Skills.sh - Agent Skills Registry

The definitive open registry for agent skills. One command to search, install, and update modular capabilities for any AI coding agent.

What It Is

skills.sh is the package manager and directory for the open agent skills ecosystem. Skills are reusable SKILL.md files that extend agent capabilities with specialized procedural knowledge - SEO auditing, React best practices, design systems, deployment workflows, security reviews.

The CLI (npx skills) works like npm for agent capabilities: find, add, check, update. The registry at skills.sh ranks skills by total installs, shows security audit status (Gen Agent Trust Hub, Socket, Snyk), and tracks adoption across agent platforms (Cursor, Claude Code, Codex, Copilot, Gemini CLI, etc.).

Skills are most useful when paired with a concrete reference artifact, not used as a context dump. The Spotted in Prod bookmark shows the right pattern for design work: choose a shipped UI reference, select the single relevant design/implementation skill, then ask the agent to translate named qualities. Loading every skill wastes context and weakens taste. Source: X/@starkience, 2026-04-08

Why It's the Default

Before skills.sh, agent skills were scattered: hand-written SKILL.md files, repo-specific .claude/ configs, framework-specific prompts. skills.sh provides:

1. Discovery - search by keyword, browse by category, ranked by installs
2. Quality signals - install counts, GitHub stars, source reputation, security audits
3. Universal format - one SKILL.md works across Cursor, Claude Code, Codex, Copilot, Gemini CLI, OpenCode, Amp
4. Supply chain safety - security audits via Gen Agent Trust Hub, Socket, Snyk; cross-reference with Brin - Agent Context Security for artifact scoring

The Skills-First Rule (Enforced)

Every agent session in every repo must follow this protocol:

1. Before any specialized task, check installed skills for a match
2. If no match, use find-skills to search skills.sh
3. If a skill exists, read and follow it - skills encode proven upstream procedures
4. If no skill exists, proceed with wiki knowledge and general capabilities
5. After solving a novel task well, consider creating a skill for it

This is enforced in AGENTS.md, .cursorrules, and CLAUDE.md. The rationale: skills encode upstream knowledge from Vercel, Anthropic, Microsoft, and the open-source community that is continuously updated. Using them means agents always operate at the frontier.

CLI

npx skills find [query]        # Search by keyword
npx skills add <source>        # Install a skill
npx skills add <source> -g -y  # Install globally, skip prompts
npx skills check               # Check for updates
npx skills update              # Update all installed skills
npx skills init <name>         # Create a new skill

Top Ecosystem Sources

Kevin's Setup

Cursor/personal skills install to skills/personal/<name>/SKILL.md in this repo and load through the ~/.cursor/skills symlink. Codex skills still install to ~/.codex/skills/<name>/SKILL.md. The find-skills meta-skill is installed globally and triggers whenever a task might benefit from a specialized skill that isn't already available.

Installed from skills.sh

Installed via Cursor plugin (superpowers)

Kevin's Custom Skills (not from skills.sh)

Quality Gates (Three-Gate Chain)

Before installing any new skill, all three gates must pass:

1. Brin - curl https://api.brin.sh/skill/<owner>/<repo>. Block if suspicious or dangerous. See Brin - Agent Context Security.
2. Skill Auditor - Run the skill-auditor skill for the full 6-step vetting protocol: typosquat check, permission analysis, dependency audit, prompt injection scan, network/exfil analysis, content red flags. Must pass with verdict SAFE.
3. Reputation signals - Check install count (prefer 1K+), source reputation (vercel-labs, anthropics, microsoft preferred), GitHub stars (under 100 = skepticism), security audit badges on skills.sh (Gen Agent Trust Hub, Socket, Snyk).

Creating Skills

Always use the skill-creator skill when creating new skills. It enforces wiki integration:

1. Check the wiki for existing knowledge on the domain
2. Check skills.sh for upstream skills to adapt
3. Check installed skills for overlap
4. Create the SKILL.md with proper frontmatter and trigger descriptions
5. Update wiki/tools/skills-sh.md, wiki/SKILL-RESOLVER.md, wiki/meta/active-stack.md, and wiki/log.md
6. Rebuild the index with npx tsx scripts/build-index.ts

The skill-creator is based on anthropics/skills (134K weekly installs) with Kevin-specific wiki awareness layered on top. It also absorbs Matt Pocock's writing-great-skills and no-op pruning guidance: delete generic skill text unless removing it would change behavior in that skill's context. Source: X/@mattpocockuk, 2026-06-24

Consider publishing to skills.sh if the skill is generally useful: npx skills init <name>.

API (GA — 2026-06-05)

The skills.sh API reached general availability on 2026-06-05: programmatic access to the registry (600,000+ skills) for agents, applications, and platforms, beyond the npx skills CLI. Products can power their own agents with on-demand catalog access. Source: Vercel changelog, https://vercel.com/changelog/the-skills-sh-api-is-now-available, 2026-06-05

The GA API path is Vercel-native: authenticate with a project's Vercel OIDC token, call https://skills.sh/api/v1/skills, fetch details/security audits, and let skills.sh enforce a per-team/project rate limit of 600 requests per minute. This is useful for platforms that need registry lookup inside their own agents; Kevin's local workflow still prefers installed skills plus explicit source review before adoption. Current CLI/package snapshot checked 2026-07-04: npm skills@1.5.14, latest dist-tag 1.5.14, registry modified 2026-06-29. Source: Vercel changelog, 2026-06-05; Source: npm registry, 2026-07-04

---

Timeline

• 2026-07-04 | Source-reviewed the Vercel Developers skills.sh API GA row. Added the OIDC-authenticated API shape, 600 requests/minute team/project rate limit, and current npm skills@1.5.14 snapshot. Source: X/@vercel_dev, 2026-06-05; Source: Vercel changelog and npm registry, 2026-07-04
• 2026-07-06 | Added Vercel Agent Skills as the source-review map for all nine public vercel-labs/agent-skills folders. Local policy remains selective import into existing owners rather than blind full-bundle install. Source: GitHub vercel-labs/agent-skills, 2026-07-06
• 2026-07-01 | Deep artifact review added the Spotted in Prod workflow note: skills.sh should be used selectively with a concrete reference artifact, not as a bulk context load. Source: X/@starkience, 2026-04-08
• 2026-07-01 | Refreshed the vercel-react-best-practices skill snapshot to ~517.5K installs/activity, 28.6K repo stars, and vercel-labs/agent-skills HEAD f8a72b9603728bb92a217a879b7e62e43ad76c81. Source: skills.sh + GitHub, 2026-07-01
• 2026-06-30 | Refreshed the vercel-react-best-practices install/activity signal to ~499.9K and created Vercel React Best Practices as the canonical local page. The 2026-06-21 Vercel performance bookmark shows skills as the feedback path from production optimization work back into agent behavior. Source: skills.sh, 2026-06-30; X/@rauchg, 2026-06-21
• 2026-06-29 | Renamed the local user-facing routes for upstream ask-matt and setup-matt-pocock-skills to kevin-engineering-flow and setup-kevin-engineering-flow; source slugs remain provenance only. private page
• 2026-06-27 | Completed the mattpocock/skills engineering import with kevin-engineering-flow, setup-kevin-engineering-flow, implement, improve-codebase-architecture, and resolving-merge-conflicts; added upstream reference files to the existing local imports. Source: github.com/mattpocock/skills commit 5d78bd0903420f97c791f834201e550c765699f8
• 2026-06-27 | Added conductor as a local skill from Conductor's official agent-skill surface plus current docs. It owns Conductor workspaces, .conductor/settings*.toml, run scripts, files-to-copy behavior, MCP, harness auth, and review/merge workflows. Source: https://www.conductor.build/.well-known/agent-skills/conductor/SKILL.md; https://www.conductor.build/llms-full.txt
• 2026-06-26 | Added cleanup-terminals-browsers to Kevin's custom skills table after extending it with a process ledger for localhost/dev-server lifecycle tracking and audit. Adjacent skills.sh search results existed (finding-dev-server-url, process-cleanup), but the local skill remains canonical because it encodes Kevin's IDE/MCP protect-list, ledger, live inventory, and cache audit policy. private page
• 2026-06-26 | Reframed cleanup-terminals-browsers as a thin router for agent-hygiene.sh after Kevin pointed out deterministic cleanup belongs in scripts rather than large skill prompts. private page
• 2026-06-26 | Expanded the router with a local devclean.sh after Kevin pointed to ImL1s/devclean: safe orphan cleanup, explicit deep daemon cleanup, optimize mode, and disk mode, all dry-run by default. private page
• 2026-06-25 | Expanded the local skill-creator row to include no-op pruning / token-cost reduction for skills, sourced from Matt Pocock's thread and routed as an existing skill branch rather than a duplicate skill. Source: X/@mattpocockuk, 2026-06-24
• 2026-06-25 | Added writing-fragments, writing-beats, and writing-shape from Matt Pocock's in-progress writing skills after the upstream update tweet. npx skills find "writing fragments beats shape article" did not surface an existing skills.sh install candidate, so the local copies are source imports from GitHub. Source: X/@mattpocockuk, 2026-06-25; Source: GitHub commit 5d78bd0903420f97c791f834201e550c765699f8
• 2026-06-25 | Added loop-me from mattpocock/skills to Kevin's local installed skill set after the skills.sh search surfaced mattpocock/skills@loop-me at ~1.9K installs. Source: npx skills find "loop me", 2026-06-25
• 2026-06-25 | Promoted eight additional source-imported skills from mattpocock/skills: domain-modeling, codebase-design, diagnosing-bugs, tdd, prototype, to-prd, to-issues, and triage. Source: github.com/mattpocock/skills commit 8370e760d0251a3738e006aeacec6d1cb31dd208
• 2026-06-23 | Added no-sus-code-doctor, a custom quality gate for agent-authored PRs based on Dedalus senior review feedback: no hidden fallbacks, typed errors, explicit ownership, aligned async, empirical proof, and a score-to-100 loop. private page
• 2026-06-22 | Added service-cli-registry as a custom horizontal skill for routing SaaS/infra CLI work from the capability-harvest seed catalog. private page
• 2026-06-05 | skills.sh API generally available — 600,000+ skills exposed programmatically to agents, apps, and platforms. 404 likes, 377 bookmarks. Source: X/@vercel_dev, 2026-06-05
• 2026-04-07 | Page created — skills.sh as the open registry + package manager for agent skills; the skills-first rule and three-gate quality chain documented. Source: skills.sh, 2026-04-07