Agent skills marketplaces compared: where to find, vet and install SKILL.md skills
An agent skills marketplace is a catalog of SKILL.md skills you can install into Claude Code, Codex, Cursor, GitHub Copilot and other agents. For most people, skills.sh is the place to start: one command installs a skill into any of 79 agents. Inside Claude Code, use Anthropic's official marketplace. When each skill must be checked first, use Tessl or Skills Directory.
None of them makes a skill safe on its own: a skill can run scripts on your machine, so read it before you install it.
The short answer, by what you need
Install in one command, any agent
skills.sh. Vercel's open-source CLI, npx skills add owner/repo, installs into Claude Code, Codex, Cursor, Copilot and 75 other agents, and a lockfile pins what you installed.
Search the widest index
SkillsMP. About 4 million SKILL.md files from public GitHub, searchable by category and occupation. It finds; it doesn't install or check.
You work in Claude Code
Anthropic's official marketplace. It's already registered: /plugin install a name, and read the plugin's details pane first.
You work in Codex or Copilot
OpenAI's plugin directory (Plugins tab, or /plugins in Codex CLI) and awesome-copilot, which Copilot CLI and VS Code already know.
Every skill checked before you see it
Skills Directory grades each of its 767,482 skills for free. Tessl adds evals that measure whether a skill helps, plus Snyk security scores.
Paid skills from named experts
Agensi. Free and paid skills, loaded into your agent over MCP, with a money-back guarantee on paid ones.
You run OpenClaw
ClawHub, its own registry. In February 2026 researchers found 341 malicious skills among its 2,857; it now scans every version.
See which skills a team actually uses
Zest, not a marketplace. It records which skills each engineer's sessions load, free for 3 seats.
Nine sources compared, plus Zest
Read on November 13, 2026. "Size" is each source's own number: skills.sh counts skills on its install leaderboard, SkillsMP counts SKILL.md files it indexed (copies included), and the plugin marketplaces count plugins, each of which can hold several skills.
| Source | What it is | Size | Curation and security checks | How you install | Agents | Price |
|---|---|---|---|---|---|---|
| skills.sh | Open directory and CLI from Vercel Labs; skills ranked by anonymous install counts | About 1.37 million on its all-time leaderboard | Anyone's public repo can be installed and counted. An Audits page shows results from Gen Agent Trust Hub, Socket and Snyk per skill; it "cannot guarantee" any skill | npx skills add owner/repo; skills-lock.json records each skill's commit and hash | 79, including Claude Code, Codex, Cursor, Copilot, OpenCode, Gemini CLI, OpenClaw | Free; CLI is MIT-licensed |
| SkillsMP | Independent search index of SKILL.md files on public GitHub | About 4,000,000 | No review or scanning described. Results sort by the repository's GitHub stars | No installer: it links to the source repo. REST API and an MCP server for search | Any agent that reads SKILL.md | Browsing free; paid plans raise API limits |
| Anthropic's marketplaces | Plugin catalogs for Claude Code: official (claude-plugins-official), community, and anthropics/skills; skills ship inside plugins | 530 plugins on claude.com/marketplace | Official holds Anthropic's plugins plus partners'; some carry an "Anthropic verified" label. Directory submissions get a security scan on every version and a human review before a new listing goes live | /plugin install name@claude-plugins-official | Claude Code; claude.ai and Cowork through Anthropic's directory | Free; Claude Code needs a paid Claude plan (Pro from $17 a month billed annually, $20 monthly) or a Claude Console account |
| OpenAI's plugin directory | One directory shared by ChatGPT and Codex; plugins bundle skills and MCP servers | Not published | An OpenAI tab for its own plugins, plus workspace and personal marketplaces. Hooks must be reviewed and trusted before they run | Plugins tab in the ChatGPT desktop app; /plugins in Codex CLI; $skill-installer for single skills | Codex CLI, the ChatGPT desktop app and ChatGPT (plugins aren't in the Codex IDE extension) | Free to browse; needs ChatGPT or Codex access |
| awesome-copilot | GitHub's community collection of Copilot skills, agents, instructions and plugins | 463 skills | Community-contributed; the README says to inspect anything before installing. GitHub says skills "are not verified by GitHub" | copilot plugin install name@awesome-copilot; gh skill install owner/repo (preview) | GitHub Copilot CLI and VS Code | Free; needs a Copilot plan |
| ClawHub | OpenClaw's registry for skills and plugins | Not published | Open publishing with moderation. Every upload goes through ClawScan: independent scanners (NVIDIA SkillSpector and Tencent's AI-Infra-Guard) and an AI judge give a Clean, Suspicious or Malicious verdict | openclaw skills install @owner/skill | OpenClaw; the clawhub CLI manages folders outside it | Free |
| Skills Directory | Directory that grades every skill it lists | 767,482 | Automated scan of every listed skill (120 detection patterns) with a letter grade; submissions reviewed before publishing | Free through the skills CLI; a ZIP download is $4 a skill or included in Pro | Claude, Claude Code and other SKILL.md agents | Free; Pro $9 a month ($39 once at a founding price for the first 50 members) adds ZIP downloads and change alerts |
| Tessl Registry | Registry and package manager with evals | Not published | Each skill gets a best-practice quality score, eval results that measure its effect on the agent, and Snyk security findings | npx tessl i github:owner/repo --skill name | Agent-agnostic: "every popular coding agent" | Free ($0, 1,000 credits a month); Team $100 a month; Enterprise custom, with install policies |
| Agensi | Marketplace of free and paid skills | 21,000+ | Creators verified before they can sell; an 8-point security scan on every version; money-back guarantee on paid skills | Connect your agent to Agensi's MCP server; it asks before each purchase | Claude, ChatGPT, Claude Code, Cursor, Codex CLI, Copilot, Gemini CLI and more | Free skills; paid ones from $5 to $29 among those on its home page; creators keep 70% |
| Zest | Not a marketplace: AI coding analytics that shows which skills each engineer's sessions run | No catalog | Doesn't host, rank or scan skills | A plugin or extension in each agent records sessions | Reads sessions from Claude Code, Cursor, VS Code (Copilot Chat), Codex, Hermes, Grok Build, OpenCode, Freebuff | Free for 3 seats; Pro $49 a month for 5, Max $149 for 10 |
How to choose a marketplace
- Start from your agent. Each agent reads skills from its own folders: Claude Code from
.claude/skills, Codex, Cursor and Copilot from.agents/skillsamong others, OpenClaw fromskills/. An installer that knows those paths (skills.sh, Tessl, the agent's own marketplace) saves you from copying folders by hand. How to install agent skills has the paths and commands for each agent. - Decide how much checking you need. An index (SkillsMP) lists what exists. A directory with scanners (skills.sh, Skills Directory, ClawHub) flags known-bad patterns. A reviewed catalog (Anthropic's directory, Tessl's evals, Agensi's verified creators) adds a person or a test. Scans miss things: a skill's instructions can do harm without any code.
- Read the popularity signal for what it is. skills.sh ranks by installs counted by its CLI. SkillsMP sorts by the repository's stars, so every skill in a popular repo carries the same number: each OpenClaw skill showed 394,354 stars. Tessl shows measured uplift from evals, the only signal of the three that says whether a skill helps.
- Prefer pinned installs. A skill can change after you review it. skills.sh records each skill's commit and a hash of its files; Anthropic's community marketplace pins nearly every entry to a commit; Claude Code's auto-update can replace files you already read.
- Check the license and the price. SkillsMP reminds you that public on GitHub doesn't mean free to reuse. Paid skills (Agensi) and paid tiers (Skills Directory Pro, Tessl Team) buy curation, alerts or governance, not access.
What the security studies found
Two audits early in 2026 set the tone. Snyk's ToxicSkills study scanned 3,984 skills from ClawHub and skills.sh on February 5: 13.4% had at least one critical issue, 36.82% had a flaw of some kind, and people confirmed 76 malicious payloads by hand. Koi Security found 341 malicious skills among the 2,857 on ClawHub, 335 of them using fake setup steps to install Atomic Stealer, a macOS info-stealer. ClawHub, skills.sh and others have added scanners since. A scan is a filter, not a guarantee, and Anthropic's docs put it plainly: a plugin "can execute arbitrary code on your machine with your user privileges."
Before installing anything, read the SKILL.md and every file in scripts/, check who publishes it, and pin the version. The full checklist, with a worked review of a real skill, is in Are agent skills safe?
Where Zest fits, and where it doesn't
Zest is made by Winding AI, the company that publishes this site, and it isn't a skills marketplace: there's no catalog, it hosts no skills, and it doesn't vet them. Its plugins record each coding-agent session's models, tokens, skills and MCP tools, and its GitHub App links sessions to the pull requests they led to. For skills, that answers a question most marketplaces don't: of the skills a team installed, which ones do its sessions load, how often, and for whom. Tessl's Enterprise plan and Anthropic's Enterprise Analytics API (for Claude Code) report skill use too.
It fits a team on GitHub that has started installing skills and wants to see which ones stick, before standardizing on a set. Starter is free for 3 seats and includes skills, models and tokens per engineer; Pro is $49 a month for 5 seats and Max $149 for 10, with extra seats at $19.
It doesn't fit if you want to find or vet skills: use the marketplaces above. If you want a private registry, evals and install policies alongside usage, Tessl covers more of that: Team is $100 a month, and policies and analytics come with its Enterprise plan (custom price). Zest is GitHub-only, and it can't stop anyone installing a skill. Sharing skills across a team compares the options.
Zest for skills · Zest pricing
Guides
- Claude skills marketplace: official, community and paid: Anthropic's four main catalogs, what "Anthropic verified" means, and the third-party ones that install into Claude.
- SkillsMP vs skills.sh: the same search on both, and why one is for finding and the other for installing.
- ClawHub skills: what's on OpenClaw's registry, its malware history, and how it scans now.
- Are agent skills safe? A ten-point check before you install, and what each marketplace's scanner covers.
- How to install agent skills: the command and folder for each agent and each marketplace.
- Codex skills: the folders Codex reads,
$skill-installer, the plugin directory and how to switch a skill off. - Cursor skills: where Cursor finds skills and which marketplaces install into it.
- GitHub Copilot skills: awesome-copilot,
gh skilland VS Code's marketplace. - Awesome agent skills lists: which GitHub lists are kept up to date, and lists vs marketplaces.
- Sharing skills across a team: repo folders, private marketplaces, Tessl and Zest, with costs.
Questions
Is there an official agent skills marketplace?
Not one for every agent. Each agent maker runs its own: Anthropic's official plugin marketplace is built into Claude Code (530 plugins on claude.com/marketplace on November 13, 2026), OpenAI has one plugin directory for Codex and ChatGPT, and GitHub pre-registers the community awesome-copilot marketplace in Copilot. skills.sh, run by Vercel Labs, is the closest thing to a cross-agent catalog: its CLI installs into 79 agents.
Are agent skills marketplaces free?
Browsing and installing are free on all nine sources here. The costs are elsewhere: the agent itself (Claude Code needs a paid Claude plan, from Pro at $17 a month billed annually, or a Claude Console account), paid skills on Agensi, paid API allowances on SkillsMP, Skills Directory ($4 a skill or Pro at $9 a month) for ZIP downloads and change alerts, and Tessl (Team $100 a month; install policies on Enterprise) for teams.
Are agent skills safe to install?
Not by default. A skill can carry scripts that run with your user permissions, and its instructions can steer the agent. In February 2026 Snyk scanned 3,984 skills from ClawHub and skills.sh and found at least one security flaw in 36.82% of them; Koi Security found 341 malicious skills among 2,857 on ClawHub. Read the SKILL.md and every script before installing; the full checklist is in Are agent skills safe?
Do skills from one marketplace work in other agents?
Usually. A skill is a folder with a SKILL.md file in the open Agent Skills format, which Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenClaw and others read. What differs is the folder each agent reads (.claude/skills, .agents/skills, .cursor/skills, .github/skills) and any tools a skill assumes, such as an OpenClaw command or a Claude-only frontmatter field.
Can you make money selling agent skills?
Some people do. Agensi sells skills priced from $5 to $29 among those on its home page and pays creators 70% of each sale, and MCP Market has a Sell Skills program. Most skills, including Anthropic's, OpenAI's and Vercel's, are free and open source, so a paid skill has to do something a free one doesn't.
What is the difference between a skill and an MCP server?
A skill is instructions (plus optional scripts) that the agent loads when a task matches its description. An MCP server is a running service that gives the agent new tools, such as access to GitHub or a database. Use a skill to teach a procedure and an MCP server to reach a system; plugins in Claude Code, Codex and Cursor often bundle both.
Does Smithery list agent skills?
Not today. Smithery is a directory of MCP servers, now part of Arcade, and its /skills page returned a 404 on November 13, 2026. For skills, use one of the nine sources above.
About this site
agentskillsmarketplace.dev is published by Winding AI, Inc., the company that makes Zest, which is listed in the table after the nine sources and isn't a marketplace. Winding AI makes money when teams pay for Zest. None of the other companies paid to be listed, and there are no affiliate links. Visits are counted with Google Analytics; there are no ads, and no analytics cookies in the EU, the UK or Switzerland.
We picked the sources from what Google showed for "agent skills marketplace" and related searches on November 13, 2026, its AI answer included, plus each agent maker's own catalog. Every size, feature and price was read that day on the source's own site, docs or GitHub repository, and the page links each source so you can check it. We give no ratings or scores and invent no reviews. If something is out of date, write to support@winding.ai.