skills.sh
Vercel's open registry for agent skills: publish once, install into 30+ AI coding agents.
About
skills.sh is Vercel Labs' open-source registry for reusable agent skills, launched in early 2026 and quickly the closest thing the ecosystem has to an npm for skills. A skill is a Markdown package (SKILL.md plus optional scripts, templates, and examples) that an agent loads only when relevant, keeping instructions accurate without burning context window.
Installing is one command: npx skills add <owner/repo> auto-detects your agent and drops the skill into the right directory for Claude Code, Cursor, Copilot, Aider, Codex, Gemini, and 20+ others. A usage leaderboard based on anonymous install telemetry shows which skills the community actually uses, and a skills-lock.json turns skills into managed, updatable project dependencies.
The honest caveat: skills are third-party code your agent executes, and security researchers (including Trail of Bits) have demonstrated scanner bypasses across skill registries, with at least one credential-theft campaign tied to skills.sh listings. Treat installs like any dependency: check the source before adding.
What it can do
- Open registry of reusable agent skills with install telemetry leaderboard
- One-command install across 30+ agents with auto-detection
- skills-lock.json for versioned, updatable skill dependencies
- `npx skills find/search/check/update` CLI workflow
- Fully open source (vercel-labs/skills, MIT)
Setup
Run npx skills add <owner/repo> in your project; the CLI detects your agent and installs to the right skills directory. Browse at skills.sh.
Prerequisites
Node.js for npx; any supported AI coding agent.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: 35,088 GitHub stars (vercel-labs/skills); repo pushed 2026-10-09; MIT license confirmed via GitHub API; Registry mechanics (npx skills add, agent auto-detection, skills-lock.json, telemetry leaderboard) verified against official site and docs. Manual review: third-party skills are executed code -- Trail of Bits scanner bypasses and a credential-theft campaign are documented; treat installs like dependencies. License: MIT (vercel-labs/skills).
★ 35,088 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.0/10
- Maintenance · recency, releases, issue load
- 9.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · 35,088 GitHub stars (vercel-labs/skills); repo pushed 2026-10-09; MIT license confirmed via GitHub API
- · Registry mechanics (npx skills add, agent auto-detection, skills-lock.json, telemetry leaderboard) verified against official site and docs
- · manual review: third-party skills are executed code -- Trail of Bits scanner bypasses and a credential-theft campaign are documented; treat installs like dependencies
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.