How to Download and Install Claude Skills from GitHub

What Claude Skills Are and Why GitHub Is Where They Live

Here's the strange thing about Claude Skills: they're just text. A skill is a folder containing a SKILL.md file written in plain English, and your AI reads it and follows the instructions the same way it follows anything you type. There's no runtime, no code to execute, no package to install. As freeCodeCamp puts it, skills "cannot run code on their own, but they can instruct the agent to run code using its existing tools." They're not plugins, extensions, or packages.

That simplicity is the design's best feature. Each skill starts with YAML frontmatter containing just two required fields: a name and a description. When a session begins, Claude scans only that frontmatter, which costs a few dozen extra tokens per skill. The full instructions load only when they're actually relevant, a pattern called progressive disclosure. The same SKILL.md file works across Claude Code, GitHub Copilot, Cursor, and Gemini CLI.

So why is GitHub where you'll find them? Because in December 2025, Anthropic made Agent Skills an open standard, following the precedent of MCP. The moment a format becomes a standard, anyone can write for it, and anyone means everyone: a partner ecosystem launched with skills from Atlassian, Canva, Notion, Figma, Cloudflare, Stripe, and Zapier. Practitioners note that "GitHub is where almost every skill you'll hear about is hosted," usually shared as a repo link or a zip file. Anthropic's own official skills repository has over 150,000 stars.

Here's the problem you're about to run into, though. Thousands of skills sit one click away, and quality and safety vary wildly. Researchers scanned more than 42,000 skills and found roughly 1 in 4 had a security hole, while about 1 in 20 showed signs of being deliberately malicious. A separate Snyk audit found roughly 1 in 8 skills had a critical issue, such as hidden data theft or instructions written to leak logins. Anthropic's own guidance is blunt: only install skills from trusted sources, and review anything from less-trusted sources before enabling it.

The core risk comes from the same place as the core benefit. As one practitioner wrote, "Claude doesn't know the difference between a helpful author and a malicious one. It just follows the instruction." A skill can have thousands of stars and still do something you'd never agree to, so star counts tell you nothing about safety.

Before you install anything from GitHub, check the SKILL.md for these red flags:

• References to API keys, passwords, or credentials
• Instructions to send data to external services
• Unexplained scripts or files you can't account for
• Trigger-on-unrelated-events instructions
• Scrambled or encoded text, or a description that doesn't match the files

The good news and the bad news are the same sentence: a skill is just text, which means anyone can write one, and it means you can check one before you trust it. But reading every SKILL.md by hand gets tedious fast, and most people won't do it. That's the gap SkillzBench fills: it continuously crawls and dedupes skills from GitHub, pins every version to a commit SHA, security-scans each one, and publishes sandbox benchmark results so you can see what a skill actually does before it touches your agent. Everything is free at skillzbench.com.

The rest of this guide walks through the installation methods themselves, starting with the official Anthropic repo as your safest starting point.

Three Ways to Install a Skill, Matched to How You Use Claude

There's more than one way to put a skill on Claude, and the right one depends on where you work: terminal, desktop app, or a shared repo with your team. All three paths take minutes, but they differ in scope, so it's worth picking deliberately before you install anything.

Option 1: Claude Code's plugin marketplace commands. If you live in the terminal, this is the fastest route. You register a GitHub repo as a marketplace, then install skills from it. Using Anthropic's official repo, the commands look like this:

• /plugin marketplace add anthropics/skills to register the marketplace
• /plugin install document-skills@anthropic-agent-skills to install the document skills
• /plugin install example-skills@anthropic-agent-skills to grab the examples instead

The official Anthropic repo is the cleanest starting point, and it's a good way to learn what a well-built skill looks like.

Option 2: The desktop app's Customize flow. Open Customize, then Plugins, and add a marketplace by pasting the GitHub repo URL. You can also upload a skill as a ZIP file directly. Hit Sync and the skill lands in your setup. On the web, the flow is similar: Customize, then Skills, then upload a ZIP, though you'll need code execution enabled first, per Anthropic's support docs.

Option 3: Drop the folder in manually. A skill is just a folder with a SKILL.md file inside, so you can place one yourself. Where you put it determines who sees it, and the Claude Code docs spell out the scopes:

• ~/.claude/skills/ for personal skills, available in every project
• .claude/skills/ inside a repo for project skills your whole team can commit and share

The location is the decision. Personal skills follow you everywhere; project skills stay with the codebase and give everyone on the team the same behavior.

One caveat before you install from any random repo: popular does not mean safe. Research scanning 42,000+ skills found roughly 1 in 4 carried a security hole, and about 1 in 20 showed signs of deliberate malice. Anthropic's own guidance is to install only from trusted sources and review anything less familiar before enabling it. If you'd rather not read every SKILL.md by hand, SkillzBench security-scans and benchmarks skills from GitHub and pins each version to a commit SHA, all free at skillzbench.com.

The Vetting Problem: Why You Should Never Install Blind

Installing a skill is easy. That's exactly the problem. A skill is just a text file with instructions your agent will follow without question, and as practitioner Tayla Burrell puts it, "Claude doesn't know the difference between a helpful author and a malicious one. It just follows the instruction."

The numbers back that caution up. Research scanning more than 42,000 skills found roughly 1 in 4 carried at least one security hole, and about 1 in 20 showed signs of being deliberately malicious. A separate Snyk audit found roughly 1 in 8 skills had a critical issue, including hidden data theft and instructions engineered to leak logins. Anthropic's own guidance is blunt: only install skills from trusted sources, and review anything less-trusted before enabling it, because the primary risks are prompt injection and data exfiltration.

The good news is that because a skill is plain text, you can audit it yourself in a few minutes. Open the SKILL.md file and look for these red flags:

• References to API keys, passwords, or credentials the skill has no business touching
• Instructions to send data to external services, especially ones the description never mentions
• Unexplained scripts in the folder that the documentation doesn't account for
• Trigger conditions that fire on unrelated events, so the skill activates when it shouldn't
• Scrambled or encoded text, or a description that doesn't match what the files actually do

A useful heuristic from Burrell: if you wouldn't be comfortable performing a line's instruction by hand with your own accounts, that's the line to question. Also check the scripts folder, and run a skill's first use in a fresh session with a contained folder so you can see what it actually does.

One signal you should ignore: star counts. Anthropic's official repo has over 150,000 stars, and that's genuinely reassuring for that specific repo. But popularity is not a safety signal. A skill can have thousands of stars and still do something you'd never agree to, because stars measure interest, not inspection. Most people install without reading a single line.

If manual review sounds tedious for every skill you want to try, that's a fair reaction, and it's why automated vetting exists. SkillzBench handles the grunt work: it crawls and dedupes skills from GitHub, pins every version to a commit SHA, security-scans and license-checks each one, and benchmarks them in a sandbox, all free at skillzbench.com. Its 0–100 trust score draws on security, quality, license, and maintenance signals, and Lift results are always shown separately from ratings so you can judge usefulness and safety on their own terms.

No scanner is a force field, as Burrell notes. But a mix of automated scanning and your own read of the SKILL.md file catches the vast majority of dangerous skills before they ever reach your agent.

Skip the Manual Audit: Vetted Skills and Benchmark Results on SkillzBench

Every install guide ends with the same warning: check the skill before you trust it. That's good advice, and it's also a chore. When researchers scanned more than 42,000 skills, roughly one in four had a security hole, and about one in twenty showed signs of deliberate malice. A separate Snyk audit found about one in eight skills had a critical issue, such as hidden data theft or instructions written to leak logins.

Manually inspecting every SKILL.md works, eventually. But it's tedious, easy to get wrong, and most people skip it. That's the gap SkillzBench (skillzbench.com) was built to close. It's a free, independent directory that does the vetting work for you, then shows its evidence so you can judge for yourself.

Here's what it actually does, running today:

• Continuous discovery: it crawls GitHub for agent skills and dedupes them, so you're browsing a curated catalog instead of raw search results.
• Pinned versions: every skill version is locked to a specific commit SHA, so what you read is what you install. No silent swaps after the review.
• Automated checks: each skill gets a security scan, a license check, and a quality review before it's listed.
• Sandbox benchmarks: every skill is tested with the same model, with and without the skill, and the Lift in percentage points is published alongside the result.
• A 0-100 trust score: built from security, quality, license, maintenance, and community signals.

Two design choices matter more than the rest. First, Lift is always shown separately from ratings and trust scores, and money never touches either. A skill can score high on trust and still show a modest Lift, which tells you it's safe but not particularly useful for your workflow. Second, everything on the platform is free: the directory, the benchmarks, the alerts when a skill changes upstream and gets re-scanned, and the MCP connector.

That connector is the deployment piece. Instead of copying folders into ~/.claude/skills/ by hand, you toggle the skills and tools you want onto a per-agent loadout, and the agent only sees what you chose. It works with Claude Code, Codex, Cursor, Gemini CLI, and chat-app agents, and it's the same free MCP server for all of them.

This matters because Anthropic's own guidance is to only install skills from trusted sources and review third-party skills before enabling them. Enterprise plans get automatic scans that take one to two minutes, but most readers don't have an enterprise plan. A free directory with pinned versions, published benchmarks, and a trust score is the closest substitute available, and it's already live.

The practical workflow is simple: search SkillzBench for the capability you need, check the Lift and trust score, then load it onto your agent through the free MCP connector. If a skill's numbers don't convince you, skip it. The whole point is that you decide with evidence in front of you, not vibes and star counts.

Your First Install, Done Safely: A Starter Workflow

You've picked your first skill and you're ready to install. Do it in the right order and you'll build habits that keep you safe on every skill you add afterward.

Start with Anthropic's official skills repository. It's the canonical starting point, with over 150,000 GitHub stars, and it's the cleanest way to learn what a well-built skill actually looks like. In Claude Code, run /plugin marketplace add anthropics/skills, then install with a command like /plugin install document-skills@anthropic-agent-skills. Desktop users can add the same repo through Customize → Plugins.

Before you enable anything third-party, put it through a security check. Researchers who scanned more than 42,000 skills found roughly 1 in 4 had a security hole, and about 1 in 20 showed signs of deliberate malice. Anthropic's own guidance is to only install skills from trusted sources and review everything else before enabling it. A Snyk audit found roughly 1 in 8 skills carried a critical issue, such as hidden data theft.

When you inspect a SKILL.md yourself, look for these red flags:

• References to API keys, passwords, or credentials
• Instructions to send data to external services
• Unexplained scripts or trigger-on-unrelated-events instructions
• Scrambled or encoded text, or descriptions that don't match the files

Then test the skill's first run in a fresh session with a contained folder. Keep the working directory limited to files you don't mind exposing, and watch what the agent actually does. As practitioner Tayla Burrell puts it, Claude doesn't know the difference between a helpful author and a malicious one; it just follows the instructions. A contained first run means a bad instruction can't reach anything that matters.

Finally, cross-check candidates before you commit. Popularity isn't a safety signal, so skip the star counts and look at evidence instead. SkillzBench publishes a 0–100 trust score built from security, quality, license, and maintenance signals, plus sandbox benchmark results showing the Lift each skill delivers, tested with the same model with and without the skill. Both are free to browse at skillzbench.com, and Lift is always shown separately from ratings so you can judge risk and performance on their own terms.

One pass through this sequence takes maybe ten minutes, and it turns skill installation from a leap of faith into a routine you can repeat for every new skill you adopt.