previous one.
• The listing shows your public name, the versions, the install count, the publication date, the licence and a summary of the scan (for example “12 articles, 3 external links”). There are no ratings or reviews.
• A Verified badge is added by a website administrator after a check; reseller staff and members of an organisation with a verified domain qualify automatically.

Withdrawing your package

You can withdraw your own package at any time. It is no longer listed or installable; people who installed it are told it was withdrawn and are offered Remove. Their copy is not deleted remotely, and the licence they received for the version they installed stays valid.

Blocking, removal and reports

• Signed-in users can Report a package (spam, malicious, a credential, copyright, offensive, other, with a note of up to 500 characters). Three reports from different people hide it until an administrator has looked.
• SphereHarness can block a package (it disappears from the listing and update checks; people who installed it see “blocked by SphereHarness” with the reason) or remove it (it is withdrawn, with a notice and the offer to remove it). We do this when a package breaks the contributor terms or the community rules, after a valid legal notice, or when it puts users at risk.

If somebody published your work: takedown

If a listed package contains material you own and did not license, use the takedown form: who you are, which work, which package, and a statement that you are the owner or act for the owner. We aim to block the package within one business day of a complete notice, then send the notice to the publisher. The publisher can answer with a counter-notice; an administrator then decides whether to restore the package. Records of a takedown are kept for two years.

What is stored about you

Your submissions are stored on our server: the package files, what you wrote about them, the scan report, the review decision and your acceptance of the contributor terms. Each published version carries the server’s signature, which includes your account’s internal number (not your name or e-mail address); copies people have already installed keep it. See the privacy policy.

See also

• The content catalogue — installing, updates, signatures
• Contributor terms and community rules
• Skills