Skills marketplace
Also known as: agent skills marketplace, skill registry marketplace, plugin marketplace for agents
A skills marketplace is the distribution layer between the people who build agent behaviors and the people who use them. A developer packages a behavior, such as a /triage skill that reviews incoming issues or a /code-review skill that annotates pull requests, and publishes it to the marketplace with a SKILL.md file describing what it does, what permissions it needs, and what tools it invokes. Other developers browse, install, and chain those skills into their own agents without rebuilding the same logic from scratch.
The most prominent examples in 2026 are ClawHub, the official marketplace for OpenClaw agent skills, and skills.sh, which also distributes skills compatible with Claude Code and other coding agents. The ecosystem grew fast because it solves a real composability problem: you want your coding agent to be able to call specialized behaviors for pentesting, documentation, test generation, and issue triage, but building each from scratch is slow. Marketplaces make those behaviors shareable.
The tradeoff is supply-chain risk. A skills marketplace is only as trustworthy as its review process, and in early 2026 that process was minimal for both ClawHub and skills.sh. Security audits found malicious payloads, prompt injection attacks, and credential-stealing code embedded in a meaningful percentage of published skills. That episode turned the skills marketplace from a convenience story into a security story: builders now need to evaluate third-party skills before installing them, much like they evaluate open-source packages, but with higher stakes because agent skills operate with active model permissions rather than just running in a build pipeline.