Are agent skills safe?
A skill is instructions plus, often, scripts that your agent runs with your permissions. In 2026 public skill registries were hit by malware campaigns, so treat a skill like any code you download.
What happened in 2026
- ClawHavoc (ClawHub, reported February 2026): hundreds of malicious skills posing as crypto tools or "required prerequisites" delivered infostealers and backdoors. Reports: Antiy, Unit 42.
- ToxicSkills (Snyk): of 3,984 skills from ClawHub and skills.sh, 13.4% had a critical issue and 76 were confirmed malicious, often combining malware with hidden prompt injection.
Checklist before installing a skill
- Open
SKILL.mdand every file inscripts/. If you can't read it, don't run it. - Red flags:
curl … | sh, "download this prerequisite", base64 blobs, invisible Unicode, skills that install other skills, crypto wallets. - Huge install counts with almost no GitHub stars, or a clone of a famous name under a different owner.
- Check the license if you use it at work: no license means all rights reserved.
- Run long, unattended sessions in a sandbox or container.
How we review security
For every skill we list we record facts, not impressions: what it sends where, what it can run, which credentials or browser data it touches, what it installs, and what we could not see. The status follows from those facts by a fixed rule, so the same behavior always gets the same label.
| Status | What it means | Skills |
|---|---|---|
| No issues found | We had every file in scope, read every script, and found nothing beyond what the skill describes. | 39 |
| Review before installing | Nothing alarming, but something you should know: network calls, an API key, telemetry you can turn off, a curl | sh installer, or parts we could not review (large packs, external CLIs). The page lists the reasons. | 179 |
| Broad access | It asks for more access than most skills or sends data to another service: sharing your keys with a third party, using your browser session, loading instructions from a server, pre-approving shell commands. Usually a design choice rather than bad intent, but worth a conscious decision. | 72 |
We also run every skill through NVIDIA SkillSpector in static mode. Pattern scanners are noisy: they flag git push or rm -rf even when the text only explains them, so we use the hits as leads, not verdicts. Skills that look malicious are not listed at all. Our result is a review, not a certification. Full methodology.
Skills with broad access
| Skill | Verdict | Installs |
|---|---|---|
 last30days mvanhorn/last30days-skill Research skill that searches Reddit, X, YouTube, Hacker News, Polymarket and more for the last 30 days, scores results by engagement, and writes a cited brief. | Recommended | — |
 Azure Skills Plugin microsoft/azure-skills Microsoft's official plugin: 94 Azure skills plus the Azure MCP Server (200+ tools) and Foundry MCP for preparing, deploying, diagnosing and costing Azure workloads. | Recommended | 14M |
 Planning with Files OthmanAdi/planning-with-files Keeps task_plan.md, findings.md and progress.md on disk and re-injects them via hooks, so a plan survives /clear, compaction and crashes. | Recommended | — |
 Compound Engineering EveryInc/compound-engineering-plugin Every's plugin of 36 skills for a brainstorm, plan, build, review and capture-the-learning loop, with an optional hands-off /lfg pipeline. | Recommended | — |
 drawio-skill Agents365-ai/drawio-skill Skill that turns natural language, Terraform, SQL, OpenAPI and other sources into editable draw.io diagrams, with incremental sync, drift detection and CI tests. | Recommended | — |
 Trail of Bits Skills trailofbits/skills Trail of Bits' marketplace of 97 security skills: smart-contract scanners, C/C++ and Rust review, Semgrep and CodeQL workflows, variant analysis and audit helpers. | Recommended | — |
 scroll-craft nateherkai/scroll-craft Builds distinctive scroll-driven landing pages: eight mutually exclusive page grammars, a required bespoke signature move, and a fingerprint gate against repeats. | Recommended | — |
 delegate-skills amElnagdy/delegate-skills Twenty skills that hand a coding task to another agent CLI (Codex, Cursor, Aider, Claude and many more) in the background, then leave the diff review and commit to you. | Recommended | — |
 ToolUniverse mims-harvard/ToolUniverse Harvard MIMS lab's Python SDK, MCP server and 556 skills that give agents access to thousands of scientific databases and tools for biomedical research. | Recommended | — |
 Vercel Agent Skills vercel-labs/agent-skills Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit. | Recommended | 3.0M |
 hyperframes-registry skill in heygen-com/hyperframes A HyperFrames skill for searching and installing about 450 ready-made blocks and components (transitions, titles, captions, charts, camera moves) as editable source. | Recommended | 1.1M |
 Google Agent Skills google/skills Google's official collection of about 180 skills for Google Cloud, Gemini APIs, Analytics, Data Manager, sign-in and other Google products. | Recommended | — |
 Stitch Skills (Google Labs) google-labs-code/stitch-skills Google Labs' 16 skills for the Stitch design tool: generate screens, extract design systems, and convert Stitch designs to React, React Native and more. | Recommended | 65K |
 Expo Skills expo/skills Expo's official skills for Expo and React Native apps: Router, animation, EAS builds, updates and store releases, plus module migration. | Recommended | 71K |
 Playwright Skill lackeyjb/playwright-skill A skill that lets an agent write and run its own Playwright scripts for testing, screenshots, login flows and arbitrary browser automation. | Recommended | — |
 wayfinder skill in mattpocock/skills Plans an effort too big for one session as a map of decision tickets on your issue tracker, resolved one at a time until the route is clear. | Recommended | 739K |
 UI Skills ibelick/ui-skills Nine skills for design engineers: a UI baseline checklist, accessibility/metadata/motion fixers, a design.md generator, and canvas builders for components. | Recommended | — |
 Nx AI Agent Skills nrwl/nx-ai-agents-config Official skills, subagents and commands from the Nx team for working in Nx monorepos, including Nx Cloud CI monitoring and self-healing fixes. | Recommended | 80K |
| HyperFrames heygen-com/hyperframes HeyGen's framework and skills for writing HTML and rendering it to deterministic MP4 video, with a CLI, a block registry and media tooling. | With caveats | 16M |
 Impeccable pbakaus/impeccable A design skill with 24 commands (polish, bolder, critique, audit, harden and more), a 62-rule deterministic slop detector and an optional edit hook. | With caveats | 1.5M |
| impeccable skill in pbakaus/impeccable The main Impeccable design skill: a command vocabulary (critique, audit, polish, bolder and more) with PRODUCT.md and DESIGN.md context files. | With caveats | 369K |
 Paperclip paperclipai/paperclip A self-hosted app for orchestrating teams of AI agents with org charts, budgets and approvals; its skills are mostly maintainer workflows. | With caveats | — |
| Microsoft Foundry (Azure Skills) skill in microsoft/azure-skills Microsoft's skill for building, deploying, evaluating, fine-tuning and troubleshooting Foundry agents and models, routed through a dozen sub-skills. | With caveats | 582K |
 Scientific Agent Skills K-Dense-AI/scientific-agent-skills K-Dense's library of 177 science skills covering bioinformatics, chemistry, clinical research, data analysis, lab tooling and scientific writing. | With caveats | — |
 Neon Agent Skills neondatabase/agent-skills Neon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals. | With caveats | 533K |
 NanoClaw nanocoai/nanoclaw A small self-hosted assistant that runs Claude agents in Docker containers and connects to chat apps, extended by about 35 Claude Code setup skills. | With caveats | — |
 baoyu-skills JimLiu/baoyu-skills Twenty-two skills from Baoyu for content work: illustrated articles, comics, infographics, translation, URL-to-markdown and posting drafts to WeChat, Weibo and X. | With caveats | — |
 Distilly titanwings/distilly Skill that distills a person's messages, documents and public material into a reusable Person Profile packaged as an agent skill. | With caveats | — |
| neon (Neon Agent Skills) skill in neondatabase/agent-skills Neon's entry-point skill: explains Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime, and sets up the CLI and MCP server. | With caveats | 243K |
 ARIS (Auto-Research-In-Sleep) wanshuiyin/Auto-claude-code-research-in-sleep A large markdown skill set for autonomous ML research: idea discovery, experiment runs and cross-model review loops where a second model critiques the first. | With caveats | — |
 memU NevaMind-AI/memU Memory layer that mines agent session logs into a shared markdown wiki and re-injects it across Codex, Claude Code, Cursor and others, locally or via memU Cloud. | With caveats | — |
 AI Research Skills (Orchestra) Orchestra-Research/AI-Research-SKILLs 98 skills for AI research and ML engineering, plus an autoresearch orchestrator that runs a two-loop experiment and synthesis cycle. | With caveats | — |
 Oh Story zenstory-ai/oh-story-claudecode 13 skills for writing Chinese web novels: ranking scans, teardown of hit books, long and short drafting with file-based continuity tracking, de-AI editing and covers. | With caveats | — |
 squirrelscan Skills squirrelscan/skills Two skills and plugins for squirrelscan's website audit CLI: run 300+ SEO, security and accessibility rules, then fix the findings in code and re-audit. | With caveats | 74K |
 ModLens liustack/modlens Gives text-only models (DeepSeek, GLM) the ability to read pasted images, converting them to structured JSON (OCR, layout, semantics) via ten vision backends. | With caveats | — |
 ctf-skills ljagiello/ctf-skills Twelve technique-reference skills for solving capture-the-flag challenges: web, pwn, crypto, reverse engineering, forensics, OSINT, malware analysis and AI/ML. | With caveats | — |
 Babysitter a5c-ai/babysitter An npm-installed orchestration runtime that makes coding agents follow workflows defined in JS code, with quality gates, approval breakpoints and a run journal. | With caveats | — |
 daymade Claude Code Skills daymade/claude-code-skills A marketplace of about 120 skills from one author: skill-creator fork, audio and transcription tools, Claude Code and Codex ops, research, QA and more. | With caveats | — |
 Sleuth povvo/sleuth A 6-phase, 56-task OSINT workflow with a Python task runner, source grading, hypothesis analysis, templates and about 15 scripts. | With caveats | — |
 Caveman JuliusBrussee/caveman A token-saving pack that makes agents answer in terse "caveman" prose, plus an optional CLI with output trimming, model routing and usage telemetry. | With caveats | 4.4M |
 ECC (Everything Claude Code) affaan-m/ECC A very large Claude Code harness: 311 skills, 71 agents, commands, hooks, memory, rules and a scanner, with adapters for Codex, Cursor and others. | With caveats | — |
| hyperframes-cli skill in heygen-com/hyperframes A command guide for the HyperFrames CLI: scaffold, check, snapshot, edit the timeline, preview, render locally or in the cloud, and recover from failures. | With caveats | 1.3M |
 Higgsfield AI Skills higgsfield-ai/skills Nine skills for generating images, video, brand kits, product shots and websites through the paid Higgsfield service and its CLI. | With caveats | 1.3M |
 Browser Use browser-use/browser-use Seven skills around the Browser Use browser agent: drive local Chrome over CDP, use the paid cloud API, run QA scoring, or pay by crypto wallet. | With caveats | 98K |
 OmO (oh-my-openagent) code-yeongyu/oh-my-openagent An agent harness and CLI (omo) with multi-model orchestration; its .agents/skills folder holds mostly maintainer workflows for the project itself. | With caveats | — |
 Claude Plugins Official anthropics/claude-plugins-official Anthropic's official Claude Code plugin marketplace: first-party plugins such as skill-creator and plugin-dev, plus external channel plugins. | With caveats | — |
 Claude Code Templates davila7/claude-code-templates A large catalog and npx installer (aitmpl.com) of agents, commands, hooks, MCP configs and skills for Claude Code, much of it collected from other authors. | With caveats | — |
 Context Mode mksglu/context-mode MCP server plus hooks that keep bulky tool output out of the context window, index it in local SQLite, and restore session state after compaction. | With caveats | — |
 BrowserAct Skills browser-act/skills A browser-automation CLI skill with stealth browsers, CAPTCHA solving and handoff to a human, plus about 100 ready-made scraper skills for shops and lead sources. | With caveats | 193K |
 dbskill dontbesilent2025/dbskill A Chinese business-diagnosis skill toolbox of 35 skills, led by a dispatcher that routes problems to execution, pricing or AI-writing-detection skills. | With caveats | — |
 Claude Code Infrastructure Showcase diet103/claude-code-infrastructure-showcase A reference setup for Claude Code: hooks that auto-activate skills, a skill-rules.json config, and Node/Express/React stack guides to copy into your project. | With caveats | — |
 HTML Anything nexu-io/html-anything Local agentic HTML editor with 75 skills across 9 surfaces (magazine, deck, social cards) that drives a logged-in coding-agent CLI to write and preview HTML. | With caveats | — |
 Mastra Agent Skills mastra-ai/skills Mastra's official skills: a framework guide that routes to current docs and ten references, and a Factory supervisor skill for the mastra api CLI. | With caveats | 87K |
 k-skill NomaDamas/k-skill A Korean-language collection of about 125 skills for everyday Korean services: trains, buses, real estate, courts, delivery, public data, shopping and more. | With caveats | — |
 Google Maps Scraper gosom/google-maps-scraper Agent skill that runs the open-source gosom Google Maps scraper locally in Docker to collect business leads, reviews, emails and contact details. | With caveats | — |
 bb-browser epiral/bb-browser A CLI and MCP server that lets agents drive your real, logged-in Chrome and run site adapters (103 commands, 36 platforms), with two small skills describing the commands. | With caveats | — |
 InsForge Agent Skills InsForge/insforge-skills Four skills for building on the InsForge backend-as-a-service: SDK integration, CLI project management, debugging and auth-provider integrations. | With caveats | 61K |
 Continuous Claude parcadei/Continuous-Claude-v3 A personal Claude Code infrastructure: ~160 skills, 32 agents and 30 hooks that inject skill hints, isolate subagent context to files, and fight compaction. | With caveats | — |
 memsearch zilliztech/memsearch Cross-agent persistent memory for Claude Code, Codex, OpenClaw, OpenCode and DeepSeek Harness: Markdown files as the source of truth, with a Milvus search index. | With caveats | — |
 jezweb claude-skills jezweb/claude-skills A marketplace of Claude Code plugins for web builders: Cloudflare apps, design assets, frontend, dev tools, writing, Shopify and WordPress. | With caveats | — |
 Awesome Legal Skills (Lawve) lawve-ai/awesome-legal-skills A curated, contributor-written library of about 280 legal agent skills (contracts, GDPR, litigation, AI Act) in English, French, Italian and more. | With caveats | — |
 Claude Patent Creator RobThePCGuy/Claude-Patent-Creator A Claude Code plugin and MCP server for US and EPO patent work: MPEP rule search, prior art search, claim checks, drafting and diagrams. | With caveats | — |
 Agentix CEO skill agentix-cloud/skills One skill that turns your agent into a manager of remote Claude Code workers on the Agentix hosted platform, using your Anthropic and GitHub tokens. | With caveats | 75K |
 Internet Court Skill internet-court/internet-court-skill A router skill plus connectors and vendored crypto-protocol skills (x402, ERC-7710, escrow, GenLayer) for agents that pay and contract with other agents. | With caveats | — |
 designlang (extract-design) Manavarya09/design-extract Points a headless browser at any site and reconstructs its design system as 8+ files: DTCG tokens, Tailwind config, shadcn theme, Figma variables, WCAG score. | With caveats | — |
 pstack (standalone mirror) backnotprop/pstack A standalone mirror of Cursor's pstack skill stack, rewritten to work in any agent harness: 61 skills for rigorous, verified engineering work. | With caveats | — |
 Tons of Skills jeremylongshore/tons-of-skills-marketplace A very large marketplace of Claude Code plugins and skills (about 430 plugins, thousands of skills) with its own ccpi package manager. | With caveats | — |
 OpenAccountants openaccountants/openaccountants A large open library of tax skills (2,000+ across 250+ jurisdictions) with figures cited to the law, also served through a hosted MCP connector. | With caveats | — |
| web-design-guidelines skill in vercel-labs/agent-skills A one-page Vercel skill that fetches Vercel's Web Interface Guidelines at run time and checks your UI files against them, reporting terse file:line findings. | With caveats | 797K |
 Awesome Claude Skills (Composio) ComposioHQ/awesome-claude-skills A curated list of Claude skills plus hundreds of templated app-automation skills that run through Composio's hosted Rube MCP. | With caveats | — |
 anbeime Skill Store anbeime/skill A Chinese-language skill store: 63 local skills (content, video, e-commerce, PPT) plus daily-synced mirrors of other authors' skills. | Skip | — |
 Wonda CLI degausai/wonda A paid CLI and 258 KB skill for AI image, video and audio generation, social publishing and logged-in LinkedIn, X and Reddit automation. | Skip | 75K |
Install counts that don't add up
Among the most installed skills on skills.sh, 19 repositories report more than 100,000 installs while having fewer than 100 GitHub stars. That can have innocent causes (a new official repo, bulk installs in CI, a renamed repo), so we don't name them, but we leave them out of the catalog until the numbers make sense.
One pattern is clear enough to show: repositories that reuse the name of a famous skill pack under a different owner. Install the original.
| Repository | Installs (skills.sh) | Stars | Original |
|---|---|---|---|
| 101-skills/superpowers | 4.3M | 16 | obra/superpowers (308K stars) |
| magentosh/superpowers | 3.8M | 4 | obra/superpowers (308K stars) |
| qu-skills/superpowers | 2.8M | 4 | obra/superpowers (308K stars) |
| skills-shell/superpowers | 2.1M | 2 | obra/superpowers (308K stars) |
| its-a-skill-issue/superpowers | 1.8M | 0 | obra/superpowers (308K stars) |
| bankai-skills/superpowers | 1.7M | 0 | obra/superpowers (308K stars) |