AI coding agents like Claude Code, Codex, Cursor and Gemini CLI are only as good as the instructions they follow. That is where skills come in, and in 2026 they have become one of the fastest-growing corners of GitHub, with single repositories collecting hundreds of thousands of stars.
But a skill is also something your agent obeys and code it runs on your computer. So before recommending any, we cloned and scanned the most popular ones. Here is what we found.
What is an AI agent skill?
A skill is a folder with a SKILL.md file inside: a short description, then instructions, and sometimes helper scripts or reference files. Your agent reads only the description until a task matches, then loads the full instructions. Install a design skill and your agent starts following real design rules; install a testing skill and it writes tests first.
The format is an open standard, so the same skill folder usually works in Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot and many other agents. Plugins go one step further and bundle skills with commands, subagents and hooks.
Why scanning skills matters
A skill is not just text. It can contain scripts your agent runs with your permissions, and plugins can install hooks that run automatically on every action. A malicious skill could hide instructions in invisible characters, tell the agent to read your SSH keys, or quietly send data to an outside server.
So every repository below went through two checks:
- Our standard GitHub scan: secrets, suspicious code patterns, install scripts, committed binaries, GitHub workflows and known vulnerabilities in dependencies.
- A skill-specific pass: invisible Unicode, prompt-injection phrases, data-sending hosts, references to credential files, download-and-run commands, and every plugin hook, which we then read by hand.
The result: none of the 13 contained malware, hidden instructions or credential theft. Some come with notes worth knowing, listed below. One popular repository, OpenAI's skills catalog, passed the scan but was left out because it has been deprecated in favour of OpenAI's plugins.
Best skills for coding
1. Matt Pocock Skills
The most-starred skills repository on GitHub, at about 281,000 stars. Matt Pocock's personal set of short skills for planning, testing and reviewing code, led by /grill-me, which makes the agent interview you until every open question about a change is settled. Scan: nothing to warn about. Read the full scan
2. Superpowers
A complete workflow for coding agents: brainstorm, plan, write tests first, then implement in small reviewed steps. It is one of the most popular plugins in Anthropic's official marketplace. Read the full scan
3. Anthropic Agent Skills
Anthropic's own public skill library, including the Word, PDF, PowerPoint and Excel skills Claude uses itself, plus a skill-creator for writing your own. Scan: nothing to warn about. Read the full scan
4. wshobson/agents
A catalogue of 92 plugins covering hundreds of specialist subagents, skills and commands, from Python development to Kubernetes, for Claude Code, Codex, Cursor and more. Note: two optional plugins run a third-party npm package on every tool call. Read the full scan
5. Vercel Agent Skills
Vercel's React and Next.js performance rules, web design guidelines and deploy skills. Note: the deploy skill uploads your project to Vercel, so keep secrets out of the folder, and the repository has no licence file. Read the full scan
6. Trail of Bits Skills
Security auditing skills from a professional security firm: static analysis with Semgrep and CodeQL, fuzzing, YARA rules and code review the way auditors do it. Note: share-alike licence, and two plugins change how the agent calls curl and pip. Read the full scan
Best skills for design and marketing
7. UI UX Pro Max
Gives your agent a searchable library of UI styles, colour palettes, font pairings and UX rules, so it stops guessing at design. About 134,000 stars. Note: a demo gallery site in the repository uses an outdated Next.js; the skill itself does not use it. Read the full scan
8. Marketing Skills
About 50 skills for conversion optimisation, copywriting, SEO, ads, analytics and growth, from conversion consultant Corey Haines. Note: some tool mentions come from disclosed paid partners. Read the full scan
Best skills for science and machine learning
9. Scientific Agent Skills
177 skills that teach agents scientific packages and databases, from single-cell genomics and drug discovery to lab automation. Note: skills send queries to public science APIs, and it is big, so install only what you need. Read the full scan
10. Hugging Face Skills
Hugging Face's official skills for finding models, preparing datasets, fine-tuning on cloud GPUs and publishing demos. Scan: nothing to warn about, though training jobs bill your Hugging Face account. Read the full scan
Directories and installers
11. Claude Plugins Official
Anthropic's curated plugin directory and the default marketplace in Claude Code. Note: some plugins run hooks automatically, and the external plugins are made by third parties, not Anthropic. Read the full scan
12. Vercel Skills CLI
The npx skills command that installs skills from GitHub into dozens of agents in one step; many repositories on this list use it. Note: it sends anonymous telemetry unless you set DISABLE_TELEMETRY=1. Read the full scan
13. Claude Skills by Alireza Rezvani
A huge community library of about 380 skills for engineering, marketing, product, finance and leadership work. Note: mostly one person's work and quality varies, so pick the few you need. Read the full scan
How to install skills safely
Even with a clean scan, a few habits keep you safe with any skill, from this list or anywhere else:
- Install only what you need. Every skill adds to what your agent reads, and fewer skills means fewer surprises.
- Read the SKILL.md and any scripts first. They are short. If a skill asks the agent to read files outside your project or send data somewhere, do not install it.
- Check for hooks. A hooks.json file means code that runs automatically. Know what it does before you install the plugin.
- Prefer known publishers and active repositories. Recent commits, many contributors and a clear licence are good signs.
- Be careful with download-and-run commands. If a skill tells you to pipe a script from the internet into your shell, read the script first.
Browse every scanned repository, from local AI models to automation tools, in our GitHub Tools section.
FAQ
Are AI agent skills free?
All 13 repositories here are free to use. You still need an AI agent to run them, such as Claude Code, Codex or Cursor, under that product's own pricing.
Do skills work outside Claude Code?
Usually, yes. Skills follow an open format, and installers like npx skills can put the same skill into Codex, Cursor, Gemini CLI, GitHub Copilot and many other agents. A few skills depend on features of a specific agent.
Can a skill be dangerous?
It can. A skill is instructions your agent follows and scripts it may run with your permissions, and plugins can run hooks automatically. That is why we scan each repository and why you should read a skill before installing it.