Every coding agent is a generalist. It knows a lot about everything, and nothing about how you want a specific job done: how your team writes commits, how to drive a browser to test a form, which Turborepo config keys are current. You can explain it every session, or you can install a skill once.
skills.sh is the biggest public directory of them, and it's worth knowing about.
What a skill is
A skill is just a folder with a SKILL.md file in it, plus optional scripts/, references/ and assets/. The file starts with two required fields:
---
name: release-notes
description: Write release notes from merged PRs. Use when the user asks for a changelog or release notes.
---
# Release notes
1. List PRs merged since the last tag with `gh pr list --state merged --search "merged:>…"`.
2. Group them into Features, Fixes and Internal.
…The format is an open standard, Agent Skills, "originally developed by Anthropic, released as an open standard." That's why one skill works across tools: the spec's client list includes Claude Code, Codex, Cursor, GitHub Copilot, VS Code, Gemini CLI, OpenCode, Goose, Kiro and dozens more.
The clever part is progressive disclosure. At startup an agent reads only each skill's name and description. It loads the full instructions only when a task matches, and any bundled files only when the instructions call for them. So installed skills cost almost nothing until they're needed.
What skills.sh is
skills.sh calls itself "The Agent Skills Directory," and it's made by Vercel. Two things make it useful:
- A leaderboard built from real usage. Rankings come from anonymous telemetry when people run the
skillsCLI, so popular skills rise on their own. There's no manual submission: a skill appears once people install it. - Ways to browse. An Official section collects skills published by the companies that build the technology (Anthropic, OpenAI, Microsoft, AWS, GitHub, Cloudflare, Stripe and others). The topics page groups curated skills by domain.
| Topic | What's in it |
|---|---|
| Frontend & React | Component and React patterns |
| Next.js | App Router, data fetching, deployment |
| Design & UI | Interface and visual design |
| Mobile | Native and cross-platform apps |
| Agent workflows | Planning, review and multi-step agent habits |
| Databases | Schemas, queries and migrations |
| Testing | "TDD loops, Playwright automation, and verification passes" |
| Marketing | Copy, SEO and campaigns |
At the time of writing, the most-installed skills were find-skills (a skill for finding other skills), Matt Pocock's grill-me, and Vercel's agent-browser, each with over a million installs.
Installing one
You need Node.js 22.20 or later. Everything goes through one CLI:
# Pick skills from a repo interactively
npx skills add vercel-labs/agent-skills
# See what a repo contains first
npx skills add vercel-labs/agent-skills --list
# One skill, globally, for one agent, no prompts
npx skills add vercel-labs/agent-skills --skill frontend-design -g -a claude-code -ynpx skills find typescript
npx skills listnpx skills check
npx skills update
npx skills remove <name>npx skills init my-skillBy default skills install into the current project (for example .claude/skills/ for Claude Code, .agents/skills/ for Codex and Cursor), and -g installs them for your user. A source can be a GitHub owner/repo, a full Git URL, a local folder, or even a direct link to a SKILL.md.
Pick carefully: a skill is code you run
A skill is instructions your agent will follow, and often scripts it will execute. Treat installing one like adding a dependency.
skills.sh helps here. It shows combined security audits from Gen Agent Trust Hub, Socket and Snyk on every skill page, and the CLI shows the same table while installing. But the site is also clear that it "cannot guarantee the quality or security of every skill listed."
A good example of what a warning looks like: agent-browser passes two audits but has a Snyk warning for "third-party content exposure (indirect prompt injection risk)". That's not a bug in the skill. It's honest: a skill that reads arbitrary web pages can be fed instructions by those pages. Knowing that, you'd point it at your own app, not at random sites.
My checklist before installing:
- Prefer official skills from the people who make the tool.
- Read the
SKILL.mdand any scripts. It takes two minutes. - Check the audits and what any warning actually means.
- Install per project, not globally, until you trust it.
- Keep the set small. Descriptions are cheap but not free, and overlapping skills confuse the agent about which one to use.
A few worth starting with
Lets your agent search skills.sh for a skill that fits the task in front of it.
Drive a real browser to test features before they ship.
Official Turborepo skill that reads the docs bundled with your installed version.
More on those last two: testing with agent-browser and Turborepo vs monorepo.
Or write your own
The best skill is often the one you write for your own project: how to run your tests, your deploy steps, the mistakes your agent keeps making. Run npx skills init, write the steps you'd tell a new teammate, and keep it short. If you find yourself explaining the same thing to an agent twice, that's a skill.