A very large marketplace of Claude Code plugins and skills (about 430 plugins, thousands of skills) with its own ccpi package manager.
Useful as a catalog, but at this scale quality and licensing vary by plugin, so pick and read individual items.
Tons of Skills is a catalog rather than a single skill pack. The README counts 428 catalog plugins, 2,713 marketplace-visible skills and 352 agent definitions across 19 categories, and GitHub reports more than 5,000 SKILL.md files in the repo. The whole marketplace installs with one Claude Code command, or you can pick individual plugins through the ccpi CLI from npm, for example ccpi install devops-automation-pack. A website at tonsofskills.com lets you browse.
External plugins are mirrored by default: the contributor's repo stays the source of truth, sources are pinned in a content lockfile, and upstream author, license and commit are recorded. First-party packages are published under the Intent Solutions npm scope. Individual skills vary a lot; the average SKILL.md is about 5.8 KB, and some plugins have references and scripts, such as an agency-os plugin and a 27 KB audit skill. The repo has CI and an eval set of only a few files. Quality, scope and license differ per plugin, so this is a place to find candidates, not a vetted bundle.
Thousands of skills averaging 5.8 KB, mostly instructions with some plugins adding references and scripts, and only a few eval files across the repo.
Counted from the repository file tree. How we score depth.
This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.
Bash (unrestricted shell) together with WebFetch and WebSearch; the same pattern is in pitch-copy, buzz-devrel, buzz-hn, buzz-outreach, ink-brief, ink-cluster, ink-distribute and pitch-landing.plugins/ai-agency/tonone/bundle/marketing-team/skills/pitch-launch/SKILL.md:4A very large marketplace of which we hold only the ai-agency plugins (hyperflow workflow skills, agency-os, shipwright-pipeline, a tonone marketing bundle). Several skills pre-approve broad shell access, including unrestricted Bash in the marketing bundle and python/bash/npx wildcards in hyperflow, so they can run commands without per-command prompts. The one script talks only to the Notion API with your Notion key; hyperflow's deploy and dispatch skills ask before pushing unless you pre-elect push=auto or pr=auto.
npx -y @notionhq/notion-mcp-server (no version) in .mcp.json, and pre-approves Bash(npx:*).plugins/ai-agency/agency-os/skills/agency-os/SKILL.md:59The repository (25517 files) on Oct 29, 2026. Not a full review: 25366 of 25517 files were not downloaded (large repository; we reviewed the skill folders); it relies on code outside the repository: @notionhq/notion-mcp-server (npm package used by agency-os); 25366 of 25517 repository files were not available to us; only the ai-agency plugins and one beads agent file were downloaded.
NVIDIA SkillSpector static scan: 176 pattern hits (Tool Misuse 67, Privilege Escalation 63, Excessive Agency 17, Agent Snooping 7, Prompt Injection 4, Memory Poisoning 4). The CRITICAL tainted-flow hits are query-tasks.py sending a Notion token read from env/.env to api.notion.com, which is the script's purpose. The many HIGH hits are the hyperflow security.md lists of blocked files and commands (.env, ~/.aws/credentials, rm -rf, git push --force) that describe what workers must not do, plus audit examples.
A review, not a certification. Skills change after we check them — read the files before installing.
MIT for the repository scaffolding and first-party tooling; each plugin carries its own license, and mirrored plugins keep the upstream license.
Not really. It is a catalog; whether any plugin can run unattended depends on the plugin.
A 400+ skill library of agents, personas and commands for engineering, marketing, product, compliance and C-level work, mirrored for 13 coding agents.
A large library of 385 business, product, compliance and engineering skills with 906 standard-library Python tools, under a Commons Clause license.
A multi-harness plugin marketplace with 94 plugins, 202 agents, 185 skills and 105 commands for Claude Code, Codex, Cursor, OpenCode, Copilot, Antigravity and Pi.
A large catalog and npx installer (aitmpl.com) of agents, commands, hooks, MCP configs and skills for Claude Code, much of it collected from other authors.
It is a marketplace of hundreds of Claude Code plugins and thousands of skills, with a ccpi package manager and a browsing site at tonsofskills.com.
In Claude Code run /plugin marketplace add jeremylongshore/claude-code-plugins, or install the ccpi CLI with pnpm add -g @intentsolutionsio/ccpi and run ccpi install followed by a plugin name.
Install individual plugins rather than the whole catalog, and read their skills first. The repo mirrors third-party work and each plugin has its own license and quality level.