skills.sh review: the biggest free directory of agent skills (2026)

By /
skills.sh all-time leaderboard of agent skills, led by find-skills and Matt Pocock's grill-me

skills.sh is the biggest free directory of agent skills: plug-in instruction packs that teach Claude Code, Codex, Cursor and dozens of other AI agents new jobs. Vercel runs it, and it ranks skills by how often people install them. It's free and huge, and each skill shows results from three security scanners. But anything installed through Vercel's tool can appear on it automatically, with no human review, and fake skills have reached its trending list. I rate it ★★★½☆ 3.5/5.

Last updated 18 October 2026. Written by Annie, a search and digital marketing specialist. Based on the public site, documentation and security research; I did not publish a skill. See the editorial policy.

Key facts

  • What it is: A free directory and leaderboard of agent skills, ranked by installs
  • Made by: Vercel Inc., a US company best known for website hosting
  • Launched: 20 January 2026
  • Size: The all-time counter showed 1,382,591 on 18 October 2026. Vercel reported more than 69,000 skills in February 2026. About 2.1 million visits in three months (Similarweb, September 2026)
  • Price: Free. No paid plan, listing fee or commission
  • Best for: Developers and confident users who read a skill before installing it
  • Available in the UK: Yes, it's a public website
  • Seller commission: None. Skills appear automatically when people install them
  • Our rating: ★★★½☆ 3.5/5

On this page

What is skills.sh?

skills.sh lists agent skills, the folders of instructions and scripts that teach an AI agent how to do a particular job. A skill might make your agent write better tests, draw diagrams, build PowerPoint decks or audit a website for SEO. Each one is built around a file called SKILL.md and follows an open format, so one skill works across many agent apps.

You don't download anything from the website itself. You find a skill there, then install it with Vercel's free command-line tool: npx skills add owner/repo. That tool supports Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI and around 75 other agents.

The leaderboard is built from anonymous data sent by that tool. All Time ranks total installs, Trending ranks the last 24 hours, and Hot compares the last hour with the same hour the day before. Vercel doesn't publish the formulas, and one install is one install event, not one person.

skills.sh all-time leaderboard on 18 October 2026
The skills.sh all-time leaderboard, 18 October 2026. Vercel's find-skills and Matt Pocock's skills lead.

Who owns skills.sh?

  • Vercel Inc., a US company. Its privacy policy covers UK and EEA users and cites the UK Extension to the EU-US Data Privacy Framework.
  • Vercel launched skills.sh on 20 January 2026, in a changelog post by Andrew Qu, its Chief of Software, titled "Introducing skills, the open agent skills ecosystem".
  • The same day it was posted to Hacker News as "Show HN: Agent Skills Leaderboard", where it scored 135 points.
  • The npx skills tool is open source under the MIT licence on GitHub.

It's the default place people look for skills. The most-installed are:

SkillPublisherInstalls
find-skillsVercel3.9 million
grill-meMatt Pocock1.4 million
grill-with-docsMatt Pocock1.2 million
agent-browserVercel1.2 million
improve-codebase-architectureMatt Pocock1.1 million
tddMatt Pocock1.1 million
hyperframes-cliHeyGen1.1 million

Similarweb estimated about 2.1 million visits in the three months to September 2026. China and the US send the most visitors; the UK isn't in the top five. For what's rising right now, see our weekly chart of the top 20 agent skills.

How much does skills.sh cost?

Nothing. There's no paid plan, no listing fee and no commission. Packs, which bundle skills you want to share privately, need a free Vercel sign-in.

Some skills connect to paid services. Image and video skills, for example, often need an account and an API key with the company behind them, and you pay that company.

Hidden costs

  • Your agent's running costs. Skills add instructions your agent has to read, which uses tokens on paid AI plans.
  • Third-party accounts. Some skills only work with another company's tool and account.
  • Telemetry. The npx skills tool sends anonymous usage data. Set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 to switch it off.
  • Your time checking skills. Because nothing is reviewed by a person, the safety checks fall to you.

Best skills to try on skills.sh

These are popular, from well-known publishers, and useful beyond coding.

SkillPublisherWhat it doesInstalls
pptxAnthropicCreates and edits PowerPoint decks237,900
seo-auditCorey HainesAudits a site's crawlability, speed and on-page SEO230,700
copywritingCorey HainesWrites copy for home, landing and pricing pages227,700
docxAnthropicCreates and edits Word documents203,000
xlsxAnthropicBuilds and analyses spreadsheets with formulas184,100

Publishing your skill on skills.sh

  • There's no submission form or review queue. Put your skill in a public GitHub repo, and it appears on skills.sh once people install it with npx skills add.
  • There's no fee and no revenue share, and no way to sell a skill through the site.
  • Rankings depend on installs, so new skills from unknown publishers start at the bottom.

Is skills.sh safe?

It's a genuine service from a well-known company, but the skills on it are only as safe as the people who wrote them. Vercel's own docs say it "cannot guarantee the quality or security of every skill listed".

What helps: every skill page shows results from three security firms, Gen's Agent Trust Hub, Socket and Snyk, marked Pass or Warn, with a full report one click away. Many still show "Pending", which means not yet checked. When Zenity Labs reported fake skills in August, Vercel and GitHub removed them within 12 hours.

What doesn't: listings are automatic, and the scanners have been beaten.

  • Fake Paperclip skills. In July and August 2026 seven fake skills passed 1.7 million installs and reached the trending list while installing malware that stole SSH keys and cloud passwords (Zenity Labs).
  • Scanners bypassed. In June, Trail of Bits got two test malicious skills past skills.sh's scanners and advised against using skill marketplaces for sensitive work (Trail of Bits).
  • Copycat names. On 18 October the top trending skill came from magentosh/superpowers, an account using the name of the famous obra/superpowers framework, with install counts that look unnatural. Socket flags it as suspicious, though nobody has shown it to be malware.

Our guide, are agent skills safe to install?, has a five-point check to run before installing anything from here.

What other people rate it

I found no third-party star rating. On Hacker News the launch drew praise for a single place to find skills, and a recurring complaint that Vercel's own skills top the board. InfoQ covered the launch in February 2026. Security researchers have been far less kind: Trail of Bits "strongly discourage the use of skills.sh, ClawHub, and similar marketplaces" for sensitive deployments.

What's good

  • Free, with an open-source install tool
  • By far the largest catalogue, including official skills from Anthropic, Microsoft and Vercel
  • Three security scanners' results shown on every skill page
  • Works with around 75 agent apps, not just one
  • Fast takedown when malware was reported

What's not so good

  • No human review: anything installed can be listed
  • Install counts can be gamed, and malware has trended
  • Scanners have been bypassed, and many results say "Pending"
  • Ranking formulas aren't published
  • Command line only, so it's not for non-technical users

Who is it for?

skills.sh suits developers, technical marketers and agencies who already use Claude Code, Codex or Cursor and are happy to read a skill before installing it. If you're not comfortable reading code, stick to skills from publishers you recognise, or use a store with human review such as Anthropic's plugin directory or the Cursor Marketplace.

Using it in the UK

skills.sh works normally from the UK, and there's nothing to pay. Vercel's privacy policy covers UK users and cites the UK's data bridge with the US.

The bigger UK question is what the skills you install do with your data. A skill can send files to outside services, so check what it connects to before you use it on client or customer information, especially under UK GDPR.

Interesting facts about skills.sh

  • 12 of the all-time top 25 skills are Matt Pocock's, led by grill-me, which makes your agent question you before it builds anything.
  • The most-installed skill of all, find-skills, exists to help your agent find other skills.
  • Vercel reported more than 69,000 skills and 2 million installs just a month after launch.

Alternatives to skills.sh

Our rating

AreaScore
Choice5/5
Pricing clarity5/5
Getting started3/5
Trust and safety2/5
UK fit3/5
Overall★★★½☆ 3.5/5

skills.sh is the best place to discover agent skills and costs nothing, but treat it like a search engine, not a vetted store. Check the publisher and scan every skill before you install it.

Frequently asked questions

Is skills.sh free?

Yes. There's no paid plan, listing fee or commission. Some skills connect to paid services from other companies.

Is skills.sh safe?

Partly. Each skill shows results from three security scanners, but there's no human review, and fake skills that stole SSH keys reached 1.7 million installs in 2026. Check the publisher and scan a skill before installing it.

Who owns skills.sh?

Vercel Inc., a US company, which launched it on 20 January 2026 and also makes the npx skills install tool.

Sources

More guides

Scroll to Top