AI Skill Marketplace: Where to Find Skills for Any Agent

An AI skill marketplace is a catalog of Agent Skills: folders built around a SKILL.md file that teach an AI agent how to do one job. Because the format is now an open standard, the same skill can run in Claude Code, OpenAI Codex, GitHub Copilot, Cursor and a long list of other agents. That changes how you shop. You no longer need a separate store per tool. You need to know which catalogs are run by a vendor, which are open directories anyone can list in, and how to check a skill before it runs code on your machine.

Here's the short version:

• Vendor catalogs (Anthropic, OpenAI, GitHub, Cursor) are the safest starting points, but each is tied to its own agent's plugin system.
• Cross-agent directories like skills.sh index skills from public GitHub repos, so they're broad, and the checking falls on you.
• App marketplaces like Taku's package skills into something you run in a workspace instead of installing into an agent.
• Every source needs vetting. A skill can bundle scripts, and an agent will run them.

If you only use Claude, our narrower guide to the Claude skills marketplace covers Claude Code and claude.ai in detail. This post is about the cross-agent picture.

Quick comparison: AI skill marketplaces and directories

Two patterns stand out. Vendor catalogs ship skills inside plugins, which can also carry MCP servers, hooks and commands. Open directories ship the bare skill folder, which is simpler but comes with fewer guardrails.

What an AI skill is, and how it differs from an MCP server or an app

A skill is a folder. At minimum it holds a SKILL.md with a name, a description and instructions. It can also bundle scripts/, references/ and assets/. The Agent Skills specification says the format was originally developed by Anthropic and then released as an open standard that other agent products have adopted.

Agents load skills in stages. At startup they read only the name and description. When a task matches, they pull in the full instructions, and only then do they run any bundled code. That's why you can keep dozens of skills installed without flooding the context window.

People mix skills up with two neighbouring things:

Skills and MCP servers often work together: the skill tells the agent what to do, and the MCP server gives it the hands to do it. Our Claude skills vs MCP breakdown goes deeper on when you need which. The Model Context Protocol site is the reference for the server side.

Vendor skill catalogs

Anthropic: the skills repo and Claude Code marketplaces

Anthropic's skills repository holds its example skills and the document skills for Word, PDF, PowerPoint and Excel. It doubles as a Claude Code marketplace, and the skill folders themselves follow the open format, so you can copy one into another agent's skills directory.

Inside Claude Code, the /plugin command browses Anthropic's official catalog plus any community or third-party marketplace you add. Each plugin shows what it will install before you confirm.

OpenAI: Codex skills and plugins

Codex supports Agent Skills and says it builds on the open standard. It scans .agents/skills in your repo and your home folder, and it ships two system skills, skill-creator and skill-installer. The installer pulls curated skills by name.

One detail older tutorials get wrong: the openai/skills repo is now marked deprecated. OpenAI points to its plugins repository instead, where a plugin can bundle skills, apps and MCP servers. Plugins go out through a directory shared by ChatGPT and Codex.

GitHub Copilot and Cursor

GitHub Copilot reads Agent Skills in the Copilot CLI, the cloud agent, and agent mode in VS Code, Visual Studio and JetBrains IDEs. It looks in .github/skills, .claude/skills or .agents/skills. For a catalog, github/awesome-copilot sits under GitHub's organization but is community-maintained: its README says the contents come from third-party developers. You install from it with copilot plugin install.

Cursor supports skills too, and it reads .claude/skills and .codex/skills folders for compatibility. Cursor distributes skills through plugins: you import a GitHub repo that carries a marketplace file, or add a team marketplace.

Notice the overlap. A skill sitting in .claude/skills can be picked up by Claude Code, Copilot and Cursor without any changes. That's the practical payoff of an open format.

Cross-agent skill directories

skills.sh by Vercel

skills.sh calls itself a directory for the open agent skills ecosystem, and its footer credits Vercel. It lists more than 20 compatible agents, including Claude Code, Codex, Cursor, GitHub Copilot, Gemini, Windsurf, Cline and Zed. You install from the command line with npx skills add owner/repo.

Two features make it more useful than a plain list:

• A leaderboard. Rankings come from anonymous telemetry on which skills the skills CLI installs. Popular means installed often, not reviewed.
• Security audits. The audits page combines results from Gen Agent Trust Hub, Socket and Snyk for listed skills, with risk labels per skill. Some entries show as pending.

Its own docs are honest about the limits: Vercel says it can't guarantee the quality or security of every skill on the site, and asks you to review skills before installing. Treat an audit badge as one signal, not a clearance.

Curated GitHub lists

"Awesome" lists collect links to skills from vendor teams and the community. They're good for discovery and nothing else. A list doesn't host the files, doesn't install anything, and a link doesn't mean anyone read the scripts. Click through to the source repo and judge it there.

Taku Marketplace: run a skill instead of installing it

Every option above assumes you're comfortable in a terminal or an IDE. Plenty of people searching for an AI skill marketplace aren't. They saw a skill demo, found the repo, and stalled at the install step.

The Taku Marketplace takes a different route. It lists AI apps and skills that run inside Taku's desktop workspace. Instead of wiring a skill into your own agent config, you run a version a creator already got working, then edit it and save your own copy. Listings can be free or paid, and creators have public profiles.

To be straight about it: Taku's marketplace is early. It's one entry in this table, not a replacement for the vendor catalogs, and not every listing will fit your use case. The vetting advice below applies here too.

How to vet a third-party skill before you install it

Anthropic's Agent Skills overview recommends using skills only from trusted sources and auditing anything else. A skill is instructions plus code, and a malicious one can steer an agent into commands that don't match its stated purpose. Plugins carry more risk: Claude Code's plugin security page warns that a plugin can run arbitrary code with your user privileges.

The checklist, in order:

1. Check the publisher. A vendor catalog, a known company repo, or an anonymous account with one commit? Look at repo history and whether issues get answers.
2. Read SKILL.md end to end. It's usually short. Does the description trigger on things you'd expect? Do the instructions fetch URLs, send data out, or touch files unrelated to the task?
3. Open every script. Red flags you can spot without being a developer: calls to unfamiliar domains, reading your home directory or credential files, curl ... | sh, long encoded strings, code that clearly does more than the skill claims.
4. Check pre-approved tools. Some agents honour an allowed-tools field that lets a skill use tools without asking you. Know what it grants.
5. Watch for remote instructions. A skill that downloads its instructions at runtime can change after you reviewed it.
6. Pin versions. If the source auto-updates, the files you read today may not be the files that run next week.
7. Start narrow. Install for one project, try it on a throwaway folder, and widen scope once you trust it.

The same caution applies to the MCP servers that many plugins bundle. Our guide to MCP security risks covers what to check there.

Key points

• Agent Skills are an open format, so one SKILL.md folder can work across Claude Code, Codex, Copilot, Cursor and more.
• Vendor catalogs are the safest default, but each lives inside one agent's plugin system.
• skills.sh indexes skills across agents; popularity and audit labels are signals, not guarantees.
• A skill tells an agent how; an MCP server gives it access; an app does the whole job.
• Read the SKILL.md and every script before anything runs.

FAQ

What is an AI skill marketplace?

A catalog where you find and install Agent Skills, the SKILL.md folders that teach an AI agent a specific task. Some are run by agent vendors, some are open directories that index GitHub, and some are app marketplaces that package skills to run in a workspace.

Do Claude skills work in Codex, Copilot or Cursor?

Usually, if the skill follows the Agent Skills spec. Codex, GitHub Copilot and Cursor all document support for the format, and Copilot and Cursor even read .claude/skills folders. Skills that lean on one agent's custom frontmatter fields or tools may need small edits.

Is skills.sh official?

It's run by Vercel, not by Anthropic or OpenAI. It's an open directory with audit results from third-party scanners, and Vercel itself says it can't guarantee every listed skill is safe.

What's the difference between a skill and a plugin?

A skill is one folder of instructions and optional scripts. A plugin is a packaging unit that can bundle several skills with MCP servers, hooks, commands or apps. Claude Code, Codex, Copilot CLI and Cursor all distribute skills inside plugins.

Are AI skills from GitHub safe to install?

Some are, some aren't, and stars don't tell you which. Skills can run scripts on your machine. Read the SKILL.md and every bundled file, prefer vendor or well-known publishers, and pin the version you reviewed.

Where this leaves you

If you live in one agent, start with its vendor catalog. If you use several, an open format means you can keep one set of skills in a shared folder and pull from skills.sh or an agent's own catalog, as long as you read before you install.

And if the install-and-audit loop is where you keep stalling, Taku mirrors an app or skill someone already got working into a desktop workspace, so you can run it, change it, and keep your own version. Taku is in Beta, and the Mac app is available now.