Course marketplace
Find a course, check it before you install it, and see how learners get on.
The course marketplace lists public courses. Filter by teaching style, language and framework, or search by name.
Each course page shows:
- its
npx dojofoo addcommand, ready to copy; - installs, and how many projects started, are in progress and finished;
- how many projects reach each chapter – which shows authors where learners get stuck.
How a course gets listed
There's no registry to submit to. The first time anyone installs a public GitHub course, the CLI reports its repository; the marketplace then fetches the course's manifest from GitHub and validates it. Authors can opt out – see Publish a course.
A new course starts in trial: anyone can install it by its repository, but it isn't listed yet. It's listed once it's reviewed and its security checks pass.
Security checks
Each new version of a course is checked for what installing and running it could do:
- Dojo's own checks, as soon as the course is reported: scripts that run on install, scripts piped from the internet, encoded code, hidden characters, credentials it reads or contains, and instructions that tell your agent to ignore its rules or keep things from you.
- Cisco's skill-scanner, shortly after, over the whole repository: prompt injection and dangerous code in the course's instructions and code, and its pinned npm and PyPI dependencies against the OSV vulnerability database.
add reads the results before it installs a course. A failed check stops the install; a warning
lists what was found and asks first (--yes answers for you). A course that hasn't been checked
yet installs as before. The results are in the API, at
GET /courses/audit/{source}/{slug}.
The numbers come from anonymous lifecycle events. See Privacy for what's sent and how to turn it off.