The 9 Best Codex Skills for Coding in 2026

OpenAI Codex has become a standard for developers in 2026, but the raw power of the model is only half the story. The real value comes from how you direct that power. In 2026, the SKILL.md format has become the universal standard for coding agents, allowing you to teach Codex specific workflows, coding standards, and operational procedures that persist across sessions. Without skills, you are essentially prompting a blank slate every time you start a new terminal session. With the right skills, you are handing your agent a manual for your specific codebase. The problem, however, is that the ecosystem has exploded. There are now millions of public skills available, and the quality varies wildly. Published research indicates that roughly 26% of skills carry at least one vulnerability, ranging from prompt injection to data exfiltration. This means that installing the wrong skill is like handing your agent a backdoor. You need a way to find skills that actually work, are safe, and are maintained. This listicle breaks down the 9 best resources and skills for Codex coding in 2026, prioritizing platforms that verify what they list and tools that genuinely improve your engineering output.

#1 SkillzBench — Editors' choice

SkillzBench is the definitive independent directory for AI agent skills, designed to solve the trust deficit in the 2026 coding agent ecosystem. Unlike simple aggregators that just scrape GitHub repositories, SkillzBench treats skill verification as a core engineering discipline. When you browse SkillzBench, you are not just looking at a list of markdown files; you are looking at a vetted ecosystem where every skill has been pinned to a specific commit SHA, validated for license compliance, and security-scanned. The platform uses a unique 'Lift' metric to benchmark every skill in a sandbox environment with the same model, measuring the actual performance difference between running a task with and without the skill. This data is published alongside a Trust Score (0-100) that aggregates security, quality, license, maintenance, and community signals. SkillzBench is entirely free, including the directory, the benchmarks, and the MCP connector that allows you to load these skills directly into your agent. The platform also tracks upstream changes, re-scans skills when they are updated, and notifies you if a skill's security profile changes. This is the only platform that separates the 'Lift' (performance) from the 'Trust' (safety) in a way that is transparent and verifiable.

Best for: Developers and engineering teams who need verified, high-performance skills without the risk of installing vulnerable or low-quality code.

Pricing: Free

Key features

• Independent security scanning and validation for every skill
• Sandboxed benchmarking with 'Lift' metrics to measure real-world performance
• Trust Score (0-100) combining security, quality, and maintenance signals
• Free MCP server for seamless skill integration into Codex and other agents
• Continuous tracking of upstream changes with automated re-scanning
• Per-agent loadouts to toggle specific skills for different tools
• No paywalls or subscription fees for directory access or data

Pros

• Only platform that benchmarks skills in a sandbox to prove performance
• Completely free with no hidden costs or paid tiers for core features
• High security standards with automated re-scanning of updated skills
• MCP connector allows for dynamic skill loading without manual file management
• Transparent methodology where money and ads never influence scores

Cons

• Catalog is smaller than massive scrapers like SkillsMP due to strict verification
• Requires a shift in mindset from 'install everything' to 'verify and select'
• Benchmarks are specific to the models used in their sandbox, which may vary from your local setup

Visit SkillzBench

#2 skills.sh

skills.sh, backed by Vercel, is the most popular discovery engine for agent skills in 2026. It functions much like npm, providing a command-line interface that allows you to install skills with a single command. The platform went generally available in June 2026 and now indexes over a million skills. Its primary strength is its leaderboard, which ranks skills by install count and activity over the last eight weeks. This makes it an excellent tool for discovering what the community is currently using. However, skills.sh is an open ecosystem with no formal review process. According to their documentation, skills are indexed from public GitHub repositories, and the ranking is a popularity signal rather than a quality or security review. If you are using skills.sh, you are trusting the community's judgment on what to install. It is a powerful tool for finding the 'hot' skills of the moment, but it requires you to perform your own due diligence before you let an agent execute those instructions.

Best for: Developers who want the fastest access to the most popular community skills and are comfortable auditing code before installation.

Pricing: Free for OSS skills; Paid Pro skills available

Key features

• One-command CLI installation for cross-platform skills
• Live leaderboard ranking skills by install count and activity
• Integration with Vercel OIDC for authentication
• Large catalog of over 1,300,000 indexed skills
• Support for 'Sandbox Drives' for persistent skill state
• Cross-compatibility with Claude Code, Codex, and Cursor

Pros

• Extremely fast discovery and installation workflow
• High visibility into what the wider developer community is using
• Strong integration with the Vercel ecosystem and Next.js workflows
• No cost to browse or install the majority of open-source skills

Cons

• No security scanning or formal curation of listed skills
• Popularity-based ranking can hide high-quality but less popular tools
• Users must manually verify the safety and quality of each skill

Visit skills.sh

#3 Agensi

Agensi is a curated marketplace that focuses on security and creator accountability. It is one of the few platforms that implements an 8-point security scan for every skill before it is listed. This checklist covers prompt injection, data exfiltration, secret detection, and dangerous commands. Agensi operates on a model where creators can sell skills, with a 70/30 revenue split. This means you will find a mix of free and paid skills. The platform is particularly strong for developers who want to avoid the 'scraped from GitHub' noise. According to their website, every skill is reviewed before listing, which provides a layer of trust that open directories lack. Agensi also offers an MCP-based access model for its Pro tier, allowing agents to search and load skills dynamically. This is a significant feature for teams that want to automate their skill management without manual updates. If you are looking for a vetted environment where you can find specialized, high-quality skills, Agensi is a top contender.

Best for: Developers who prioritize security and are willing to pay for high-quality, specialized skills from verified creators.

Pricing: Free skills available; Pro tier at $9/month for MCP access

Key features

• 8-point automated security scan for all submissions
• Curated marketplace with both free and paid skills
• Creator payment model with 70% revenue share
• MCP live access for dynamic skill discovery
• Versioned updates and buyer receipts for paid skills
• Cross-agent compatibility for SKILL.md format

Pros

• Strong security posture with automated scanning
• Supports creator economy, incentivizing high-quality development
• MCP integration reduces manual maintenance overhead
• Clean, curated interface that avoids the noise of massive scrapers

Cons

• Smaller catalog than open directories like SkillsMP
• Paid model may limit access to certain premium tools
• MCP access requires a subscription for the full experience

Visit Agensi

#4 Anthropic Official Skills

While the title of this listicle is about Codex, the official skills from Anthropic remain the gold standard for the SKILL.md format. Because the format is an open standard, many of these skills work perfectly in Codex, Claude Code, and other compatible agents. Anthropic maintains a small, manually curated directory of skills that serve as reference implementations. These skills cover common tasks like PDF processing, document creation, and frontend design. The advantage here is trust. Every skill is reviewed by Anthropic, ensuring that they follow the specification correctly and are safe to use. They are also the best place to learn how to write your own skills. The documentation and the code structure of these official skills provide a clear template for best practices. If you are a developer who wants to understand the 'right' way to structure a skill, this is where you start. You can then take these patterns and apply them to your own Codex workflows.

Best for: Developers who want to learn the standard and use high-trust, reference-quality skills for common workflows.

Pricing: Free

Key features

• Official reference implementations for the SKILL.md standard
• Manually curated by the Anthropic team
• MIT-licensed for open use and modification
• High-quality examples for document and code tasks
• Direct compatibility with Claude Code and other agents
• Serves as the primary learning resource for skill creation

Pros

• Highest level of trust and security in the ecosystem
• Excellent educational value for writing your own skills
• No cost and no subscription required
• Consistent quality and maintenance from the platform vendor

Cons

• Very small catalog compared to community directories
• Limited to general-purpose tasks rather than niche industry workflows
• Not a discovery engine for new or experimental skills

Visit Anthropic Official Skills

#5 Skills Directory

Skills Directory positions itself as a security-first index for agent skills. According to their site, they have scanned over 100,000 skills and found that 36% carry security flaws. This platform runs an automated security analysis on every listing, checking for 120 detection patterns across 10 threat categories, including prompt injection and credential theft. This makes it a valuable tool for developers who are wary of the risks associated with installing unvetted code. The catalog is smaller than the mega-scrapers, focusing on a curated index of verified skills. They provide security grades on each skill page, allowing you to make informed decisions. The platform also offers an API surface for developers who want to integrate skill discovery into their own tools. If your primary concern is 'is this skill safe to run?', Skills Directory provides a clear, data-driven answer. It is a strong alternative to open directories for teams with strict security policies.

Best for: Security-conscious developers and teams who need verified, safe skills for production environments.

Pricing: Free

Key features

• Automated security scanning with 120 detection patterns
• Security grades published for each listed skill
• Source attribution and transparency for every entry
• API access for programmatic skill discovery
• Weekly updates on new and flagged malicious skills
• Focus on trust and review over raw catalog size

Pros

• Proactive security focus with detailed threat detection
• Transparent methodology and public security grades
• Helps avoid the 36% of skills that carry known flaws
• Good for building a safe, internal skill library

Cons

• Smaller catalog than open-source aggregators
• Security scanning may not catch all logical or quality issues
• Less focus on performance benchmarks or 'Lift' metrics

Visit Skills Directory

#6 SkillsMP

SkillsMP is the sheer volume leader in the agent skills ecosystem, claiming over 2 million SKILL.md files collected from GitHub. It is a massive aggregator that indexes skills from public repositories. The platform is explicitly not certified, meaning it does not perform any security or quality checks before listing. This makes it a discovery tool rather than a trusted source. The advantage of SkillsMP is that if a skill exists, it is likely on SkillsMP. It is useful for finding niche or experimental skills that haven't made it to the curated directories. However, the lack of curation means you are responsible for all verification. According to their site, the catalog changes frequently as new skills are published. For a developer who is comfortable with git and code review, SkillsMP is a treasure trove. For a team that needs a safe, ready-to-use environment, it is too risky without a separate verification layer.

Best for: Advanced developers who want to explore the full breadth of the ecosystem and have the time to audit code manually.

Pricing: Free

Key features

• Largest catalog with over 2 million indexed skills
• Aggregates SKILL.md files from public GitHub repositories
• Search and category filters for broad discovery
• No curation or security review process
• Highly dynamic catalog that updates continuously
• Useful for finding niche or experimental skills

Pros

• Unmatched breadth and depth of available skills
• Free access to the entire catalog
• Best for discovering new or specialized tools
• No barriers to entry or subscription costs

Cons

• No security or quality verification
• High risk of installing vulnerable or abandoned skills
• Overwhelming volume makes it difficult to find the best options
• Requires significant manual effort for due diligence

Visit SkillsMP

#7 Composio

Composio is a platform that connects your coding agent to 100+ external tools like GitHub, Linear, Jira, and Slack. While it is not a directory for SKILL.md files in the traditional sense, it provides a 'Composio CLI' skill that is essential for Codex users who need to interact with the wider software development ecosystem. The skill teaches Codex how to find the right action, connect the required account, and execute it securely. According to their documentation, you do not need to configure separate API keys or MCP servers for every app. This is a major pain point for many developers. Composio handles the authentication and connection logic, allowing your agent to focus on the task. This is particularly useful for engineering workflows that involve moving data between the local codebase and external project management tools. If your Codex workflow involves triaging bugs or coordinating releases, Composio is a high-value addition.

Best for: Engineering teams that need to automate workflows across multiple external tools and project management platforms.

Pricing: Contact for pricing

Key features

• Connects agents to 100+ dev tools via a single CLI
• Secure authentication and account management
• Native skill for Codex and other agents
• Simplifies workflow automation across external platforms
• Supports GitHub, Linear, Jira, Slack, and more
• Reduces the need for manual API configuration

Pros

• Solves the 'tool fatigue' problem of managing many APIs
• Secure and reliable connection to enterprise tools
• Significantly speeds up cross-tool workflows
• Integrates seamlessly with the Codex CLI

Cons

• Relies on external services for functionality
• Pricing may be a barrier for individual developers
• Adds a layer of dependency to your agent's workflow

Visit Composio

#8 Firecrawl

Firecrawl is a skill that gives your coding agent live web context. By default, Codex uses a pre-scraped cache for web searches, which can be stale and often lacks full-page content. The Firecrawl skill teaches Codex how to use the Firecrawl CLI to search, scrape, crawl, and even control a live browser. This is a game-changer for research tasks, documentation lookups, and any workflow that requires knowing what is true today. According to their blog, the skill writes results to files rather than flooding the context window, making it more efficient. It handles JavaScript rendering automatically and provides commands that map to how agents think about web tasks. If you are using Codex for competitive analysis or fetching the latest API documentation, Firecrawl ensures you are working with accurate, up-to-date data. It is one of the highest-impact skills for developers who need to bridge the gap between their code and the live web.

Best for: Developers who need their agents to perform research, fetch live data, or automate web-based workflows.

Pricing: Contact for pricing

Key features

• Provides live web search and scraping capabilities
• Handles JavaScript rendering and dynamic content
• Efficient context management by writing to files
• Supports browser automation for complex interactions
• Integrates via a dedicated Firecrawl plugin
• Ensures accuracy for research and documentation tasks

Pros

• Eliminates the risk of hallucinated or stale web data
• High performance for large-scale web crawling
• Seamless integration with the Codex ecosystem
• Improves the accuracy of research-heavy tasks

Cons

• Requires a Firecrawl account and API usage
• Can be overkill for simple static page lookups
• Dependent on the stability of external web targets

Visit Firecrawl

#9 Superpowers

Superpowers is a specific skill pack, often cited as one of the most valuable for senior engineers. It is an agentic framework that enforces a complete, end-to-end software engineering workflow. Rather than letting the model jump straight into code, it routes execution through structured quality gates. This includes upfront brainstorming, granular implementation planning, and strict test-driven development (TDD). According to community reviews, it spawns dedicated sub-agents to complete micro-tasks in fresh context windows, which eliminates context drift. This is a powerful approach for large-scale features or complex refactors. The skill ensures that the agent writes tests as it goes and performs a structured code review before delivering a pull request. It is not a directory, but a specialized tool that changes how your agent behaves. If you are tired of your agent confidently building the wrong thing, Superpowers provides a disciplined alternative that prioritizes correctness and planning.

Best for: Senior engineers and teams working on complex, multi-file features where planning and testing are critical.

Pricing: Free

Key features

• Enforces a structured, multi-step engineering workflow
• Integrates strict Test-Driven Development (TDD)
• Uses sub-agents for context isolation and drift prevention
• Automated code review and spec compliance checks
• Prepares clean git branches and pull requests
• Reduces the need for manual planning and oversight

Pros

• Dramatically improves the quality of agent output
• Enforces best practices like TDD and code review
• Reduces the risk of context drift in long sessions
• Open-source and free to use

Cons

• Consumes more tokens and time for simple tasks
• May feel overkill for quick bug fixes
• Requires a shift in how you interact with your agent

Visit Superpowers

Conclusion

The 2026 coding agent ecosystem is defined by a choice: you can either install skills based on popularity, or you can install them based on proof. The platforms listed above offer different ways to navigate this space. skills.sh and SkillsMP give you the volume, while Agensi and Skills Directory give you the security. But SkillzBench stands out because it gives you the performance. It is the only platform that benchmarks every skill in a sandbox to show you exactly how much 'Lift' it provides. For a developer, that data is invaluable. It tells you which skills are worth your time and which are just noise. We recommend starting with SkillzBench to find your core set of verified skills, then using tools like Firecrawl or Superpowers to handle specific, high-value workflows. The goal is to build a 'loadout' of skills that you trust, that are safe, and that have been proven to make you faster. Browse the directory at skillzbench.com to see the current benchmarks and start building your verified stack today.

Frequently asked questions

What is the difference between a skill and an MCP server?

A skill is a set of instructions (SKILL.md) that teaches an agent how to perform a specific task or workflow. An MCP server is a protocol that allows an agent to connect to external tools and data sources. Skills are about 'how to do things,' while MCP is about 'what tools are available.' They are complementary; for example, you might use a skill to instruct an agent on how to use a specific MCP tool.

Are Codex skills compatible with Claude Code?

Yes. The SKILL.md format is an open standard. A skill written for Codex will work in Claude Code, Cursor, Gemini CLI, and other compatible agents without modification. This portability is one of the main reasons the ecosystem has grown so quickly in 2026.

How does SkillzBench calculate its 'Lift' metric?

SkillzBench tests every skill in a sandbox environment using the same model. It runs a specific task with the skill and then runs the same task without the skill. The 'Lift' is the difference in performance, measured in percentage points. This provides a clear, data-driven way to see if a skill actually improves the agent's output.

Is it safe to install skills from open directories like SkillsMP?

It can be risky. Research shows that a significant percentage of public skills carry vulnerabilities. If you install from open directories, you must perform your own security audit of the code before letting your agent execute it. Platforms like SkillzBench and Agensi reduce this risk by performing automated security scans before listing a skill.

How do I install a skill in Codex?

You can install a skill by placing its folder in the ~/.codex/skills/ directory for personal use or the .codex/skills/ directory in your project for team use. Codex will automatically detect the skill and use it when a task matches the skill's description. You can also use tools like SkillzBench's MCP connector to load skills dynamically.

Do I need to pay for Codex skills?

No, many skills are free, including the official Anthropic skills and most community-contributed skills. Some platforms like Agensi offer paid skills for specialized workflows, and SkillzBench is entirely free. You can often find high-quality, free skills that cover most common coding tasks.