Is an agent skills registry worth building in 2026?

Why did agent skills just take over GitHub?

On August 7, three separate agent-skills libraries sat in GitHub's daily top five at once: mattpocock/skills at 2,152 stars that day, addyosmani/agent-skills at 1,131, and obra/superpowers at 782. maybe worth building's radar logged all three in one pull, and as of August 16 the three repos hold a combined 579,621 stars. The oldest of them, superpowers, launched in October 2025. The youngest, mattpocock/skills, went from zero to 219,154 stars in six and a half months.

Then the platform owners showed up. Google published google/skills on March 31, 2026, "Agent Skills for Google products and technologies," now at 18,395 stars, and google-gemini/gemini-skills sits beside it. A skill, for anyone catching up, is a markdown file (usually SKILL.md) that teaches an agent a capability, and it runs with the agent's permissions: shell, files, network. The prompt you used to paste into a chat box became a package you install.

Hasn't someone already built the npm for skills?

Several times, which is exactly the problem with building another one. A solo developer shipped a discovery directory on January 14. Skyll launched February 6 to aggregate skills.sh and the community registries behind a REST API. Tessl runs a registry that generates and publishes evals for every submitted skill. And ClawHub, the registry behind the OpenClaw agent platform, listed 14,704 skills by the time a security researcher scanned the whole thing on March 1.

The people building the registries describe the pain best. "While the ecosystem for 'Agent Skills' is growing fast, it feels very fragmented right now. I found myself constantly digging through random GitHub repos or Twitter threads to find compatible tools," wrote the directory's creator on Hacker News on January 14, 2026. A different builder put a number on it in February: there was "no way to discover which of the 7,400+ community skills are actually worth installing."

So discovery is real pain, and it's also the crowded, obvious layer. A skills directory is a weekend build with zero switching costs, and one HN commenter named the open question in April: it's "tbd whether the skill registry develops network effects or just stays a flat directory." So far, they stay flat.

What's actually missing in skills distribution?

Versioning, almost entirely. A skill installs from whatever a repo's HEAD happens to be today. No pinning, no lockfile, no record proving that the skill your agent runs on Friday is the one you read on Monday. In a normal package ecosystem that gap took years to close; here it hasn't started closing. Format fragmentation stacks on top: SkillKit exists purely to translate one skill across the 45+ competing agent formats (SKILL.md, .mdc, .github/skills and the rest), which tells you how little the ecosystem has converged.

The npm comparison people reach for is right about the gap and wrong about the fix, because the trust problem underneath is worse than npm's ever was.

How bad is the trust problem, in numbers?

Start with ClawHavoc. Disclosed by Koi Security on February 1, 2026: threat actors mass-uploaded 1,184 malicious skills to ClawHub across 12 publisher accounts, one account carrying 677 packages by itself, with reverse shells and staged malware downloads inside. The upload gate they beat was a GitHub account older than one week. Four days later, "Top downloaded skill in ClawHub contains malware" hit 334 points on Hacker News.

A 15-year enterprise architect summed up the structural issue in a February 26 HN post: teams adopting third-party skills face "the same blind trust problem that npm had before npm audit existed," except worse, since "agent skills can execute shell commands, read environment variables, and make network requests by design."

Here's the part that makes it a real wedge rather than a solved rerun of npm audit. When RankClaw's author scanned all 14,704 ClawHub skills, surface heuristics flagged 6.6% as malicious. AI deep audits of the same skills found 16.4%. His conclusion, verbatim: "Surface scanning misses roughly 60% of the actual risk." The reason is structural: "There's no malicious code to detect because the payload doesn't exist until the AI writes it during a conversation." One actor published 30 skills under the name "x-trends" across multiple accounts; 28 were confirmed malicious. Static analysis, the entire toolbox that secured traditional package registries, reads code. Skills are English.

When is a skills registry worth building?

When you build the layer the directories skipped, and sell it to teams. The shapes that hold up:

• The lockfile. Hash-pinned installs, explicit upgrade diffs, a record that the skill you audited is the skill that runs. This is table stakes in every other ecosystem and absent here.
• Capability declarations, enforced. A skill states what it needs (shell, network, env vars) and the harness holds it there. The declared-versus-actual gap becomes the audit surface.
• Provenance for teams. Signed publishers, approval flows, change history. The buyer is the platform team that just read about 1,184 poisoned packages, and they will pay for the boring version of this.
• Audit that reads English. The 6.6%-versus-16.4% gap is the market. Nobody has built tooling that reasons about instructions, rather than patterns in code, well enough to trust yet.

Agents already got this treatment at other layers. Runtime security has funded companies in it, which we covered in the agent security tooling verdict, and pre-deployment testing is consolidating fast, per the AI red-teaming verdict. The supply chain between those two, what gets installed and whether it's still what you approved, is the thinnest slice today.

When it isn't

• Directory number six. Free, crowded, no lock-in, and the platform owners run the defaults. Google's own skills repo took 18,395 stars without trying.
• Another regex scanner. A dozen scanning tools appeared within weeks of ClawHavoc, per the February 26 post above, and the leading one's own docs concede "no findings does not mean no risk." Shipping the thirteenth heuristic scanner adds nothing.
• Anything you secretly expect the platforms to bundle. If your roadmap assumes OpenClaw, Anthropic, and Google never ship signing and pinning natively, say that assumption out loud before you build on it.

The test to run before you build

Our standard bar is a two-part receipt: a real company or artifact proving the space, and a real person describing the pain in their own words. This idea clears both with room. The space receipt is 579,621 stars across three skills repos plus Google publishing its own. The pain receipt is a registry founder writing "constantly digging through random GitHub repos" and a security scan showing a 60% miss rate on live malicious packages. MCP servers hit this same distribution-layer moment a year earlier, and that verdict turned on the identical question: who owns the layer once the platforms move in.

Which is the one way this verdict is wrong. OpenClaw, Anthropic, and Google each control a registry surface, and native signing, pinning, and capability scopes from any of them would compress a standalone trust product into a feature. Speed matters more here than in most verdicts on this site. ClawHub's screening at attack time was a one-week-old GitHub account; how far its post-ClawHavoc hardening goes is the tell to watch.

Frequently asked questions

Is there already an npm for agent skills?

Several. ClawHub listed 14,704 skills as of a March 1, 2026 scan. Skyll aggregates skills.sh and community registries over REST and MCP. Tessl auto-generates evals for submissions. At least two independent discovery directories launched in January and February 2026 alone. Browsing is solved. Versioning and trust are not.

What is an agent skill?

A markdown instruction file, usually SKILL.md, that teaches an AI agent a capability. Skills run with the agent's own permissions, which typically means shell commands, file access, and network requests. Installing one means letting a document written in English direct a program that can act on your machine.

Why doesn't npm-audit-style scanning work on skills?

Because there is often no malicious code to find at scan time. A skill can instruct the agent to write and run the dangerous code mid-conversation. Scanning all 14,704 ClawHub skills, surface heuristics flagged 6.6% as malicious while AI deep audits found 16.4%. Roughly 60% of the actual risk was invisible to surface tools.

What was the ClawHavoc attack?

A supply-chain campaign disclosed by Koi Security on February 1, 2026. Actors mass-uploaded 1,184 malicious skills to ClawHub across 12 publisher accounts, one account responsible for 677 packages. Payloads included reverse shells and staged downloads. The upload gate at the time was a GitHub account older than one week.

What part of skills infrastructure is worth building in 2026?

The trust and versioning layer: hash-pinned installs with a lockfile, capability declarations the harness enforces, signed provenance with approval flows for teams, and audit tooling that reasons about natural-language instructions. Sell it to platform teams, not hobbyists.

What kills this idea?

The platform owners. OpenClaw, Anthropic, and Google each control a skills surface, and any of them could ship signing, pinning, and capability scopes natively. If that lands, the standalone trust layer becomes a checkbox feature. That is the bet you are making.