skills.sh

• 1. overview (644 chars)

  Skills.sh is an open AI agent skills ecosystem launched by Vercel Labs in January 2026, consisting of an online catalog platform and a CLI tool. It attempts to be the “npm” of AI programming assistants—an extension of the ability for developers to manage AI agents like software packages. As of April 2026, its npm core package has been downloaded more than 680,000 times a week, the platform has more than 60,000 skills included, and supports more than 45 mainstream AI programming tools. Despite rapid growth and widespread praise from the community, Snyk's security audit revealed the grim reality that 36.8% of skills have security vulnerabilities, and the platform urgently launched an automated security audit mechanism in February to address this challenge.

• 2. Product background (1444 chars)

  Skills.sh was born out of a very real pain point. Since the second half of 2025, AI programming assistants (Claude Code, Cursor, GitHub Copilot, Windsurf, etc.) have rapidly become popular, but these tools are independent, and users’ accumulated experience and best practices cannot be transferred across tools. A Nuggets author described the dilemma at the time in an article in January 2026: "The word Skills is very popular, but usually everyone is tortured to the point of collapse by looking for Agent Skills. There are too many repos, the keywords are too scattered, and you have to install them one by one when you see useful ones."   As one of the world's largest front-end cloud platforms, Vercel's Labs team (driven by Vercel co-founder and CEO Guillermo Rauch) officially launched the Skills ecosystem on January 20, 2026, which consists of two core components: the skills.sh website as a skills directory and ranking list, and the skills CLI tool as an installation manager. The project is open sourced under the MIT license, and the code is hosted at github.com/vercel-labs/skills. It is developed by Andrew Qu, chief software engineer at Vercel.   InfoQ pointed out Vercel’s deeper motivation for launching this product in a report on February 4, 2026: The reason why many current AI agents fail is not insufficient reasoning capabilities, but unreliable execution links. Skills.sh attempts to separate the "reasoning" and "execution" of the agent, providing the agent with a controlled, predefined instruction set to replace dynamically generated shell logic. This means that Skills is more than a simple configuration sharing tool, but an architectural answer to Vercel’s AI agent reliability problem.

• 3. Product functions and usage experience (3139 chars)

  The way the Skills.sh ecosystem works is very simple. Each skill is essentially a SKILL.md file, with a name and description defined using YAML frontmatter, and the body of the skill describing the professional knowledge and operating specifications in the field. Developers can install skills with a single command: npx skills add vercel-labs/agent-skills. The CLI tool will automatically detect which AI programming assistants are installed locally, install the skills to the corresponding directory, and share a skill with multiple tools through symbolic links.   The functions of the CLI tool cover the complete life cycle, including add (install), remove (uninstall), list (view installed), find (search), check (check for updates), update (batch update) and init (create new skill template). It supports installation from multiple sources such as GitHub repository, GitLab, local path, direct URL, etc. One parsing function uniformly handles more than 6 input formats, and the user experience is very friendly. From DeepWiki's technical analysis, the installation mode gives priority to using symbolic links and automatically falls back to copy mode in unsupported environments, taking both flexibility and reliability into consideration.   The skills.sh website itself plays a role similar to the npm registry, providing three ranking dimensions: All Time (total historical ranking), Trending (trending within 24 hours), and Hot (popular). Each skill details page displays data such as SKILL.md content, weekly installation volume, warehouse address, release time, and installation distribution. The ranking mechanism is based on anonymous telemetry data, which only tracks installations and does not collect personal information.   The platform supports a wide range of AI tools, reaching more than 45 types. In addition to mainstream players such as Claude Code, Cursor, GitHub Copilot, and Windsurf, it also includes Codex, Gemini CLI, Trae (produced by ByteDance), Goose, Roo, Cline, Amp, Kiro CLI, etc., and even domestic tools such as Kimi CLI and Tongyi Qianwen Code. These agents are divided into two types of processing: Claude Code, Cursor, etc. need to symbolically link skills from the public directory to their respective private directories; general agents such as Codex and OpenCode that follow the XDG specification read directly from .agents/skills/.The skill categories are very rich. From the compilation of Chinese communities such as Nuggets and Blog Park, popular categories include front-end development (React, Tailwind, Shadcn/ui), back-end and cloud services (Vercel, Supabase, Firebase), full-stack framework (Next.js, Expo), AI tools (browser automation, image generation, PDF processing), marketing content (SEO) Auditing, copywriting) and workflow optimization (brainstorming, TDD, debugging strategies), etc. Tencent Cloud Developer Community listed Skills.sh as the preferred platform for AI skill installation in a recent article, saying it can quickly add capabilities to agents through the npx command and support popular skills such as front-end design.   Integration with Vercel’s own products is a clear advantage of Skills.sh. Vercel officially maintains a large number of high-quality skills, covering React best practices, Next.js deployment, AI SDK, Web design guide, e-commerce capabilities (UCP), etc. These skills are proven, documented and quality-assured. In a discussion on Zhihu, a user pointed out that "when you start writing AGENTS.md, when you start to accumulate your own skills, the second half of AI programming tools is no longer about who can complete the code faster, but about who can organize the Agent better."

• 4. Pricing and business model (1116 chars)

  Skills.sh is completely free and does not have any paid features, subscription plans or enterprise version. The CLI tool is open source under the MIT license, and the skills.sh website is operated as a free directory service. Vercel has not shown any monetization intentions for the platform itself.   This strategy is not difficult to understand. From Vercel's perspective, the core value of the Skills ecosystem is to strengthen its influence in the AI ​​developer community. As more developers install Vercel-related skills (deployment, monitoring, AI SDK, etc.) for their AI agents through Skills.sh, Vercel's cloud service will naturally gain more users and project traffic. InfoQ quoted AI engineer Aakash Harish as saying: "Skills solves the problem of how developers share and discover the capabilities of agents," and the discovery layer itself is a powerful distribution entrance.   Competitor ClawHub (OpenClaw's skills market) is also free, but Chinese accelerated versions (such as SkillHub) have emerged in the community to solve network problems, indicating that the competition barriers under the free model mainly lie in network effects and content quality. Skills.sh currently has first-mover advantage and the Vercel brand endorsement, giving it a clear lead in the English development community.

• 5. User reviews (1872 chars)

  Positive community reviews of Skills.sh focus on several areas.   Practicality was the most frequently cited advantage. Nugget author Guoxk directly stated in his January 2026 article that the combination of skills.sh + Skills CLI "solves the pain point of crashing Agent Skills." The author himself adopted this set of tools when actually using OpenCode. Blog Park user yupi compiled a collection of articles on "40 Selected Agent Skills Resources" in February, listing Skills.sh as a core recommended platform and providing a complete one-stop guide from introductory tutorials to tool installation to resource collections.   The installation experience also received rave reviews. In a step-by-step tutorial in January 2026, Zhihu users recorded in detail the process of configuring Skills in Cursor, pointing out that the introduction of Skills allowed the AI ​​editor to "evolve from a code completion tool to a collaborative partner with professional domain knowledge." A recent article in the Tencent Cloud Developer Community summarized the complete process of "Large Model Skill-Cil Installation Skill", and specially provided a parameter scheme for forced installation for Codex users, reflecting the community's active exploration in adapting different tools.   Cross-platform compatibility is another recognized advantage. A developer said in a Nugget review: "It supports more than a dozen tools such as amp, claude-code, cursor, codex, gemini, github-copilot, goose, windsurf, etc. One set of skills can be used everywhere. This experience is really good."   However, negative feedback also exists objectively. Users in mainland China generally report that installations often fail due to GitHub network problems. Therefore, GitHub user lanceCryp developed the skills-cn project as an acceleration solution. He said frankly that "the quality of Skills installed through skills.sh is generally higher, but the installation process often fails due to GitHub network problems." In addition, some users pointed out in CSDN and Zhihu discussions that the quality of Skills is uneven. Some skills on the popular rankings are too simple, while truly valuable in-depth skills are not ranked high.

• 6. Industry evaluation (1656 chars)

  InfoQ provided Skills.sh with the most systematic industry analysis in its February 2026 coverage. The report positioned Skills.sh as "a tool to fill the gaps in execution reliability and capability discoverability in the current agent ecosystem" and cited the views of multiple developers. Software developer Thomas Rehmer believes that "discoverable skills solve the problem of what you can do in most agent settings." AI engineer Aakash Harish compared it to "npm for AI agents" and proposed that MCP (Model Context Protocol) and Skills are complementary rather than competitive - MCP solves how agents talk to tools, Skills solves how developers share and discover capabilities, and the ultimate winner may be a combination of the two.   In terms of the competitive product landscape, there are currently multiple parallel systems in the Agent Skills ecosystem. Skills.sh is the most versatile cross-platform solution, ClawHub is a dedicated market for OpenClaw, SkillsMP is another aggregation platform, and Cursor Rules and GitHub Copilot Extensions are the built-in capability expansion mechanisms of their respective tools. Cursor's official documentation has a dedicated Skills page, which defines Agent Skills as "an open source standard that encapsulates reusable knowledge and scripts" and supports integration through the SKILL.md file. Vercel lists 18 officially supported Agents in a February 2026 documentation update, positioning Skills.sh as a unified management layer across all of these tools.   It is worth noting that Runoob Tutorial (runoob.com) has incorporated Skills into its AI Agent tutorial system, explaining in very popular language: "Skills are essentially instructions for teaching AI to do things according to a fixed process. Once written, it can be called repeatedly like a function." This inclusion by mainstream programming education platforms shows that the concept of Skills is quickly becoming mainstream.

• 7. Controversies and Risks (2824 chars)

  Security issues are the biggest controversy faced by Skills.sh and are also systemic challenges faced by the entire Agent Skills ecosystem.   On February 5, 2026, the security company Snyk released the "ToxicSkills" research report, which conducted a comprehensive security audit of 3,984 Skills on ClawHub and skills.sh. The results were alarming: 36.82% (1,467) of Skills had at least one security vulnerability, 13.4% (534) had critical issues, and 76 were confirmed to contain malicious payloads. What is even more noteworthy is that 91% of malicious Skills use prompt injection and traditional malicious code at the same time, forming a combined attack to bypass the dual defense lines of AI security mechanisms and traditional security tools.   The attack techniques discovered by Snyk include: hiding data exfiltration commands through base64 obfuscation (decoding and executing curl to steal AWS credentials), distributing malware through password-protected ZIP to avoid anti-virus detection, modifying the systemctl service file to add a persistence backdoor, and conducting DAN-style jailbreak attacks on proxy security mechanisms. The report points out that the threshold for publishing a Skill is extremely low—just a SKILL.md file and a GitHub account of more than a week—making it easy for malicious actors to sneak into the ecosystem.   At the time of publication of the Snyk study, eight confirmed malicious Skills were still online, primarily on the ClawHub platform. While Snyk's report covers both skills.sh and ClawHub, the findings put immediate pressure on Vercel's platform given Skills.sh's larger size and faster growth.   Vercel's response was pretty quick. Just 12 days later, on February 17, 2026, Vercel announced that it had cooperated with three security companies, Gen, Socket, and Snyk, to launch an automated security audit function. Audit results are publicly displayed on each Skill details page, Skills marked as malicious are automatically hidden from rankings and searches, and the CLI tool displays audit results and risk levels before installation starting from v1.4.0. Vercel said the system has covered audits of 60,000+ Skills, an order of magnitude improvement compared to the 3,984 samples reported by Snyk.But security risks are not completely eliminated. The Snyk report states that Agent Skills have full agent permissions by default - shell access, file reading and writing, credential access, message sending, persistent memory - which means that once installed, a malicious Skill could theoretically take full control of the user's development environment. Third-party security tools (such as skill-security-auditor, mcp-scan) have also appeared in the community to make up for the shortcomings of the platform security mechanism. This in itself is a signal that the security ecosystem is not yet mature.   Another potential risk is platform dependency. Skills.sh is led by a single company, Vercel. Although the project is open source and licensed under the MIT license, the skills.sh website as the core registry is in the hands of Vercel. If Vercel changes its strategy, restricts access, or adjusts its ranking algorithm, the entire ecosystem will be affected. This has been seen in the history of npm (which experienced many policy controversies after being acquired by GitHub).

• 8. Applicable groups and usage suggestions (1408 chars)

  Skills.sh is best suited for developers who are already using or planning to use an AI programming assistant. If you use Claude Code, Cursor, GitHub Copilot, Windsurf or similar tools on a daily basis, and want to inject domain-specific expertise and operational specifications into these tools, Skills.sh is currently the most convenient unified entrance.   It is particularly valuable for the following categories of people: developers who frequently switch between multiple AI tools (a set of skills shared by multiple tools), technical leaders who want to unify AI tool best practices for their teams (standardized through project-level Skills), and front-end and full-stack engineers who have in-depth needs on specific technology stacks (such as Next.js, React, Supabase) (Vercel's official Skills are of higher quality).   People who are not suitable for it include: traditional developers who do not use any AI programming assistants, enterprise environments with extremely high security requirements (which require internal audit mechanisms and cannot rely entirely on platform audits), and users who have high installation success rate requirements in mainland China's network environment (may need to cooperate with acceleration solutions such as skills-cn).   In terms of alternatives, if you only need to customize a single tool, Cursor Rules (.cursorrules file) and Claude Code's CLAUDE.md configuration are lighter choices; if you need an enterprise-level tool integration protocol, Anthropic's MCP (Model Context Protocol) provides a more structured solution; if you mainly use the OpenClaw ecosystem, ClawHub is a native skills market.

• 9. Summarize (952 chars)

  Skills.sh is an important infrastructure-level product in the rapid evolution of the AI ​​programming assistant ecosystem. It uses the most concise way (a SKILL.md file + an npx command) to solve the standardization and discoverability problems of AI agent capability expansion. It has reached a scale of nearly 700,000 downloads in three months, proving the real existence of market demand. Vercel's brand endorsement and deep integration with its own cloud services give it a strong competitive advantage, while the MIT open source license and broad tool compatibility lower the barrier to adoption. However, the Agent Skills ecosystem is still in its early stages, and the seriousness of the security risks (more than one-third of skills have vulnerabilities) reminds users that they must remain vigilant while enjoying the convenience. Be sure to check the audit results and review the SKILL.md content before installation. With the improvement of the automated security audit mechanism and the improvement of community maturity, Skills.sh is expected to truly become the core distribution layer in the era of AI agents.

No in-depth report yet

• 

  RudesindoAlmeida

  —

  skills.sh 确实是个好东西，现在每天都在用 find-skills 找技能，装上就能用，省了不少自己写 prompt 的时间

---

• 

  Dylan.MillerK

  —

  browser-use 这个技能太香了，AI 直接帮我操作浏览器，省掉多少重复劳动

---

• 

  Andrew.Anderson_2022

  —

  用了三个月，确实好用

---

• 

  Brenda.Foster

  —

  前端必装 vercel-react-best-practices，57条规则直接套用，改完性能提升明显

---

• 

  Laura.ThomasK

  —

  说实话安装量高的不一定好，踩过几个坑，还是官方出品的靠谱

---

• 

  PaulLee_2024

  —

  YYDS！终于不用每次都跟 AI 重复说代码规范了

---

• 

  Nathan_Moore_X

  —

  作为一个用了两个月的老用户，个人体验：基础功能确实扎实，但质量参差不齐的问题确实存在。建议只装官方那几个

---

• 

  trueIinaMaki_dev

  —

  agent-browser 用来自动登录后台查数据，运营和产品应该会喜欢

---

• 

  悠然_11

  —

  说实话，有点被吹过头了。用了两周，80%的 skill 都是凑数的，真正有用的就那么几个

---

• 

  trueLavanyaChiplunkar_dev

  —

  Claude Code 装了 frontend-design，做出来的设计确实没那么 AI 味了

---

• 

  CarlColeman_2022

  —

  一小时新增550个技能，这个增长速度有点吓人，质量能不能跟上是个问题

---

• 

  JesseBennett_99

  —

  SEO 审计这个 skill 很实用，非技术人员也能用

---

• 

  AaronHoward_99

  —

  建议平时只装3-5个高频的，装太多影响上下文加载速度

---

• 

  Maria_CampbellX

  —

  vercel-react-best-practices 真的管用，帮我项目优化了不少

---

• 

  SelimNeff

  —

  web-design-guidelines 严格得有点变态，但确实解决了 UI 返工的问题

---

• 

  Angela_Davis520

  —

  发现了个好东西叫 skillhub，专为中国用户优化的社区

---

• 

  Pamela.Carter_X59

  —

  对比过几个平台，skills.sh 还是最全的，就是筛选机制不太行

---

• 

  Gregory_Hernandez_2024

  —

  免费无限制这点很良心

---

• 

  Jennifer_ColemanSr

  —

  个人开发者仓库的 skill 要谨慎，装之前最好看看源码

---

• 

  MLewisQ

  —

  用自然语言让 AI 帮你选 skill，这个思路很聪明

---

• 

  Nicole_Green_660

  —

  skills.sh 有点像 AI 技能的 npm，安装生态起来了确实方便

---

• 

  Gregory_RobertsIII

  —

  Cursor 2.5.0 目录变更问题还在，要手动创建符号链接才能用

---

• 

  EricaCarlson

  —

  安全风险确实要考虑，skill 可以包含可执行脚本

---

• 

  Jeremy_JamesZ7

  —

  better-auth-best-practices 做登录系统的必装，减少很多坑

---

• 

  梁涛

  —

  就是来解决重复输入痛点的，装完就回不去了

---

• 

  MLopez_2022

  —

  跨代理兼容性这点很实用，换工具不用重新配置

---

• 

  Patrick.WhiteX3

  —

  说实话比想象中好用，但别期望太高

---

• 

  康明

  —

  目前最方便的 skill 管理工具，没有之一

---

• 

  FrankGreen369

  —

  Vercel 出品，必属精品

---

• 

  Walter_Ortiz_77

  —

  用了两周，暂时没遇到什么问题

No reviews yet