Overview
skills.sh is the directory and install hub for AI agent skills, powered by Vercel’s npx skills add CLI. The vercel-labs/skills GitHub repo reached ~25,100 stars by July 2026; find-skills leads with 2.3M installs.
Security Concerns
Snyk ToxicSkills audit (February 2026) of 3,984 registry skills: 36.8% with flaws, 13.4% critical, 76 confirmed malicious (2026-07-06-vercel-skills-snyk-toxicskills). Trail of Bits (June 2026) showed scanners can be bypassed.
Treat community skills as untrusted code. Scan before install; prefer official sources.