State of agent skills 2026

An agent skill is a folder with a SKILL.md file in it: a name, a one-line description, and instructions an agent follows when the task matches, plus any scripts or reference files it needs. Anthropic introduced them on 16 October 2025 as "folders that include instructions, scripts, and resources that Claude can load when needed". The trick is progressive disclosure, which Anthropic's engineers call the core design principle: only the name and description sit in the agent's context, and the rest loads when the skill is used. That makes a skill cheap to install and easy to write. It's Markdown, not a protocol.

A year later skills are an open standard read by almost every coding agent, a registry with more than a million entries, a distribution channel for developer-tool companies, and a new software supply chain with the problems that come with one. This post puts the year's data together. One caveat runs through all of it: almost every number comes from someone with a stake. Vercel runs the biggest registry and counts its installs, the security figures come mostly from companies that sell scanning, and Anthropic and OpenAI sell the agents. We name the source and what it sells next to each figure, and we lean on the academic studies where we can.

The standard and who adopted it#

Skills shipped on 16 October 2025 across the Claude apps, the API and Claude Code, whose 2.0.20 changelog reads "Added support for Claude Skills". The format was simple enough to copy, and others did before anyone asked them to. A Codex feature request for SKILL.md support opened four days after launch, Codex CLI merged experimental support in early December, and Simon Willison found a /home/oai/skills folder inside ChatGPT's Code Interpreter on 12 December.

On 18 December Anthropic published Agent Skills as an open standard at agentskills.io. GitHub shipped skills in Copilot the same day, with a line that explains how the standard spread: "If you've already set up skills for Claude Code in the .claude/skills directory… Copilot will pick them up automatically." Amp says it reads .claude/skills "for compatibility with existing skills", and Goose's v1.16.0 lists "claude compatibility". Reading the folder a user already had was the cheapest way to support skills, so nearly everyone did.

The spec itself is small. agentskills.io requires two fields, a name of up to 64 characters and a description of up to 1,024, and it suggests a budget: about 100 tokens of metadata loaded at startup, under 5,000 tokens of instructions loaded when the skill is activated, and a SKILL.md under 500 lines. Everything else (scripts, references, assets) loads only when needed.

The governance is less settled. On 9 December 2025 MCP and AGENTS.md went to the Linux Foundation's new Agentic AI Foundation, but Agent Skills is not on its project list. The spec repository's contributing guide still says "Logo requests are reviewed by the Anthropic team", and Anthropic reviews the showcase listings. Even Agent Plugins 1.0, the packaging spec built on top of skills, says it "is not an AAIF project".

How big the ecosystem got#

Vercel launched skills.sh and the npx skills CLI on 20 January 2026, and it became the default registry. On 25 September Vercel said that "in seven months, the skills.sh registry grew to one million agent skills and recorded nearly 280 million installs". Those are Vercel's numbers about its own registry, counted by its own telemetry, and Vercel says the installs "do not represent unique people or necessarily independent choices."

The registry's live counter is not a clean growth line. It sat around 91,000 from late March to mid-May, jumped to 609,966 by 31 May (more likely a change in what's indexed than a publishing boom), and read 1,548,375 in a 2 October Wayback snapshot. Nobody has explained the jump. The safe statement is that Vercel reported one million skills on 25 September.

Installs of the most popular skill tell a steadier story. find-skills is Vercel's own skill: it searches the registry and installs other skills, so it sits at the front door of everything else.

Vercel's concentration numbers are the most useful thing in its report. "375 skills, or 0.04% of the registry, account for 62% of installs, and the top 1.2% account for 94% of installs", and "nearly half of all skills were installed exactly once." A registry of a million skills is, in practice, a few hundred skills people use and a long tail of experiments, forks and copies.

Outside skills.sh the count is bigger, and it measures something else. SkillsMP, which crawls public GitHub for SKILL.md files, counted more than 3.3 million in early October. That includes forks and vendored copies, so it counts files rather than distinct skills, but it shows how fast the format spread into repositories.

The CLI's download count is the third measure, and the noisiest. The skills package on npm was downloaded about 24.7 million times in the 30 days to early October, and about 168 million times in 2026, per the npm API. Every npx skills run counts as a download, and the find-skills skill tells agents to run the CLI themselves, so these are CLI runs, not users.

What people install#

The top of the leaderboard belongs to one skill that installs the others and one author's collection. Seven of the ten most-installed skills on skills.sh come from Matt Pocock's mattpocock/skills.

Install counts are easy to inflate. Just below the top ten, a reddit-automation skill from a repository created on 12 August, with about a dozen GitHub stars, had 812,125 installs and sat at #14. More than 21 Lark skills from open.feishu.cn each show about 745,000 installs, which looks like one bundle install counted many times. That's the same counter the trojanized skills below used to look popular.

GitHub stars are a different signal, harder to fake at scale and slower to move. Two individuals' repositories lead every vendor's: obra/superpowers, Jesse Vincent's skills framework, had 295,951 stars in early October, which makes it the 12th most-starred repository on GitHub, and Matt Pocock's collection had 277,896, eight months after it was created.

The vendors' collections matter more than their star counts suggest, because they're how a company teaches agents to use its product. skills.sh's official makers page lists 1,164 skills from NVIDIA, 605 from Anthropic and 582 from Microsoft. Google's repository launched at Cloud Next on 22 April "starting off with thirteen skills".

Skills vs MCP#

Skills arrived a year after the Model Context Protocol, and the first argument was whether they replace it. The case for skills is context cost. Anthropic's docs put a skill's always-loaded cost at "~100 tokens per Skill", with its instructions loading only when it's triggered. An MCP server, by default, loads the full schema of every tool up front. Anthropic's advanced tool use post from November 2025 measured how much that costs.

The MCP side answered by borrowing the idea. Anthropic's Tool Search defers tool definitions until they're needed, which it says gives "an 85% reduction" in tokens. Its code execution with MCP pattern goes further: in Anthropic's worked example, presenting MCP tools as code the agent reads on demand "reduces the token usage from 150,000 tokens to 2,000 tokens", a 98.7% saving. In August the protocol's maintainers put the same idea on the MCP roadmap.

Skills have a budget too. Claude Code's docs say its skill listing is capped at 1% of the model's context window, with each entry cut at 1,536 characters, and when the listing overflows it drops descriptions, starting with the skills used least. Install enough skills and you get the MCP problem back, in a smaller form.

MCP isn't shrinking. Its maintainers reported "close to half-a-billion downloads a month" across the main SDKs in July, and the official MCP Registry held about 40,100 server names when we crawled it in early October. That's names, not working servers, and about 15% come from four bulk publishers.

The natural split is that the skill says how to do something well and the MCP server reaches live account data and takes actions. Supabase, which ships both, measured what the pair is worth.

Nobody has published a skill-only arm on the same tasks, so "skill vs MCP" is still unmeasured. "Skill plus MCP vs MCP" is, and the pair wins.

Do skills work#

The best first-party usage number comes from OpenAI, which has an obvious interest in it. Its researchers' paper on Codex reports that "the share of active Codex users invoking any skill rose from 5.4% on March 1, 2026 to 26.6% on June 11, 2026", and that "within OpenAI, skill use is nearly universal: 96.2%". Anthropic hasn't published a comparable number for Claude, and no 2026 developer survey we found asks about skills.

Whether they make agents better is a different question, and the academic answer is "the good ones do". SkillsBench found in February that curated skills "raise average pass rate by 16.2 percentage points", from +4.5 points in software engineering to +51.9 in healthcare, with 16 of 84 tasks getting worse. Skills the model wrote for itself "provide no benefit on average" (−1.3 points). The current version, from June, reports 33.9% → 50.5% with curated skills across 87 tasks and 18 configurations, and finds focused skills beat big bundles. SWE-Skills-Bench is gloomier for coding: "39 of 49 skills yield zero pass-rate improvement, and the average gain is only +1.2%".

The bigger practical problem is that a skill only helps if the agent loads it. Vercel tested this on Next.js 16 tasks in January and found that "in 56% of eval cases, the skill was never invoked".

Anthropic says the same about its own model. Its skill-creator skill warns that "Claude has a tendency to 'undertrigger' skills -- to not use them when they'd be useful", and ships a tool to rewrite descriptions so they match more requests. The description field, 1,024 characters at most, is what decides whether a skill does anything at all.

Security#

A skill is instructions an agent follows plus, often, scripts it runs with the user's permissions. Anthropic's launch engineering post warned that malicious skills may "direct Claude to exfiltrate data and take unintended actions", and its docs still say to "use Skills only from trusted sources". A year of research shows why.

The academic baseline is Liu et al., who collected 42,447 skills from two marketplaces in December 2025 and analyzed 31,132. They found that "26.1% of skills contain at least one vulnerability", data exfiltration in 13.3% and privilege escalation in 11.8%, and that skills bundling scripts were 2.12 times likelier to be vulnerable. Most of those are flaws rather than attacks; the paper put 5.2% at "high-severity patterns strongly suggesting malicious intent". The attacks are what grew in 2026.

The first big campaign hit ClawHub, the registry for the OpenClaw agent. In February The Hacker News reported that Koi Security audited all 2,857 skills on it and found 341 malicious, 335 of them from one campaign whose fake "prerequisite" step installed the Atomic macOS Stealer. Antiy CERT later counted 1,184 malicious packages in ClawHub's history, from 12 author IDs. Snyk, which sells scanning and audits skills.sh, sampled 3,984 skills across ClawHub and skills.sh: 1,467 (36.82%) had at least one flaw, 534 (13.4%) a critical one, and 76 carried malicious payloads, 8 of them still live when it published.

The mainstream registry was hit in July. Zenity Labs, which sells agent security, found a family of look-alike skills imitating Paperclip and Browser Use that were "trojanized on July 11" after being listed clean. By 2 August they had more than 1.7 million aggregate installs on skills.sh. Zenity notes that "these counters are not user-unique", and Vercel and GitHub removed the skills within 12 hours of its outreach.

The attack doesn't need a script. Skill-Inject, an academic benchmark of 202 injection-task pairs, found "up to 80% attack success rate with frontier models" from instructions hidden in skill files. The registries' response has mostly been scanning, which helps with known payloads and not with a well-written instruction.

Anthropic's scanning, per its Help Center, only covers skills added after it's turned on; skills already in an organization aren't scanned.

Skills as distribution#

For developer-tool companies, skills became a way to reach customers through their agents. When we probed in early October, more than 20 vendor domains served a skill index at /.well-known/agent-skills/index.json or the older /.well-known/skills/ path, the convention proposed in a Cloudflare RFC whose current version adds a sha256 digest for every file. An agent can find a company's skills from its domain alone.

Documentation hosts made it the default. Mintlify put a skill file at /.well-known/skills/default/skill.md on every docs site it hosts in January. The traffic followed: Mintlify, which sells docs hosting, says agents went from 20.8% of traffic to its docs in February to 66% in August, when it counted 257 million agent requests against 131 million human page loads, and that 83% of agent traffic came through Markdown pages, /llms.txt or agent skills.

The other channels are the install command and the marketplace. A GitHub code search in early October found about 41,600 README files containing npx skills add (an estimate; code search counts copies). Anthropic's Claude Marketplace opened on 23 September with "more than 2,000" connectors and plugins built on "MCP and Agent Skills". We found no paid first-party skill store at Anthropic, OpenAI or GitHub: Anthropic told VentureBeat in December that "there are no revenue-sharing arrangements at this time", and skills are included in paid Claude plans at no extra cost.

What this means if you build with AI#

Skills are the cheapest way to teach an agent how you work and how a product is meant to be used. The data points to a few habits.

1. Read a skill before you install it. It's a Markdown file and maybe a script; read both. A skill runs with your agent's permissions, and the install counter told 1.7 million installers that a trojanized family was popular.
2. Prefer official and vendor skills. Install from the company that makes the product, its GitHub organization or its own domain's /.well-known/ index, or write your own. Anthropic's own advice is to use skills you created yourself or got from Anthropic.
3. Don't treat a scan as a clean bill of health. Registry scanners can be beaten in under an hour. A pass means no known payload was found, not that the instructions are safe.
4. Write descriptions that trigger. The description is the only part the agent sees until it decides to use the skill. Say what it does and when to use it, using the words people will type. Agents undertrigger skills, so test whether yours fires.
5. Keep a docs index in AGENTS.md for what must always apply. In Vercel's evals an always-loaded 8KB index beat a skill the agent skipped. Use a skill for the occasional procedure and AGENTS.md for the rules of the repo.
6. Curate, don't generate. Self-written skills gave no benefit on average in SkillsBench. A skill that captures what you actually learned beats one the model wrote from what it already knew.
7. Keep skills small and few. Focused skills beat big bundles in SkillsBench, and Claude Code drops descriptions once the listing passes 1% of context. Uninstall what you don't use.
8. Use a skill with MCP, not instead of it. The skill carries the how and the MCP server the live data. In Supabase's eval the pair beat MCP alone every time.
9. If you build a developer tool, ship it as a skill. Put a SKILL.md in a public repo, serve an index from your domain's /.well-known/agent-skills/, and give people an npx skills add line. Agents are already the main readers of many docs sites.

host0 ships its deploy as a skill: an agent reads host0.ai/skill.md, runs publish.sh on a folder or file, and gets back a URL to share.

Methodology#

This post is built on a data pack we compiled in early October 2026. Five research agents worked in parallel, one per angle: the standard and its adoption timeline, ecosystem size and distribution, security, skills vs MCP, and skills in practice. We then spot-checked about 30 of the numbers the post leans on: we fetched each primary page live and pulled the exact sentence, and re-queried live sources (the GitHub and npm APIs, the skills.sh leaderboard, SkillsMP, the MCP Registry, Wayback snapshots and vendors' /.well-known/ indexes). Each claim carries a tier: verified against the primary source that day, confirmed by two or more independent outlets when the primary was gone, or single-sourced. Before publishing we re-opened every single-sourced page we cite and dropped anything it no longer said.

We left out several claims that circulate widely:

• "Snyk found 1,467 malicious skills." Snyk's 1,467 is skills with any flaw; 76 were malicious.
• "1.7 million people installed malware." Zenity says the counters aren't user-unique.
• An Anthropic skills marketplace with a 15% revenue share in May 2026. We found no Anthropic source; the real launch is the Claude Marketplace in September.
• Higher recounts of the ClawHub campaign, found only on aggregators.
• Any single skills.sh counter value as a growth rate, or npm downloads as users.
• A precise count of SKILL.md files on GitHub. Code-search totals are estimates and include copies.
• Details we couldn't re-confirm on the source page: the exact totals on skills.sh's official makers page and the date the Claude API took skills out of beta.

Limitations:

• Conflicts of interest run through almost everything. Vercel runs skills.sh, maintains the CLI, publishes the most-installed skill and counts the installs. Snyk, Socket, Gen, Zenity, Koi (now part of Palo Alto Networks), Antiy, Trail of Bits and AIR sell scanning, vetting or audits. Anthropic created the standard and sells Claude; OpenAI's researchers wrote the Codex paper about their own product; Supabase and Mintlify benefit from skills looking useful. Only Liu et al., SkillsBench, SWE-Skills-Bench and Skill-Inject have no product attached.
• Installs and downloads aren't people. Both are anonymous CLI telemetry, inflated by bundles and by agents running the CLI themselves.
• Denominators differ. The security studies sample different registries at different times; ClawHub figures describe one loosely moderated registry, not the ecosystem.
• Everything moves. Stars, installs and registry counts change by the hour; we give the date we read each one.

Open questions#

The public data leaves gaps:

1. What happened to the skills.sh counter? It jumped from about 91,000 to 609,966 in May, and Vercel hasn't said why.
2. How big is the top skill, really? Vercel says even the most-installed skill is "less than 1%" of installs, but 3.7 million find-skills installs is about 1.3% of 280 million.
3. How many people use skills? No registry publishes unique installers, and Anthropic has published no adoption number for Claude. OpenAI's Codex paper is the only first-party figure with a denominator.
4. Does a skill alone beat MCP alone? Supabase compared MCP with MCP plus a skill; nobody has a skill-only arm on the same tasks.
5. How much of skills.sh is flagged? Its three audit partners scan every skill, but there's no public total.
6. Who will govern the standard? MCP and AGENTS.md went to a foundation; Agent Skills is still run by Anthropic.
7. Will the spec adopt signing? NVIDIA signs its skills and the discovery RFC adds digests, but the spec has no security section.

We plan to come back to several of these with data of our own.