Agent Skills Marketplace: What Is Actually Worth Installing (2026)

The community directory SkillsMP indexes roughly 1.9 million skills scraped from GitHub, and Vercel's skills.sh lists 89,753. Those are their numbers, not ours, and they move daily. The number that matters to you is much smaller: how many skills you install, because every installed skill puts its name and description in your prompt on every turn, whether it fires or not. Two hundred skills at roughly 50 tokens of description each is 10,000 input tokens per turn — about $0.40 of input across a 20-turn run at Claude Sonnet 5's $2 per 1M rate, spent before the agent does anything. That figure is arithmetic, and we label it as such. What we did measure, on 13 models in one sitting, is the other half of the bill: reasoning tokens ranging from 0 to 732 per call and measured costs from $0.10 to $8.83 per 1,000 tasks at identical correctness. Below: what the spec actually is, who adopted it, what the marketplaces really contain, and how to choose from 1.9 million pieces of markdown that your agent will read and follow.

A skills marketplace is a strange kind of app store. Nothing gets installed in the usual sense. No binary runs, no permission dialog appears. A folder of markdown lands on disk, and from then on your agent reads it and does what it says. That is the whole mechanism, and it is why the format spread across the industry in about two days — and why a directory with a million entries in it is a problem rather than a feature.

What the Agent Skills spec actually is

Anthropic published the Agent Skills specification on 2025-12-18. Its defining property is how little it defines. A skill is a folder. Inside the folder is a file called SKILL.md with YAML frontmatter at the top — principally a name and a description — followed by instructions in plain markdown. Optionally the folder also carries scripts and resource files that the instructions can point at.

That is it. No runtime, no manifest schema to validate against a server, no registry protocol, no transport. Compare that to what it takes to ship an MCP server, and the adoption curve stops being surprising.

The design idea underneath it is three-tier progressive disclosure, and it is the part worth understanding because it is a context-budget decision dressed as an ergonomics decision:

Source: the Agent Skills specification, Anthropic, published 2025-12-18. The tier boundaries are the spec's; the cost column is our framing.

The consequence people miss: tier 1 is not free and it is not conditional. Every skill you have installed contributes its name and description to the prompt on every turn of every run, including the turns where it is irrelevant and the runs where it never fires. Structurally that is the same cost shape as tool definitions in a function-calling request — a constant floor you pay per turn regardless of use. We covered that failure mode as trap 4 in AI agent traps; skills reproduce it exactly.

Who adopted it, and how fast

Adoption was unusually quick for a cross-vendor format. Within roughly 48 hours of publication, Microsoft added support in VS Code and OpenAI added it to ChatGPT and the Codex CLI. By March 2026, about 32 tools from competing companies read the same SKILL.md files from the same folder layout — among them Google's Gemini CLI, JetBrains' Junie, AWS's Kiro, and Block's Goose.

Those adoption facts are vendor announcements and third-party reporting, not something we measured. Treat the 32 as a point-in-time count from March 2026 rather than a live figure.

Why it moved that fast is worth naming, because it predicts what happens next. There was nothing to implement. A tool that already reads project files — and they all do, see AGENTS.md for the earlier version of the same convention — supports skills by globbing a directory and concatenating some frontmatter. There is no server to run, no auth to negotiate, no version handshake. The cost of adopting was near zero, so everyone adopted.

The same property is why the marketplaces filled up so fast, and why almost nothing in them has been reviewed.

The marketplace numbers, and who counted them

Two numbers get quoted constantly. Both are self-reported by the directories themselves. Neither is ours, neither is verified by us, and both were recorded as we write this on 2026-07-29:

• skills.sh, run by Vercel, lists 89,753 skills.
• SkillsMP, a community directory, indexes roughly 1.9 million skills scraped from GitHub.

Read the second one carefully. Scraped from GitHub is not submitted, not reviewed, and not maintained. A scraper that walks public repositories looking for SKILL.md will find every abandoned experiment, every tutorial copy, every fork of a fork, and every file someone wrote in ten minutes and never opened again. 1.9 million is a measure of how easy the format is to produce. It is not a measure of how much is worth installing.

This is not a swipe at either directory — an index is supposed to index. It is a warning about how the number gets used. A count that large invites the assumption that there is a mature ecosystem behind it with the usual filtering. There is no filtering. There is a file format and a crawler.

Progressive disclosure is a context-budget mechanism

The spec's three-tier design exists because context is the scarce resource in an agent, and context is billed. Everything the model can see costs input tokens on the turn it can see it, and in a loop that multiplies by turn count.

Progressive disclosure solves tiers 2 and 3 well. A skill body of 2,000 tokens costs nothing until it matches. Bundled scripts cost nothing until referenced. That is a genuinely good design and it is why the format scales past a handful of skills at all.

What it does not solve is tier 1. Descriptions must all be present for the matching decision to happen — the agent cannot decide a skill is irrelevant without reading enough of it to know. So the floor grows linearly with the number of installed skills, and you pay that floor on every turn.

Two practical consequences follow, and they point in opposite directions from the usual advice:

• Installing a skill you rarely use is not free. It is a small permanent tax, not a conditional cost. Ten unused skills are cheap; two hundred are not.
• Verbose descriptions are worse than verbose bodies. A 400-token description on a skill that fires once a week is a bad trade. A 4,000-token body on the same skill is fine. Put the length where progressive disclosure can hide it.

The prefix is stable across turns, which means prompt caching can blunt the cost substantially if your provider and client support it. It reduces the rate; it does not remove the item. The broader discipline is in context engineering for AI agents.

What a bloated skills directory costs per run

Here is the arithmetic, stated as arithmetic. Assume a skill's name plus description averages 50 tokens — that is our assumption, chosen as a round number, not a measurement, and a deliberately low one: the published progressive-disclosure guidance we cite in MCP vs Skills puts tier-1 metadata nearer 100 tokens per skill. Treat every figure below as a floor and double it if your descriptions run to that length. Assume a 20-turn agent run. Input token cost then scales with directory size like this:

Projection, not measurement. The 50-token description and the 20-turn run are assumptions. The per-1M input rates are verified list prices captured 2026-07-28. Substitute your own numbers; the shape does not change.

Now the half we did measure, because it sets which column of that table you are actually paying. We ran 13 models through an executed benchmark in one sitting: nine Python tasks, temperature 0, a 4,000-token ceiling, and every answer scored by running the returned code against assertions the model never sees. 10 of those 13 scored a perfect 9/9. Their measured costs ranged from $0.10 to $8.83 per 1,000 tasks — an 88x spread at identical correctness.

Measured by DataLLM Lab on one methodology in one sitting. Cost is computed — reported token counts multiplied by that model's list price — not a vendor invoice. Misses: DeepSeek V4-Pro on parse_csv_line, Grok 4.3 on flatten, StepFun Step 3.7 Flash on valid_parentheses. Full field in the coding cost benchmark.

Reasoning tokens are the other compounding item, and they bill at the output rate. Across those 13 models the spread was 0 to 732 per call. Four models emitted zero and still scored 9/9: Qwen3 Coder Next, Mistral Medium 3.5, Claude Sonnet 5, Claude Opus 4.8. Google's Gemini 3.6 Flash, run later on the same harness on 2026-07-28, scored 9/9 at $8.02 per 1,000 tasks with 933 reasoning tokens per call — and its per-task counts ranged from 341 on two_sum to 2,615 on parse_csv_line, a 7.7x spread within one run.

Put the two halves together and the point sharpens. A large skills directory raises your input floor per turn. A heavily-reasoning model raises your output cost per turn. Both multiply by turn count, and neither shows up in the prompt you wrote. If you are going to run an agent with 200 skills installed, the model column in that first table is not a detail — it is the difference between $0.022 and $1.00 of pure overhead per run. More reductions in cutting token costs for coding agents.

1.9 million skills is a supply chain

Say the uncomfortable part plainly. A skill is a set of instructions that your agent reads and follows. There is no sandbox around markdown. The security model of installing a skill from a marketplace is identical to the security model of pasting a stranger's text into your system prompt, because that is mechanically what happens.

Three properties make this worse than the usual dependency problem, not better:

• No execution boundary to point at. Package managers at least have an install-script surface people know to audit. A skill has no scripts to audit in the ordinary case — the payload is the prose, and prose is the thing the agent obeys.
• The description is always loaded. Tier 1 metadata sits in context on every turn, so a hostile description does not need the skill to fire. It is present from the first turn of every run, in the same window as your actual instructions.
• The bar to publish is a git push. 1.9 million entries exist because producing one costs nothing. Nothing in that pipeline reviews, signs, or scores anything.

This is the same class of problem as prompt injection through tool output, which we covered in AI agent security and, for the tool layer specifically, in MCP security. The rule there is the rule here: anything the agent reads becomes instructions it may act on. A skill is not an exception to that rule; it is the purest example of it, because a skill is text whose entire purpose is to be obeyed.

The practical worry is not a movie-plot attack. It is the boring version: a skill whose instructions tell the agent to always do something, to skip a confirmation step, to read a credentials file for convenience, to fetch and follow a remote document, or to prefer one vendor's API. None of that looks like an attack in a diff. All of it changes what your agent does on every run, forever.

How to pick a skill

The selection rule that survives contact with a 1.9-million-item index is unglamorous: read the whole file, or do not install it. If a skill is too long to read, it is too long to trust — and it is also too long to sit in your context. Those two objections happen to point the same way.

Two operational habits are worth more than any checklist. Vendor your skills. Copy the folder into your own repository at a commit you reviewed, rather than installing from a live directory that can change under you. And keep the directory small on purpose — audit it monthly and delete anything that has not fired. Both the security argument and the cost argument reduce to the same instruction, which is a good sign that the instruction is right.

Skills or MCP servers

These get compared constantly and they are not really competitors. A skill is instructions — it changes what the model knows how to do. An MCP server is capability — it gives the model something it can call. A skill cannot query your database; an MCP server cannot teach the model your team's deployment procedure.

The overlap that matters here is the cost shape: both put something in the prompt on every turn. Tool definitions and skill descriptions are the same kind of item — a constant, per-turn input tax proportional to how many you have connected. If you run both, add the two floors together before you decide either is cheap. The full comparison is in MCP vs Skills, the connect-side view is in best MCP servers, and the discovery problem on the MCP side is in the MCP registry.

If you are writing skills rather than installing them, the practical guide is Claude Code skills, and the habit of writing the procedure down before the agent runs it is the same one described in spec-driven development. Day-to-day usage is in how to use Claude Code.

What our numbers do and do not prove

Separating these is the point of publishing numbers at all.

What we measured. Nine executed Python tasks — two_sum, valid_parentheses, merge_intervals, roman_to_int, lcs_len, flatten, top_k_words, token_bucket, parse_csv_line — at temperature 0 with a 4,000-token ceiling. The model gets a signature and a prose spec and never sees the tests. Returned code is executed against hidden assertions in an isolated python3 -I subprocess with a 12-second timeout. All asserts pass or it fails: no partial credit, no human grader, no LLM judge. One scored attempt per task; retries happen only on an API error, never on a wrong answer. Cost is computed from reported token counts times list price — a measured cost, not a vendor invoice. Calls go through OpenRouter's OpenAI-compatible endpoint, deliberately not through the DataLLM Lab gateway.

What is a projection. Every skills-directory cost figure on this page. Our harness is single-turn. It does not run agents, does not load skills, does not use tools, and does not measure how a loop behaves. The 50-token description, the 20-turn run, and every dollar figure derived from them are arithmetic on assumptions we chose. They are a defensible way to size the problem and they are not evidence about your agent.

What is third-party. The specification date of 2025-12-18, the roughly 48-hour VS Code and ChatGPT/Codex CLI adoption, the count of about 32 tools by March 2026, the 89,753 figure from skills.sh, and the roughly 1.9 million figure from SkillsMP. Those come from Anthropic, the respective vendors, and the directories themselves. We did not verify the marketplace counts and they change daily.

What the harness cannot see at all. Long-context reasoning, multi-file refactoring, agentic and multi-turn tool use, non-Python work, and vision. The 4,000-token ceiling can truncate a verbose model and score it as a miss.

What we have not tested. Any Gemini other than 3.6 Flash. GPT-5-mini and GPT-5-nano. Ollama or any locally-run model. Grok 3, Grok 4, Grok 4.5, Grok 4.20, grok-build-0.1. Claude Haiku 4.5, Claude Opus 4.7, Claude Sonnet 4.6. VibeThinker is not on OpenRouter, so we could not run it. If a number for any of those appears anywhere on this site as ours, it is an error.

FAQ