skills.sh is a directory and install leaderboard run by Vercel. It does not write the skills it lists; anyone's public GitHub repo can appear there. It shows audits from three partners (Gen Agent Trust Hub, Socket and Snyk) on skill pages, which is more than most directories do. Trail of Bits showed in June 2026 that all three can be bypassed, so treat a clean audit as a good sign, not a guarantee, and read the skill before you install it.

What is the best alternative to skills.sh?

It depends on what you want from it. For a bigger index of GitHub skills, SkillsMP. For a short list of trusted skills, Anthropic's repo and the awesome lists. For skills that were reviewed and scanned by someone before you install, a curated library such as ProSkills. You can still use the skills CLI with any of them that publish a GitHub repo or a discovery index.

Are there paid Claude skills worth buying?

Sometimes. Most good skills are free, so a paid skill has to do something the free ones do not: go deeper on one job, stay maintained, or come reviewed and scanned. Try the free version of a skill first where one exists, check the scan score and the sample output, and only pay when it saves you real time. Agensi and ProSkills both sell skills; ProSkills shows each one's scan score and a with/without sample before you pay.

Do skills from these directories work in Cursor, Codex and Gemini CLI?

Most do. A skill is a folder with a SKILL.md file, an open format now read by Claude Code, Cursor, Codex, Gemini CLI and many other agents. Skills built for one platform, such as OpenClaw or a Claude Code plugin with hooks, may need changes elsewhere.

Safer than in early 2026, not risk-free. After researchers found hundreds of malicious skills on it in February, ClawHub added VirusTotal scanning of every upload and daily rescans. OpenClaw itself says this is not a silver bullet. Check the publisher and read the files before installing anything.

What is the agent skills discovery index?

A JSON file at /.well-known/agent-skills/index.json that lists a site's skills, from a Cloudflare RFC. The skills CLI reads it when you pass a full https URL, so npx skills add https://proskills.dev installs the ProSkills free skills without a GitHub repo.

Updated October 20, 2026

Where to find agent skills

There is no single best place to find agent skills. Use Anthropic's skills repo and well-known GitHub repos for trusted basics, skills.sh or SkillsMP to search the long tail, and a curated library such as ProSkills when you want skills that were reviewed and scanned before you install them. Here is how eight options compare, with sources.

Facts checked against each source on October 20, 2026. Counts change often; follow the links for current numbers. ProSkills publishes this page and is one of the options below.

Comparison

The options compared

Option	What it is	Curated or open	Security scanning	Price	Agents	Install
Anthropic skills repo	Anthropic's example skills and the document skills (PDF, Word, Excel, PowerPoint) behind Claude's file features.	Curated by Anthropic	None stated. Anthropic's docs say to use skills only from trusted sources.	Free. Many skills Apache 2.0; the document skills are source-available.	Written for Claude; SKILL.md folders work in other agents	`/plugin marketplace add anthropics/skills`
skills.sh	Vercel's directory and install leaderboard, fed by the open skills CLI.	Open: any public GitHub repo	Audits from Gen Agent Trust Hub, Socket and Snyk shown on skill pages	Free	The CLI README lists Claude Code, Codex, Cursor, OpenCode and 75 more	`npx skills add owner/repo`
SkillsMP	An independent index of SKILL.md files crawled from public GitHub repos, with categories, an API and an MCP server.	Open: crawled, no submission	None described; it asks you to review code before installing	Free	Any agent that reads SKILL.md	Copy from the linked GitHub repo
LobeHub Skills	LobeHub's marketplace of SKILL.md packages, with ratings and install counts per listing.	Open: users publish	None that we found described	Free	Any agent that reads SKILL.md	Per-listing instructions for your agent
ClawHub	The skill and plugin registry for OpenClaw agents, run by the OpenClaw Foundation.	Open, with an account-age gate, reports and moderation	VirusTotal scan of every upload, including an AI code review; daily rescans	Free	OpenClaw first	`clawhub install <skill>`
Agensi	A marketplace that sells skills from independent creators, plus free skills and bundles.	Creators list their own; the site says creators are vetted	An "8-point security scan"; the checks are not published	Free and paid. Creators keep 70%.	28 agents listed, including Claude Code, Cursor, Codex and Gemini CLI	Through Agensi's MCP server, after sign-in
Awesome lists	Hand-kept link lists on GitHub: ComposioHQ, travisvn, VoltAgent.	Curated by pull request	None	Free	Varies by skill; VoltAgent covers several agents	Follow each linked repo
ProSkills	A library of 67 skills written for this site, each reviewed by a person before release and personalised with a profile.md.	Curated: no outside submissions	Every skill scored by the open ProSkills scanner, score shown on its page	13 free (MIT), 54 paid	Claude Code, Cursor, Codex, Gemini CLI	`npx proskills-cli add <id>` or `npx skills add https://proskills.dev`

Details

Each option, briefly

Anthropic's skills repo

Anthropic created the SKILL.md format, which is now an open standard at agentskills.io and read by Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot and many more agents. Its skills repo holds the reference skills: the document skills Claude uses for files, plus creative, technical and enterprise examples. The README calls them demonstration and educational skills. It is the safest place to start and the smallest. It had about 182,000 GitHub stars when we checked.

skills.sh and the skills CLI

skills.sh ranks skills by installs counted through Vercel's open skills CLI. The CLI is the most useful part: npx skills add installs from a GitHub repo, a git URL, a local path or a site's discovery index, into the right folder for each agent. It also has find, list, check and update. It sends anonymous usage data unless you set DISABLE_TELEMETRY=1. Because listing is open, quality ranges from excellent to abandoned; installs tell you what is popular, not what is good.

SkillsMP

SkillsMP is a large, free index built by crawling GitHub; the site claims more than three million SKILL.md files. It is good for finding whether a skill for a niche task exists at all. It does not review or scan what it lists, and many entries are copies or forks of the same skill.

LobeHub

The LobeHub skills marketplace lists SKILL.md packages with ratings and install counts, alongside LobeHub's own chat app and MCP listings. It is a browsing directory first; check the source repo of anything you pick.

ClawHub

ClawHub is the registry for OpenClaw agents. In February 2026 Koi Security reported 341 malicious skills among the 2,857 then on ClawHub, most using fake setup steps to install a macOS infostealer (The Hacker News). ClawHub then added VirusTotal scanning of every upload with daily rescans, and blocks bundles flagged as malicious. It is the right place for OpenClaw skills; read the files first, as with any open registry.

Agensi

Agensi is a marketplace where creators sell skills and keep 70% of each sale. It says it has over 12,000 skills and lists 28 supported agents. Skills install through its MCP server once you sign in. It describes an 8-point security scan but does not publish what the checks are.

Awesome lists

ComposioHQ/awesome-claude-skills, travisvn/awesome-claude-skills and VoltAgent/awesome-agent-skills are hand-kept lists on GitHub. They are short enough to skim and reflect what other developers recommend. Entries are added by pull request and are not security-checked, so the list is a starting point, not a review.

ProSkills

ProSkills is this site. It is not a directory of other people's skills: it has 67 skills written here, 13 of them free, each read by a person and scored by an open scanner before release, with a real with/without sample on most skill pages. It is much smaller than the directories above. The free skills install with npx proskills-cli add <id>, or with npx skills add https://proskills.dev, which reads this site's agent skills discovery index. We also publish scan reports for 1,638 popular public skills from other authors, so you can check a skill before you install it from any directory.

Pick by need

How to choose

If you want…	Start with
Trusted basics, especially for files	Anthropic's skills repo
A well-known coding workflow	obra/superpowers
To see what is popular right now	skills.sh
To check whether a skill exists for a niche task	SkillsMP
Skills for OpenClaw	ClawHub
A short list other developers vouch for	An awesome list
Skills reviewed and scanned before install, with free and paid options	ProSkills
Picks by job across all of these	The best agent skills in 2026

Whichever you use, prefer a skill that does one job, says when it loads, keeps its body small, and comes from a repo with a licence and recent commits.

Safety

Install safely from any directory

A skill is instructions your agent follows with your permissions, and it can ship scripts. Open directories make that a supply-chain question. In February 2026 Snyk's ToxicSkills study found at least one critical issue in 13.4% of 3,984 skills from ClawHub and skills.sh. In June 2026 Trail of Bits showed that ClawHub's scanner and all three skills.sh audit partners could be bypassed. Our own scan of 1,638 popular public skills on October 19, 2026 matched a critical pattern in 61 of them; many of those turn out to be harmless in context.

Read SKILL.md and every script before installing. Look for curl | sh, fake "prerequisite" downloads, requests for keys, and hidden text.
Prefer skills pinned to a commit from an author you can identify.
Scan it: paste it into the scanner, or look it up in the reports.
Treat a clean scan as one signal. Scanners can be fooled, so a human read still matters.

The full walkthrough is in Is this skill safe? and the security checklist.

FAQ

Questions

Is skills.sh safe?: skills.sh is a directory and install leaderboard run by Vercel. It does not write the skills it lists; anyone's public GitHub repo can appear there. It shows audits from three partners (Gen Agent Trust Hub, Socket and Snyk) on skill pages, which is more than most directories do. Trail of Bits showed in June 2026 that all three can be bypassed, so treat a clean audit as a good sign, not a guarantee, and read the skill before you install it.
What is the best alternative to skills.sh?: It depends on what you want from it. For a bigger index of GitHub skills, SkillsMP. For a short list of trusted skills, Anthropic's repo and the awesome lists. For skills that were reviewed and scanned by someone before you install, a curated library such as ProSkills. You can still use the skills CLI with any of them that publish a GitHub repo or a discovery index.
Are there paid Claude skills worth buying?: Sometimes. Most good skills are free, so a paid skill has to do something the free ones do not: go deeper on one job, stay maintained, or come reviewed and scanned. Try the free version of a skill first where one exists, check the scan score and the sample output, and only pay when it saves you real time. Agensi and ProSkills both sell skills; ProSkills shows each one's scan score and a with/without sample before you pay.
Do skills from these directories work in Cursor, Codex and Gemini CLI?: Most do. A skill is a folder with a SKILL.md file, an open format now read by Claude Code, Cursor, Codex, Gemini CLI and many other agents. Skills built for one platform, such as OpenClaw or a Claude Code plugin with hooks, may need changes elsewhere.
Is ClawHub safe now?: Safer than in early 2026, not risk-free. After researchers found hundreds of malicious skills on it in February, ClawHub added VirusTotal scanning of every upload and daily rescans. OpenClaw itself says this is not a silver bullet. Check the publisher and read the files before installing anything.
What is the agent skills discovery index?: A JSON file at /.well-known/agent-skills/index.json that lists a site's skills, from a Cloudflare RFC. The skills CLI reads it when you pass a full https URL, so npx skills add https://proskills.dev installs the ProSkills free skills without a GitHub repo.

Keep reading

Free tool

Scan your own skill

Paste a SKILL.md or drop a folder. It is scored in your browser and nothing is uploaded.

Open the Skill Scanner

Want a skill that already passes? Start with a free one.

Your bag