In December 2025, Anthropic released the Agent Skills specification as an open standard. OpenAI adopted the same format for Codex CLI within weeks. By February 2026, over 160,000 skills are indexed on SkillsMP alone, Vercel runs an open skills directory with a CLI installer, and companies like dbt Labs and Supabase publish official skill packages that teach AI agents how to use their platforms. The SKILL.md format has become what package.json is to Node.js: a universal declaration file that any compatible agent can read and act on.
This is the app store moment for AI coding agents. Not in the Apple-walled-garden sense, but in the “install a capability with one command and it just works” sense.
What Agent Skills Actually Are (And What They Are Not)
A skill is a folder containing a SKILL.md file with YAML frontmatter and markdown instructions, plus optional scripts and templates. That is the entire format. No compiled binaries, no complex APIs, no runtime dependencies. The SKILL.md file tells the agent what the skill does, when to use it, and how to execute it.
---
name: database-migration
description: Helps agents write safe database migrations
version: 1.0.0
---
# Database Migration Skill
## When to Use
Use this skill when the user asks to create, modify, or rollback
database migrations.
## Instructions
1. Always check the current migration state first...
2. Generate reversible migrations by default...
Skills are model-invoked, meaning the AI agent automatically decides when to activate them based on context. If you have a database migration skill installed and ask your agent to “add a created_at column to the users table,” it will detect the relevant skill and follow its instructions. You never manually trigger a skill. The agent reads the SKILL.md files in its skills directory at startup and uses them as needed.
This makes skills fundamentally different from MCP servers. MCP provides structured API access to external tools and data sources. Skills provide instructions and workflows, essentially teaching the agent a new way of working. You might use an MCP server to connect to your database and a skill to teach the agent your team’s migration conventions. They are complementary layers, not competitors.
The Three Marketplaces You Need to Know
The agent skills ecosystem has fragmented into multiple discovery platforms, each with a different approach. Three matter.
SkillsMP: The Aggregator
SkillsMP is the largest skills directory, indexing over 160,000 skills from GitHub repositories. It works like a search engine for agent skills: you search by keyword or category, preview the SKILL.md content, and get installation instructions. SkillsMP does not host the skills themselves. It crawls GitHub for repositories containing SKILL.md files and makes them discoverable.
The SkillsMP documentation explains their compatibility model: skills work with Claude Code, Codex CLI, ChatGPT, and any agent that follows the SKILL.md convention. Quality varies significantly since anyone can publish a skill, but the sheer volume means you can find a skill for almost any development task.
Skills.sh: The Package Manager
Vercel’s Skills.sh takes a different approach. Rather than just being a directory, it functions as a full package manager with a CLI tool. Install a skill with a single command:
npx skills add dbt-labs/dbt-agent-skills
That command downloads the skill files, places them in the correct directory for your agent (~/.claude/skills/ for Claude Code, ~/.codex/skills/ for Codex), and handles versioning. Skills.sh supports 30+ agents including Cursor, GitHub Copilot, Gemini CLI, Windsurf, and Kiro. Vercel treats skills as part of their broader developer infrastructure play, which makes sense given their role in the JavaScript deployment ecosystem.
The InfoQ coverage of the launch noted that Skills.sh separates agent reasoning from execution. Instead of letting agents dynamically generate shell commands (risky), skills give agents access to predefined, tested procedures. This is a security improvement as much as a productivity one.
VoltAgent’s Awesome List: The Curated Collection
For developers who prefer a hand-picked selection, VoltAgent/awesome-agent-skills on GitHub curates 300+ skills from official developer teams and the community. This repository acts as a quality filter: every listed skill has been reviewed for usefulness and compatibility. It includes skills from Anthropic, dbt Labs, Supabase, Vercel, and dozens of independent developers.
The n-skills marketplace offers a similar curated approach, specifically designed for cross-platform compatibility with Claude Code, Codex, and OpenSkills.
How Companies Ship Official Agent Skills
The most interesting development is not indie developers publishing skills. It is platform companies treating agent skills as a first-class developer relations channel.
dbt Labs: Teaching Agents Analytics Engineering
On February 5, 2026, dbt Labs published official agent skills that teach AI agents to follow dbt best practices. The skill package covers analytics engineering (building and modifying dbt models, writing tests, exploring data sources), semantic layer configuration (creating metrics, dimensions, and semantic models with MetricFlow), platform operations (troubleshooting job failures, configuring the dbt MCP server), and migration (moving projects from dbt Core to the Fusion engine).
What makes the dbt skills interesting is their granularity. Each skill bundles prompts and scripts that LLMs can dynamically string together based on the task at hand. An agent asked to “create a new revenue metric” will activate the semantic layer skill, which instructs it on MetricFlow syntax, naming conventions, and testing patterns. Without the skill, the agent would hallucinate MetricFlow configurations. With it, the agent follows the same patterns a senior analytics engineer would.
Install them in one line: npx skills add dbt-labs/dbt-agent-skills.
Supabase: Postgres Best Practices for Agents
On January 21, 2026, Supabase published agent skills for Postgres optimization. The framework organizes Postgres guidelines across eight categories: query performance, connection management, schema design, concurrency and locking, security and RLS, data access patterns, monitoring, and advanced features.
Each category uses impact-weighted rules from Priority 1 (critical) down to Priority 8 (low), specifically designed for machine parsing. When your AI agent writes a database query through a Supabase project, these skills ensure it generates optimized SQL instead of the naive queries that LLMs typically produce.
The Supabase skills address a real problem. AI agents generate database queries at scale, but most lack embedded knowledge of Postgres-specific optimization patterns. Without the skill, an agent might write a query that works but performs terribly under load. With it, the agent knows to add appropriate indexes, use connection pooling, and handle row-level security correctly.
Building Your Own Skills: The SKILL.md Standard
Writing a skill takes about 15 minutes for a simple one. The standard requires two things: a SKILL.md file with name and description in the frontmatter, and clear instructions in the body.
The Mintlify documentation on SKILL.md explains the progressive disclosure model: lightweight metadata loads early (the agent reads the name and description at startup), full instructions load only when relevant (activated during a matching task), and supporting resources are accessed only when needed (scripts, templates, example files).
Here is a practical example. Say your team has specific conventions for React components:
---
name: react-component-conventions
description: Enforces team React component patterns
version: 1.0.0
---
# React Component Conventions
## When to Use
Activate when the user creates or modifies React components.
## Rules
1. Use functional components exclusively, no class components
2. Place hooks in a custom hook file if there are more than 2
3. Co-locate tests in __tests__/ next to the component
4. Use CSS modules, not styled-components or inline styles
5. Export types from a separate types.ts file
## File Structure
components/
ComponentName/
ComponentName.tsx
ComponentName.module.css
types.ts
__tests__/
ComponentName.test.tsx
Install this in ~/.claude/skills/ for personal use or .claude/skills/ at the project root for team-wide enforcement. Every developer on the team who uses Claude Code (or Codex, or Cursor) will get the same component patterns enforced automatically.
The cross-platform compatibility is the key differentiator from custom instructions or system prompts. A SKILL.md file works identically across Claude Code, Codex CLI, Gemini CLI, Cursor, GitHub Copilot, and 30+ other agents. Write once, run everywhere.
AGENTS.md vs. SKILL.md: Which One When?
You will encounter two related standards: SKILL.md and AGENTS.md. They solve different problems.
SKILL.md defines a reusable capability. It is portable across projects and agents. Think of it as an installable package.
AGENTS.md defines project-specific context. It lives in your repository root and tells any agent working on that project about its architecture, conventions, and workflows. Over 20,000 repositories on GitHub now include an AGENTS.md file. GitHub Copilot, Google Gemini, OpenAI Codex, and Cursor all natively support it.
Vercel’s own evaluation found that AGENTS.md outperforms skills in agent evaluations for project-specific tasks. That makes sense: the agent gets full project context from AGENTS.md, while skills provide general-purpose capabilities.
Use both. AGENTS.md for “how this specific project works.” Skills for “how to do X in general.”
Security Considerations for Agent Skills
Installing a skill means giving an AI agent new instructions for how to behave. That carries risk. A malicious skill could instruct the agent to exfiltrate data, run destructive commands, or bypass safety checks.
The ecosystem is still early, and there is no built-in code signing or verified publisher system like Apple’s App Store review process. The current mitigations are basic: review the SKILL.md content before installing (skills are plain text, so they are easy to audit), use curated sources like VoltAgent’s awesome list rather than random GitHub repositories, and keep skills in project-level directories (.claude/skills/) rather than global (~/.claude/skills/) so they only affect specific projects.
For enterprise teams, the supply chain security implications are worth thinking through before deploying skills organization-wide.
Frequently Asked Questions
What is an AI agent skill?
An AI agent skill is a modular, installable capability defined in a SKILL.md file. It contains instructions, scripts, and templates that teach an AI coding agent how to perform specific tasks like database migrations, code reviews, or framework-specific patterns. Skills are automatically activated by the agent when relevant to the user’s request.
How do I install agent skills in Claude Code?
You can install agent skills in Claude Code by placing SKILL.md files in ~/.claude/skills/ for personal skills or .claude/skills/ in your project root for project-specific skills. The easiest method is using the Vercel Skills CLI: run npx skills add followed by the skill package name, such as npx skills add dbt-labs/dbt-agent-skills.
What is the difference between SKILL.md and AGENTS.md?
SKILL.md defines reusable, portable capabilities that work across projects and agents. AGENTS.md defines project-specific context about a particular repository’s architecture and conventions. Skills are installed packages; AGENTS.md is repository documentation for agents. Both standards are supported by Claude Code, Codex, Cursor, GitHub Copilot, and 30+ other agents.
Which agent skills marketplaces exist in 2026?
The three main marketplaces are SkillsMP (160,000+ indexed skills from GitHub), Skills.sh by Vercel (an open directory with a CLI package manager supporting 30+ agents), and VoltAgent’s awesome-agent-skills (a curated collection of 300+ reviewed skills). Each takes a different approach: aggregation, package management, or curation.
Are agent skills secure to install?
Agent skills carry some risk because they provide instructions that change how an AI agent behaves. There is no verified publisher system yet. Best practices include reviewing SKILL.md content before installing (they are plain text), using curated sources like VoltAgent’s list, and installing skills at the project level rather than globally to limit their scope. For enterprise use, consider the supply chain security implications before organization-wide deployment.