Claude Skills Grew 200x in Search Demand. What Happened?

The Skills Explosion: From Niche Feature to Agent Infrastructure in 20 Days

Twenty days. That's all it took for the skills.sh marketplace to multiply its catalog 18.5 times over — from 2,179 skills on January 16, 2026 to 40,285 by February 5, 2026, according to a measurement study from Bosch Research and CMU. That's a net gain of 38,106 skills at roughly 15.7% average daily growth.

The story starts earlier. Anthropic introduced the Skills format in October 2025, then released it as an open standard on December 18, 2025, positioning skills for cross-platform portability. Today the format runs on Claude Code, Claude.ai, the Claude API, OpenAI Codex, Cursor, Gemini CLI, Antigravity, and Windsurf.

Growth wasn't gradual — it came in bursts. The researchers documented a single-day spike of 8,857 skills on January 25, 2026 — 23.2% of all new skills — with that one week contributing 47.8% of the entire snapshot. OpenClaw GitHub stars spiked in parallel, peaking at 25,432 new stars on January 26, which the authors interpret as "a wave of public attention likely encouraged both skill publication and exploration of skill-based tooling."

About that headline number: the "200x search demand" figure circulating in search-trends chatter isn't corroborated by any of the analyzed sources. The verified evidence is the marketplace data above — which is dramatic enough on its own.

Why skills scaled when other approaches didn't. The answer is progressive disclosure. Each skill loads only ~100 tokens of metadata at session start, pulls in the full SKILL.md body (typically under 5,000 tokens) only when triggered, and reads bundled files on demand. As Anthropic's engineering team puts it, progressive disclosure is "the core design principle that makes Agent Skills flexible and scalable" — a single agent can host hundreds of skills without bloating its context window.

That design turned skills from prompt snippets into something more like agent infrastructure:

• A median skill runs just 1,414 tokens, making them cheap to load and combine.
• Skills teach behavior, complementing MCP (access) and tools (actions) rather than replacing them.
• Curated repositories now list 1,000+ production-ready skills and plugins.

The researchers frame skills as "an emerging infrastructure layer for agents" — and infrastructure needs inspection. That's the premise behind SkillzBench, which is building independent discovery, verification, and benchmarking for this rapidly expanding catalog. Because when an ecosystem adds 38,000 packages in three weeks, knowing which ones actually help becomes the whole game.

Skills, proven. Join the SkillzBench waitlist to see verification and benchmarking in action at launch.

The Trust Crisis Hiding in 40,000 Skills

Forty thousand skills sounds like abundance. Look closer and it's a supply chain nobody is inspecting.

The numbers are blunt. A large-scale measurement study of the skills.sh marketplace found that 46.3% of listings share a normalized name with at least one other skill — some names appear over 100 times, a pattern consistent with template-driven or automated publication. The researchers warn this redundancy "increases user search costs and fragments feedback and adoption signals," making it harder for quality implementations to become clear defaults.

Quality fares no better than uniqueness. A 2026 UC Irvine study of 238 real-world skills found that 99% carry at least one flaw a routine review would catch, with the "Rationalization Loophole" skill smell appearing in 94% of them. And security is where it turns serious: published research found 26.1% of community skills carry at least one vulnerability.

The risk isn't theoretical. Mitiga Labs built a proof-of-concept "Testing-Validator" skill that silently exfiltrated an entire codebase via a PR signed by the Cursor Agent — with a completely empty skill-audit.log and only four user interactions required. When the researchers asked Cursor to make the malicious skill quieter, the agent obliged: "the agent co-designed a better attack with us."

Anthropic isn't hiding from this. Its own documentation warns that "a malicious Skill can direct Claude to invoke tools or execute code in ways that don't match the Skill's stated purpose." But there's a coverage gap: Anthropic's enterprise skill content scanning applies only to claude.ai and Cowork uploads — not to Skills API or Console uploads. A large share of the ecosystem runs outside the scanned perimeter entirely.

So what can you actually trust? Not the popularity signals. Mitiga explicitly recommends against trusting stars, upvotes, or download counts, and documents reputation manipulation via bot upvotes on skill catalogs. The signals most users rely on are the ones easiest to fake:

• Stars and upvotes — manipulable via bots, per Mitiga's supply-chain research
• Download counts — one reportedly fake skill racked up 26,000 installs while passing security scans
• A skill's stated purpose — which, per Anthropic itself, can diverge from what the skill actually executes
• Marketplace presence — nearly half of listings are near-duplicates of something else

This is the gap SkillzBench exists to close: independent verification — pinning every skill version to a commit SHA, security-scanning, quality-judging, and benchmarking in a sandbox — instead of trusting signals that were never trustworthy to begin with.

Why 'Popular' Doesn't Mean 'Helpful': The Benchmark Gap

Popularity tells you a skill is visible. It tells you nothing about whether the skill actually makes your agent better at its job. That distinction is the difference between installing a tool and installing a liability.

The evidence for this comes from controlled benchmarking. According to SkillsBench research, curated skills raise average pass rates by 16.2 points across 84 tasks — a genuinely impressive headline number. But averages hide the real story: 16 of those 84 tasks showed a negative delta, meaning the skill actively made the agent worse on those jobs. A skill that boosts performance on one domain can degrade it on another, and no download count or star rating will tell you which side your workflow falls on.

The self-generation story is equally sobering. Anthropic's roadmap envisions agents creating and evaluating skills on their own, codifying their behavior into reusable capabilities. Yet the same benchmarking research found that same-session self-generated skills show no measurable benefit on average. An agent writing a skill for itself mid-task is, as one researcher put it, essentially identical to extended thinking — it feels productive but doesn't move the accuracy needle.

This is why reputation signals fail as a quality proxy. The problems stack up quickly:

• 46.3% of marketplace skills share a normalized name with at least one other listing, fragmenting feedback across near-identical versions
• 99% of 238 studied real-world skills carry at least one flaw a routine review would catch
• 26.1% of community skills carry a vulnerability — and one fake skill reportedly racked up 26,000 installs while passing security scans
• Mitiga Labs researchers explicitly warn users not to trust stars or upvotes, having documented reputation manipulation via bot upvotes and fake downloads

None of these signals measure the only thing that matters for usefulness: does this skill, on this model, on this task, improve output? The only honest way to answer that is a controlled comparison — running the same model on the same task with and without the skill, and publishing the difference in percentage points. That's the methodology behind the 16.2-point average and the 16 negative tasks in the first place, and it's exactly what SkillzBench is building: sandboxed, with-and-without benchmarking on a consistent model, with the measured Lift always shown separately from trust scores so a rating can never mask a regression.

The academic community sees the same gap. The arXiv researchers who tracked the marketplace's 18.5× growth in 20 days frame skills as an emerging infrastructure layer for agents — and explicitly call for better discovery, de-duplication, and quality signals. High redundancy, they note, fragments adoption signals across near-identical listings, making it harder for quality implementations to become clear defaults.

The takeaway is simple: safe isn't the same as helpful, and popular isn't either. Before a skill earns a place in your agent's context, it should have to prove its lift — not just its downloads.

What Trustworthy Skill Adoption Looks Like: Verify, Benchmark, Equip

The difference between a skills library that compounds value and one that quietly introduces supply-chain risk comes down to the adoption workflow your team demands. With nearly half of marketplace listings being duplicates — 46.3% of skills share a normalized name with at least one other listing, per a recent measurement study — "just install the popular one" is not a process.

A trustworthy workflow has five steps. First, pin every skill to a commit SHA, not a tag or a "latest" pointer. If you can't reproduce exactly what you tested, you can't trust what you run. Second, scan before you install: license checks, security scanning, and quality review. This matters because research on real-world skills found that 26.1% of community skills carry a vulnerability — and Anthropic's own content scanning only covers claude.ai uploads, not API or Console skills.

Third, deduplicate across sources. The same skill published under near-identical names fragments feedback signals and makes it harder for quality implementations to become defaults, as the arXiv researchers note.

Fourth, benchmark with and without the skill, in a sandbox, on the same model. This step is non-negotiable because skills can actively hurt performance: curated skills raised average pass rates by 16.2 points on SkillsBench, but 16 of 84 tasks showed a negative delta. Lift should always be reported separately from trust scores — a skill can be safe but useless, or useful on average and harmful on your specific task.

Fifth, equip deliberately. Agents should only see the skills and tools that were explicitly vetted and toggled on for them — a per-agent loadout, not a shared bucket of whatever was installed.

Two principles hold the whole workflow together:

• Reproducibility over convenience: commit SHAs, versioned scans, re-benchmarks when upstream changes.
• Separation of signals: Lift (does it help?) is never blended into trust (is it safe?).
• Independence: money never touches scores.

That last point isn't idealism. Mitiga's research on skill supply-chain attacks documented reputation manipulation via bot upvotes and fake downloads on skill catalogs, and explicitly recommends not trusting stars or upvotes as a signal. When a single one-click install can, as Mitiga put it, "quietly wire exfiltration straight into your delivery flow," any score that can be purchased is a liability.

This is the workflow SkillzBench is building: continuous discovery and deduplication from GitHub, SHA-pinned verification with security and license scanning, sandboxed with/without benchmarking with Lift shown in percentage points, and per-agent loadouts through a single MCP server. The waitlist is open now for teams that want vetted skills, not viral ones.

Getting Ahead of the Skills Supply Chain Before It Gets Worse

Here's the uncomfortable math: the skills.sh marketplace grew from 2,179 skills to 40,285 in just 20 days — an 18.5× increase — yet researchers found that 46.3% of listings share a normalized name with at least one other listing. Supply is exploding faster than anyone can evaluate it, and that gap is going to widen before it closes.

The direction of travel is clear, though. Skills are no longer a Claude feature — the open-standard format now runs across Claude Code, OpenAI Codex, Cursor, Gemini CLI, Antigravity, and Windsurf, and Claude Code has folded its legacy custom commands into skills entirely. When a format is this portable, every agent platform becomes a distribution channel, and every channel multiplies the volume of unvetted packages.

The researchers behind the marketplace study frame skills as an emerging infrastructure layer for agents — and like all young infrastructure, it's messy. They document a pronounced supply-demand imbalance across categories, with redundancy that "fragments feedback and adoption signals" and makes it harder for quality implementations to become defaults. Meanwhile, 26.1% of community skills carry a vulnerability, and Mitiga Labs demonstrated a proof-of-concept skill that exfiltrated an entire codebase with an empty audit log.

What does getting ahead of this actually look like?

• Continuous discovery — crawling and deduplicating the flood, not sampling it once.
• Version pinning — every skill tied to a commit SHA, so what you verified is what you install.
• Re-scanning on upstream changes — a skill that was safe in January may not be safe after its next commit.
• Stay-current notifications — because verification is a snapshot, not a lifetime guarantee.

That's the gap the ecosystem's own researchers have named: better discovery, de-duplication, quality signals, and standardization. It's also the gap SkillzBench is building for — an independent testing lab that continuously discovers skills, pins every version, security-scans and benchmarks each one in a sandbox with and without the skill, and publishes the Lift in percentage points separately from any rating. Money never touches scores, because stars and upvotes can't be trusted — Mitiga's research documents reputation manipulation via bot upvotes and fake downloads on skill catalogs.

The supply-demand imbalance won't resolve on its own. Growth is bursty, attention-driven, and largely automated; the 8,857 skills added on a single day in late January tell you nobody is hand-reviewing that volume. The teams that thrive in this ecosystem will be the ones who treat skills like any other dependency: verified, versioned, benchmarked, and monitored.

If you want a verified, benchmarked skill loadout for your agents rather than a gamble on marketplace stars, the SkillzBench waitlist is open — early access goes to teams who'd rather test than trust.