The Claude Skills Marketplaces Compared: Where to Get Skills Safely in 2026

Why Picking a Skills Marketplace Is Riskier Than It Looks

A skill isn't a plugin. It's a file of instructions your agent follows, and that file can read your environment, run commands, and reach the network. Anthropic's own guidance is blunt here: install skills only from trusted sources, and audit anything else before you use it.

That's the part most buyers miss. Published research cited across the marketplace comparisons found roughly 26% of skills carry at least one vulnerability, and the danger is structural rather than accidental: malicious skills can direct an agent to exfiltrate data or take unintended actions. A skill that verifies GitHub webhook signatures is auditable in an afternoon. A "full-stack superpower" pack is not.

Catalogue numbers make this worse, because they don't measure the same thing. Vercel's skills.sh advertises 600,000 open-source skills; SkillsMP claims 425,000+. Those are crawled GitHub indexes, not curated catalogues, and one marketplace's own comparison admits every size figure should be read "as a measure of how much exists rather than how much is good." A filter like "at least two GitHub stars" is a popularity threshold, not a review.

Then there's the missing evidence. No marketplace publishes a benchmark showing a skill improves output. There's no shared test set, no before-and-after, and install counts measure curiosity rather than results. So a bigger marketplace isn't automatically a safer one:

• Size reflects how much got indexed, not how much was vetted.
• Ratings and stars track bookmarks and curiosity, not measured improvement.
• Curation depth varies wildly, from hand-maintained catalogues of a few hundred skills to unvetted crawls of hundreds of thousands.
• Licensing is often per-folder or absent entirely, so "what licence is this" has no repo-wide answer.

SkillzBench exists because of that gap. Its free directory pins every skill version to a commit SHA, security-scans and quality-judges each one, then tests it in a sandbox with the same model, with and without the skill, and publishes the Lift in percentage points. Trust scores stay separate from Lift, and money never touches either.

The 2026 Marketplace Landscape: Who Ships What

In early June 2026, three vendors shipped skills-marketplace features within 72 hours: Vercel's skills.sh API hit GA on June 5, Cline shipped CLI 3.0.16 on June 3, and Anthropic launched Managed Agents at Code with Claude Tokyo. As one industry writeup put it, "the marketplace era is real." Knowing who ships what, and how each one vets (or doesn't vet) what it sells, is now a core skill in itself.

Here's the lay of the land, roughly ordered by trust posture.

• Anthropic's official repo (anthropics/skills): free, first-party, 17 worked examples, and the reference implementation of the standard Anthropic published in December 2025. The official guidance is blunt: install only from trusted sources, and audit anything else before use.
• Vercel skills.sh: free, with roughly 600,000 open-source skills at GA and 1.43M+ total installs on its leaderboard. It's a crawled index at scale, targeting 20+ agents including Claude Code, Cursor, and Gemini.
• SkillsMP and LobeHub: large catalogues (425,000+ and 169,000+, labeled as estimates) built by crawling GitHub. Big numbers here reflect how much exists, not how much is good.
• Agensi: 6,000+ skills, free plus $5–$19 one-time paid tiers, and notably the only marketplace in one detailed comparison with a published automated security scan covering prompt injection, credential exfiltration, destructive shell commands, and unexpected network calls.
• Paid, curated stores: KissMySkills ($19/skill, 2,000+ skills) and Claude Protocol ($3.99/skill, 501 hand-maintained skills) trade catalogue size for curation. claudeskills.info and ComposioHQ's awesome-claude-skills round out the free end.

Two things matter more than catalogue size. First, most big numbers are crawled indexes; a filter like "at least two GitHub stars" is a popularity threshold, not a review. Second, no marketplace in this comparison publishes benchmarks proving a skill actually improves output. Install counts measure curiosity.

That gap is exactly what SkillzBench was built to close. Its free directory continuously crawls and dedupes skills from GitHub, pins every version to a commit SHA, runs security scans and license checks, and benchmarks each skill in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points. Everything, including the free MCP connector, costs nothing; revenue comes from blog ads, never from scores.

The practical takeaway: start with official and vendor-scoped skills, treat large indexes as search engines rather than vetted catalogs, and favor any source that shows its verification work.

Trust Signals That Actually Matter (and the Ones That Don't)

Not every signal on a skill's listing page tells you what you think it does. Some are genuinely useful; others measure popularity, curiosity, or nothing at all. Knowing the difference is the single cheapest safety upgrade you can make.

GitHub stars are the classic example of a weak proxy. As one directory analysis puts it, a star count records how many people bookmarked a repository, not how many ran it twice. Stars can spike for reasons unrelated to quality: the /bro skill, a seven-line SKILL.md that restates the agent's last message in plain language, drew roughly 100,000 people's attention on Hacker News. Virality is not vetting.

Vendor-scoped skills carry stronger trust, and the reason is structural. According to practitioner guidance, official repos from Anthropic, Vercel, Supabase, Sentry, Cloudflare, Trail of Bits, Qdrant, and Hookdeck are more trustworthy because they're tied to the tools the skills teach. A Supabase skill written by Supabase has a reputation to protect. A random "full-stack superpower" skill does not.

Licensing is quieter but matters in practice. Research on the ecosystem found that Anthropic's own repo has no root LICENSE file; licensing is per-folder, and several listed skills ship no license at all. If you're bringing skills into a company, "what license is this" needs an answer before installation, not after.

When in doubt, read the file yourself. Anthropic's official guidance is blunt: install skills only from trusted sources, and when installing from a less-trusted source, thoroughly audit it before use, paying particular attention to code dependencies and bundled resources like images or scripts. Malicious skills can introduce vulnerabilities or direct Claude to exfiltrate data.

A practical SKILL.md reading checklist:

• Read the description first. It's the only part Claude sees before deciding to use the skill, so vague or overbroad descriptions cause noisy triggering.
• Check what the skill touches: files, shell commands, credentials, network requests, or production services deserve extra scrutiny.
• Look for a LICENSE, and remember it may be per-folder rather than repo-wide.
• Prefer narrow scope. A skill that only handles GitHub webhook signature verification is easier to audit than one that claims to improve everything.

For teams, the guidance converges on the same pattern: create an allowlist, pin versions, and test new skills in a low-risk repo before production. SkillzBench automates part of this discipline by pinning every skill version to a commit SHA, license-checking, and security-scanning before anything reaches its free directory, so the audit you'd do manually starts already half-done.

The Hidden Cost of Skills: Always-On vs. Per-Use Tokens

Every skill you install pays rent twice, and most marketplace comparisons only show you one of the bills. The first charge is the always-on cost: the description Claude reads in every single session before deciding whether the skill is relevant. The second is the per-use cost: the full instruction body loaded the moment the skill fires.

Measured token costs make the gap concrete, per a detailed 2026 cost analysis of popular Claude Code skills. A lightweight skill like frontend-design sits at roughly 50 tokens always-on and about 2,300 when it fires. skill-creator costs roughly 80 tokens to carry but balloons to about 8,200 on invocation. Superpowers carries about 550 tokens always-on plus roughly 750 injected at startup, then 700 to 8,000 per skill used.

Then there's gstack, the clearest argument for selectivity. The full pack of roughly 60 skills costs about 1,300 tokens always-on, which sounds cheap until you see per-skill firing costs from 3,000 to 33,000 tokens. Invoke three gstack skills in one session and you can add around 50,000 tokens to your context.

That's why the analysis concludes gstack is excellent and expensive, so you take the three commands you need and turn the rest off. Claude Code caps its skill listing at 1,536 characters per entry with a total budget of 1% of the context window, and trims least-used descriptions when you exceed it. Override options ("off", "name-only", "user-invocable-only") let you keep a pack installed without paying its full freight.

Use this as a practical filter when a marketplace bundles dozens of skills into one listing:

• Check both columns before installing: a cheap description with a huge body is a skill that stays quiet until it's expensive.
• Treat vague or overbroad descriptions as a warning, since the description alone controls when Claude triggers the skill.
• For large packs, install selectively and disable what you don't use rather than carrying everything.
• Test in a low-risk repo first, and pin versions when you can.

The same discipline applies to safety. Anthropic's own guidance is to install skills only from trusted sources and audit anything less trusted before use. On SkillzBench, every skill is pinned to a commit SHA, security-scanned, and benchmarked in a sandbox so you can see measured Lift before you pay either token bill.

A Practical Workflow for Installing Skills Safely

Installing a skill means handing an agent a file of instructions it will follow, and that agent may be able to read your files, run commands, and fetch URLs. So treat every skill as an untrusted dependency, and work through a repeatable process rather than trusting a recommendation or a star count.

Start with sources that carry real trust signals. Anthropic's official guidance is to install skills only from trusted sources and audit anything less trusted before use. In practice that means official repos and vendor-scoped skills from names like Vercel, Supabase, Sentry, Cloudflare, Trail of Bits, Qdrant, and Hookdeck, which are tied to the tools the skills teach. Be skeptical of huge catalogue numbers: large marketplaces often reflect crawled GitHub indexes full of weekend experiments, while a 501-skill hand-curated catalogue may be the safer bet.

Read the SKILL.md before you install anything. The description is the only part of a skill Claude sees before deciding to use it, so a vague or overbroad description causes noisy triggering, and a narrow skill (say, one that only handles GitHub webhook signature verification) is far easier to audit than a vague "full-stack superpower" skill. While you're in the file, watch for the riskiest behaviors: skills that touch files, shell commands, credentials, network requests, deployment systems, or production services. Red flags include wildcard Bash(*) grants and curl piped straight into a shell.

Pin versions and test before production. For teams, the advice from practitioners is blunt: create an allowlist, pin versions when possible, and test new skills in a low-risk repo before they touch production code. Rotating any credentials a skill touches adds another layer of protection.

• Install from official or vendor-scoped sources first.
• Read the SKILL.md description and body, watching for shell, credential, and network behavior.
• Pin the skill to a specific version or commit.
• Test in a low-risk repo, never on production code.
• Maintain a team allowlist so unvetted skills never ship.

One gap makes this harder than it should be: no marketplace publishes benchmarks proving a skill actually improves output, so install counts measure curiosity rather than quality. That's where SkillzBench fits into the workflow. It's a free directory that crawls and dedupes skills from GitHub, pins every version to a commit SHA, runs security scans and license checks, and publishes a trust score from 0 to 100 alongside an independent Lift benchmark that shows each skill's measured improvement in percentage points, tested with and without the skill in a sandbox. Its free MCP connector lets you toggle skills into a per-agent loadout, so an agent only sees what you've chosen. Check the trust score and Lift results there before a skill ever reaches your production repo.