Agent skills marketplaces › SkillsMP vs skills.sh

SkillsMP vs skills.sh: one finds skills, the other installs them

Use skills.sh to install: its CLI puts a skill into any of 79 agents in one command, pins the version, and shows three scanners' results for each skill. Use SkillsMP to search: it indexes about 4 million SKILL.md files from public GitHub, filtered by category and occupation, but it doesn't install, review or scan anything. Searching on SkillsMP and installing with skills.sh is a reasonable split.

Both sites, their docs and the skills CLI (version 1.8.1) were read and run on November 13, 2026. SkillsMP's web pages sat behind a Cloudflare check, so its facts come from its published llms.txt, pricing.md and free API.

Side by side

The same search on both

Both were searched for "playwright" on November 13, 2026: skills.sh with npx skills find playwright, SkillsMP through its free API, sorted by stars, its default.

Three things show up. First, SkillsMP's star count belongs to the repository, not the skill: every skill inside OpenClaw's repo shows OpenClaw's 394,354 stars, and one end-to-end testing skill took seven of the first ten places because the same file sits in seven folders of one repo. Microsoft's own Playwright skill wasn't in SkillsMP's first ten. Second, skills.sh orders results by relevance and prints installs beside each, so the vendor's skill came first, and it's an install count, which says people tried it, not that it works. Third, neither tells you whether a skill is safe; that takes reading it.

SkillsMP's web search may rank differently from its API; its site was behind a Cloudflare check on November 13.

How each handles risky skills

skills.sh's Audits page lists three scanners side by side, and they don't always agree. On November 13, the seventh most-installed skill on the leaderboard, with 1.4 million installs, showed Safe on Gen Agent Trust Hub, 0 alerts on Socket and High Risk on Snyk. That disagreement is useful: it tells you where to read closely. The page also says the audits are routine and that skills.sh can't guarantee any skill.

SkillsMP doesn't scan. It points you to the source and reminds you that a public repository isn't permission to reuse it. That's honest for an index, but it puts the whole check on you. Both catalogs were in the corpus of Snyk's February 2026 audit (3,984 skills from ClawHub and skills.sh), which found at least one security flaw in 36.82% of them. The ten-point check is in Are agent skills safe?

Which to use

• You know roughly what you want: npx skills find <topic>, read the top result's SKILL.md on GitHub, then npx skills add. Commit skills-lock.json so the team gets the same version.
• You're exploring a field, such as skills for accountants or data engineers: SkillsMP's occupation and category pages cover far more ground. Ignore the star counts.
• An agent should search for skills itself: skills.sh's find-skills skill (its most installed, 4.3 million) or SkillsMP's MCP server.
• You need each skill checked first: neither alone. Skills Directory grades every listing, and Tessl measures whether a skill helps. Curated GitHub lists are another route; see Awesome agent skills lists.

After a few weeks, the useful question flips from "what can I install" to "what do I actually use". Zest, made by the company that publishes this site, counts which skills each engineer's sessions load; it's analytics, not a marketplace, and it's free for 3 seats. See how Zest shows skill use.

Back to all nine agent skills marketplaces compared.