Where Do Skills Live? Folder Paths for Claude Code, Cursor, Codex and Gemini CLI

The Folder Problem: Why Skill Location Matters More Than You Think

You think you installed a skill, but your agent can't find it. That disconnect stems from a simple truth: every coding agent looks in different folders, and nothing syncs automatically.

A skill is just a folder on your disk. It contains a SKILL.md file, scripts, and resources. Anthropic defines these as organized folders that agents load dynamically to perform specific tasks. The format was introduced publicly in October 2025 and formalized as an open standard on December 18, 2025. This standardization aims to make skills portable across platforms.

However, portability on paper doesn't mean portability in practice. Claude Code stores personal skills in ~/.claude/skills/ and project skills in .claude/skills/. Crucially, these custom skills do not sync across surfaces. If you use claude.ai, the API, and Claude Code, you must manage them separately.

Cursor takes a different approach to reduce friction. It reads from four native paths: .agents/skills/, .cursor/skills/, ~/.agents/skills/, and ~/.cursor/skills/. To help with interoperability, Cursor also loads skills from Claude and Codex directories. This means a skill placed in Claude's standard location can be discovered by Cursor without modification.

Knowing these exact paths is your first step toward control. If you don't know where a skill lives, you can't audit it. This matters because the ecosystem has security gaps. A recent academic analysis of 31,132 skills found that 26.1% contain at least one vulnerability. Skills that bundle executable scripts are 2.12 times more likely to contain vulnerabilities than instruction-only skills.

The loading process uses progressive disclosure to manage context. At startup, the agent loads only metadata, costing about 100 tokens per skill. When a skill is triggered, the agent loads the full SKILL.md body. Additional resources load only as needed. This design keeps your context window efficient.

Here is where the confusion often lives for developers:

• Claude Code does not sync skills between cloud and local environments.
• Cursor only syncs `~/.cursor/skills/` to Cloud Agents, not local project skills.
• Codex and Gemini CLI paths are not explicitly documented in current public sources.
• Skills execute with implicit trust, creating a significant attack surface if unvetted.

You need to document your skill paths by agent before deploying anything. For Codex and Gemini CLI, consult official vendor documentation directly, as current research lacks confirmed paths. If you are building a stack with multiple agents, leverage Cursor's cross-compatibility to reduce duplication. Place skills in shared Claude Code paths where possible.

Security vetting is an urgent unmet need. Skills execute with minimal vetting, which is risky. Anthropic warns that malicious skills could introduce vulnerabilities or direct data exfiltration. You must audit bundled files, code dependencies, and any instructions connecting to untrusted network sources.

SkillzBench addresses this gap by continuously crawling and deduping skills from GitHub. The platform pins every version to a commit SHA and validates security, license, and quality. It benchmarks every skill in a sandbox to measure the actual Lift in percentage points. This free directory helps you verify what you are loading before you trust it.

The Confirmed Paths: Claude Code and Cursor, Documented

You don't need to guess where your AI agent looks for instructions. The folder structure determines whether your custom skills load at all.

Anthropic’s official documentation confirms that Claude Code relies on a simple, filesystem-based approach. You place personal skills in ~/.claude/skills/ and project-specific ones in .claude/skills/. This setup requires no API uploads or complex configuration. It just works locally.

However, there is a critical deployment detail often missed. Custom Skills do not sync across surfaces. If you manage skills for claude.ai, the API, and the CLI, you must install them separately in each environment. There is no automatic mirroring. This fragmentation means you need a clear strategy for version control if you use multiple Claude interfaces.

Cursor takes a different approach by supporting four native paths: .agents/skills/, .cursor/skills/, ~/.agents/skills/, and ~/.cursor/skills/. This flexibility allows you to organize skills by scope, from global user preferences to specific repository needs.

The real power lies in Cursor’s cross-compatibility. According to Cursor’s documentation, the tool also loads skills directly from Claude and Codex directories. Specifically, it reads from .claude/skills/, .codex/skills/, ~/.claude/skills/, and ~/.codex/skills/. This means a skill you install for Claude Code is immediately discoverable by Cursor without any modification.

This interoperability is a significant efficiency gain for teams using multiple agents. You can maintain a single source of truth in a shared path, such as ~/.claude/skills/. Both agents will find it. This reduces duplication and simplifies updates.

When managing these paths, consider the security implications. A recent academic analysis of over 31,000 skills found that 26.1% contain at least one vulnerability. Knowing exactly where these files live on your disk is the first step toward auditing them. If a skill bundles executable scripts, the risk is even higher. Those scripts are 2.12 times more likely to contain vulnerabilities than instruction-only skills.

Here is how to set up your environment for maximum compatibility and safety:

• Use `~/.claude/skills/` for personal skills to ensure both Claude Code and Cursor can access them without conflict.
• Keep project skills in `.claude/skills/` if you want them tied to a specific repository version control.
• Audit every skill before installation, especially those containing scripts or external network calls.

SkillzBench helps you navigate this complexity. Our free directory verifies skills by pinning versions to commit SHAs and running security scans. We also benchmark performance to show you the actual lift a skill provides. Knowing where a skill lives is only half the battle; knowing if it’s safe and effective is the other.

For cloud and remote execution, note that only ~/.cursor/skills/ syncs to Cursor Cloud Agents. Project skills and ~/.agents/skills/ remain local. If you use self-hosted workers, you must bake skills into the worker image or use repo project skills. This distinction matters if your workflow involves distributed computing.

The open standard for Agent Skills, published by Anthropic, aims to unify this experience. But until every tool supports every path, you must be deliberate. Check your specific agent’s documentation. Verify the paths. Then deploy with confidence.

Codex, Gemini CLI and the Cloud: Where Documentation Runs Out

Here's where the documentation trail goes cold. For Claude Code and Cursor, we have official paths straight from the vendors. For Codex and Gemini CLI, we're largely reading tea leaves.

The honest answer first: no official source we could find confirms where Codex stores its skills. What we do have is Cursor's word. According to Cursor's documentation, Cursor loads skills from .codex/skills/ and ~/.codex/skills/ for compatibility, which strongly suggests those are Codex's directories. But that's Cursor documenting its own compatibility layer, not OpenAI documenting its product. A technical guide to the Agent Skills standard confirms Codex supports the format, yet stops short of naming install paths. Gemini CLI is worse: it appears in none of our sources at all. If you're deploying to those tools, check the vendor's own docs before trusting any blog post, this one included.

The remote execution picture is clearer, and it has real gotchas. Only ~/.cursor/skills/ syncs to Cursor Cloud Agents, and you have to enable it via Settings → Agents → "Sync Skills for Cloud Agents." Cursor does not copy ~/.agents/skills/ or unsynced local skills to Cloud Agents, remote SSH sessions, or self-hosted workers. If your skills live in the wrong folder, your cloud agent simply won't see them, and nothing will tell you why.

For remote and self-hosted setups, your options narrow to two:

• Use repo-level project skills, which travel with your code wherever it's checked out
• Bake skills directly into your self-hosted worker image
• For Cursor Cloud Agents specifically, keep skills in `~/.cursor/skills/` and enable syncing

This matters more than it sounds, because skills aren't inert text files. Research analyzing 31,132 community skills found 26.1% carry at least one vulnerability, and skills bundling executable scripts are 2.12× more likely to be vulnerable than instruction-only ones, per that same academic analysis. A skill you can't locate on disk is a skill you can't audit.

That's the practical case for keeping your skill inventory in one place you control. SkillzBench's free directory pins every skill to a commit SHA and security-scans each version, so you know exactly what you're deploying before you copy it into .codex/skills/, ~/.cursor/skills/, or wherever your agent happens to look this month. The paths will keep shifting; verified skills and current vendor docs are your safest anchors.

Before You Drop Files in a Folder: The Security Case for Auditing Skills

Dropping a skill into the right folder is easy. Knowing whether that skill is safe to run is the part most people skip, and the data says skipping it is a gamble.

A large academic analysis scanned 31,132 community skills and found that 26.1% contain at least one vulnerability. Worse, 5.2% showed high-severity patterns the researchers described as strongly suggesting malicious intent. Skills execute with implicit trust and minimal vetting, which makes them a quiet but real attack surface on your machine.

The risk isn't evenly distributed. Skills that bundle executable scripts alongside their SKILL.md instructions are 2.12 times more likely to contain vulnerabilities than instruction-only skills. That statistic should change how you read a skill folder: the markdown file is usually fine, the scripts directory is where you look first. Anthropic's own security guidance says the same thing, warning that malicious skills could introduce vulnerabilities or direct data exfiltration, and recommending you audit bundled files, dependencies, and any instructions that connect to untrusted network sources.

Path literacy makes this audit practical. When you know a skill lives in .claude/skills/ or ~/.cursor/skills/, you know exactly where to open the files and read them. And because of progressive disclosure, the blast radius is bigger than it looks: each installed skill costs roughly 100 tokens per skill at startup, meaning every skill you drop in is loaded into your agent's awareness whether you're using it that day or not. A crowded skills folder is a crowded attack surface.

It also helps to understand what skills actually are. As the Goose team at Block put it, MCP gives agents abilities while skills teach agents how to use those abilities well. Skills are local instruction files; they're not sandboxed services. That's precisely why a malicious instruction package can steer an agent toward harmful actions without any obvious code running.

A few habits make folder-level auditing manageable:

• Open the SKILL.md and read the full instructions before installing, not just the description.
• Check the scripts folder first. Script-bundling skills carry more than double the vulnerability risk.
• Look for instructions that connect to external URLs or ask the agent to send data anywhere.
• Pin the version you installed so you can spot when upstream content silently changes.

Reading every skill by hand doesn't scale, though. That's the gap SkillzBench fills: a free directory that security-scans and version-pins skills from GitHub, publishes trust scores, and runs each skill in a sandbox to benchmark its Lift against the same model without it. Its free MCP connector lets you build a per-agent loadout, so your agent only ever sees the vetted skills you explicitly chose. The folder path is still where the skill lives; the audit is just done before it gets there.

Your Setup Checklist: A Practical Path Plan

You've mapped the paths; now turn that knowledge into a setup you can actually maintain. A little planning up front saves you from installing the same skill five times and from wondering why an agent "forgot" a skill you know exists.

Start by writing down where each agent looks. Claude Code reads personal skills from ~/.claude/skills/ and project skills from .claude/skills/, according to Anthropic's official docs. Cursor checks four native directories (.agents/skills/, .cursor/skills/, ~/.agents/skills/, ~/.cursor/skills/) plus Claude and Codex locations for compatibility, per Cursor's documentation. For Codex and Gemini CLI, check the vendor docs, since reliable published paths are thin on the ground right now.

Here's your practical plan:

• Map each agent to its paths before installing anything, so you know exactly what each tool can see.
• Use shared directories to avoid duplication. Since Cursor loads skills from `.claude/skills/` and `~/.codex/skills/`, one well-placed skill can serve two agents.
• Keep personal skills (things you want everywhere) separate from project skills (things a specific repo needs).
• Remember what syncs and what doesn't. Claude Code skills don't sync across claude.ai, the API, and Claude Code. In Cursor, only `~/.cursor/skills/` syncs to Cloud Agents, so remote work needs project-level paths or baked-in images.
• Audit anything with bundled scripts before it touches your machine.

That last point deserves emphasis. A study of 31,132 community skills found 26.1% carry at least one vulnerability, and skills bundling executable scripts are 2.12× more likely to be vulnerable than instruction-only ones. Anthropic's own guidance warns that malicious skills could introduce vulnerabilities or direct data exfiltration, so review bundled files, dependencies, and any instructions pointing at untrusted network sources.

If auditing every skill by hand sounds tedious, that's exactly what SkillzBench automates: every skill in the free directory is pinned to a commit SHA, security-scanned, and benchmarked with the same model, with and without the skill, so you can see the Lift before you install. You can also build per-agent loadouts and connect them through the free MCP server, giving each agent only the skills you've vetted for it.

Browse verified, benchmarked skills on skillzbench.com and start building your per-agent loadouts today. Everything on the platform, including the MCP connector and benchmark results, is free.