skills.sh
Also known as: skills installer, npx skills, Vercel skills CLI
Skills.sh launched in January 2026 as an open, cross-agent installer for the emerging SKILL.md standard. Where most early skills sharing meant copying files by hand into hidden project directories, skills.sh reduced the whole operation to a single terminal command: npx skills add owner/repo. The tool fetches the skill, places it in the right location for the target agent, and makes it available immediately without restarting a session.
The cross-agent angle is what set it apart from agent-specific approaches. A skill installed via skills.sh can target Claude Code, Codex CLI, Cursor Agent, OpenCode, and others in one step, or all of them at once. That portability matters because most working builders run two or three coding agents depending on the task, and manually syncing capabilities across all of them was friction that skills.sh removed.
Skills.sh is community-driven with no formal review process, so quality varies across the catalog. Security researchers have flagged the model as a vector for supply-chain-style attacks: because skills run with the full permissions of the agent, a malicious SKILL.md file can access credentials, file systems, and API keys. Treat skill installs with the same scrutiny you would any third-party package.