The most-installed agent skills, and what they do

Which coding agents read skills, and how do you install one?

In our post on what a skill is we covered what a skill is, which folder it goes in for Claude Code, Codex, Cursor, Gemini CLI and Copilot, and how to write a SKILL.md. This post answers the next question: where and how do you install skills someone else wrote, which ones are installed most, and what do those numbers measure?

Those five are no longer the only agents that read skills. On 21 October 2026 we looked at 10 coding agents whose documentation says they read SKILL.md. They all read the same format; how you install a skill, where you find one and when support arrived differ from tool to tool:

Source: each agent’s skill and plugin documentation and release notes, 21 October 2026. Versions: Claude Code 2.0.20, Gemini CLI 0.23.0 and 0.26.0, Antigravity 1.14.2, OpenCode 1.0.190 (its release note on GitHub), Cursor 2.4; gh skill needs GitHub CLI 2.90.0 or later. Claude Code’s plugins entered public beta on 9 October 2025, and plugin support came to Codex on 25 March 2026. On 18 June 2026 Google closed Gemini CLI to free users and to Google AI Pro and Ultra subscribers and put Antigravity CLI in its place; Gemini CLI carries on for people who use it with a company licence or a paid API key. “Not in its documentation”: in the pages we read that day, we found no sentence that says so.

We covered the folders of those five tools in our post on what a skill is; the agents that post did not cover look for skills here:

• OpenCode reads .opencode/skills in the project, and .claude/skills and .agents/skills for compatibility, from the folder you are in up to the root of the git worktree. For personal skills it looks in ~/.config/opencode/skills, ~/.claude/skills and ~/.agents/skills.
• Antigravity reads .agents/skills in the project; the older .agent/skills still works. The CLI reads personal skills from ~/.gemini/antigravity-cli/skills and plugins’ skills from ~/.gemini/antigravity-cli/plugins/<plugin>/skills.
• Amp reads .agents/skills and .claude/skills in the project. For personal skills it looks in ~/.config/agents/skills, ~/.agents/skills, ~/.config/amp/skills and ~/.claude/skills, and also in Claude Code’s plugin cache (~/.claude/plugins/cache). If two skills have the same name, it uses the first one it finds.
• Goose reads .agents/skills in the project and ~/.agents/skills for personal skills; it also finds the older .goose/skills and .claude/skills.
• Pi reads .agents/skills in the project, from the folder you are in up to the root of the repository, and ~/.agents/skills for personal skills.

Two install tools are not tied to any one agent. GitHub CLI’s gh skill install command, with --agent, also installs a skill into Claude Code, Cursor, Codex, Gemini CLI or Antigravity. Vercel’s npx skills add, according to its README, installs into OpenCode, Claude Code, Codex, Cursor and 75 more agents. Still, do not assume a skill will do the same job in another agent. According to the Skill Constellations study, skills copied into other agents’ folders often carry the names of tools that exist only in Claude Code. Check which tools a skill calls.

Then there is the difference between a skill and a plugin. The documentation of Claude Code, Codex, Cursor and Antigravity describes distributing other people’s skills in plugins: Cursor does not import a standalone skill from a repository, and Codex recommends a plugin for distribution. A plugin, though, can carry more than skills. According to Claude Code’s documentation, a plugin can run hooks and MCP servers. In Codex, a plugin carries app connections and MCP server settings alongside its skills; in Cursor, rules, agents, commands, MCP servers and hooks. A skill on its own is made of text, scripts and reference files. obra/superpowers, mattpocock/skills and anthropics/skills are also distributed as plugins.

How is “most installed” measured?

The lists you find when you search for “most installed skills” count different things. These are the 4 counters we looked at on 21 October 2026:

• skills.sh is Vercel’s skill directory. According to its documentation, the ranking rests on anonymous telemetry collected from the skills CLI and tracks only which skills are installed. An install from a plugin marketplace, with git clone or with gh skill does not reach this counter. The numbers are kept per skill; a repository’s “total installs” is the sum of its skills and does not tell you how many people installed it. DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 turns the telemetry off.
• Claude’s plugin directory (claude.com/marketplace) shows an install count next to each plugin. Anthropic reports the number; the page does not say how it is counted. These are plugin installs: besides skills, a plugin can also carry hooks, agents and MCP servers.
• A GitHub star counts bookmarking a repository, not using it. According to Skill Constellations, stars say almost nothing about how far a repository’s skills are copied into other repositories (“nearly uninformative”); the study also points to fake-star campaigns.
• Copies on GitHub are counted by researchers. GitSkills collected, in July 2026, 3,797,117 SKILL.md files from 282,200 public repositories on GitHub; once identical contents were merged, 1,877,981 distinct ones were left. According to Skill Constellations, half of the SKILL.md files on GitHub are verbatim copies of another file; one skill, web-design-guidelines, spread over 12 generations of copies to 972 repositories. Both studies are preprints on arXiv and have not been peer reviewed.

The counters can give numbers for the same pack that look nothing alike, and sometimes a single counter, on its own, shows numbers that cannot be explained. This is what we saw on 21 October 2026; we do not know the reasons:

• skills.sh lists 6 repositories named superpowers that are not obra/superpowers. None of them has more than 8 stars on GitHub; on skills.sh, the most-installed skill of each shows between 341.9K and 825.8K installs. One of them has 86 skills: 60 of them show 132 installs or fewer, while 4 show between 824.3K and 825.8K.
• garrytan/gstack has 137.1K stars on GitHub; its total on skills.sh is 44.2K. Its README has you install the pack with git clone, and skills.sh counts only installs made with its own CLI.
• The mattpocock/skills plugin has 1,745 installs in Claude’s directory; on skills.sh, the pack’s grill-me skill alone shows 1.4M installs. Its README recommends the plugin for Claude Code and npx skills for many other agents; the two counters count two separate channels.

The rule that follows is simple: read a number together with the counter that counted it. Do not add up two counters’ numbers, and do not compare them with each other. In the table below, too, each counter has its own column.

Which skill packs are installed most, and what do they do?

The table below is not a ranking. It is a selection of general coding packs that came up often on the counters; the rows are in alphabetical order of repository name. Skills a company wrote for its own product (such as Supabase’s or Prisma’s) and packs that are not about code are not in the table; we mention a few company skills in a later section.

Source: the GitHub stars are the rounded number GitHub shows on the repository page; the skills.sh column is the pack’s most-installed skill and the rounded install count skills.sh shows on its repository page; both on 21 October 2026. The two columns are separate counters and are not compared with each other. The “Where it installs” column comes from each pack’s README: the tools whose install it describes. The anthropics/skills README describes the docx, pdf, pptx and xlsx skills as “source-available, not open source”; vercel-labs/agent-skills has no licence file at its root, and its README gives the licence as MIT.

Claude’s plugin directory is a separate counter, and it counts only some of these packs. The install counts Anthropic reported on 21 October 2026: Anthropic’s frontend-design plugin 1,134,112, superpowers 1,009,371, mattpocock-skills 1,745. In the directory, Anthropic’s plugins carry an “Anthropic verified” label; Anthropic is also the one that reports the number. Cursor’s marketplace and OpenAI’s plugin directory show no install counts.

What does Superpowers do, and which tools does it work in?

obra/superpowers sets up a way of working more than a set of separate skills. Its README describes it as “a complete software development methodology” for coding agents. Its latest version is 7.0.0 (9 October 2026), its licence is MIT, and it holds 15 skills. When the agent sees you want to build something, it does not jump into code: it first asks what you want, waits for you to approve the design, then writes the plan and carries out the work step by step:

What holds the flow together is using-superpowers, on the first card. According to the README, in Claude Code, Codex, Cursor and Gemini it is loaded by the plugin’s SessionStart hook. In Claude Code the hook runs when a session opens, after /clear and when the context is compacted; we covered what compaction makes the agent lose in the auto-compact post. The skill’s text is firm with the agent too: “If you think there is even a 1% chance a skill might apply to what you are doing, you ABSOLUTELY MUST invoke the skill.” In the README’s words, these are “Mandatory workflows, not suggestions.”

Most of the steps are habits we found the tools’ guides share in the vibe coding post: a plan first for big work, tests the agent can run, a separate worktree for each task, reading the change. Superpowers does not leave them as advice; it turns them into skills and has the agent follow them. We use obra/superpowers in our own sessions too, while building diffox, our AI code review tool. In a project, the brainstorming skill does not let code be written until a design document is approved; it writes the document under docs/superpowers/specs/, and the writing-plans skill writes the plan under docs/superpowers/plans/. In our repository, too, the design documents and plans superpowers had the agent write sit in these two folders.

The README explains installation under 16 headings; Codex’s app and its CLI each have their own. Of the agents in this post, Amp and Goose are not on the list; Devin CLI, Factory Droid, Grok Build CLI, Kimi Code, Qwen Code, Hermes Agent and Muse are. The README tells you to install it in each tool separately: “If you use more than one, install Superpowers separately for each one.” The commands for the agents in this post:

Source: the obra/superpowers README, 21 October 2026. Superpowers is listed on Cursor’s marketplace with a “Verified by Cursor” label, and in OpenAI’s plugin directory (openai/plugins) too.

The load at the start of each session does not arrive the same way in every tool. According to Superpowers’ release notes, Antigravity has no hook that runs at session start; according to the README, using-superpowers’ description makes the model load it at the start of the conversation. The release notes say this was confirmed in 12 runs on agy 1.3.1; that is the project’s own measurement. In Pi, a small extension adds the same text at session start and after compaction. Hermes Agent has no hook that runs after compaction, so a very long session can lose this load. using-superpowers holds separate reference files for Claude Code, Codex, Pi, Antigravity, Hermes Agent and Muse.

Two things to watch. The first is the name: as we said above, skills.sh has repositories named superpowers that have nothing to do with obra/superpowers, so type the full repository name. The second is a small piece of telemetry: brainstorming’s optional visual companion loads the Prime Radiant logo from the project’s website, and that request sends the version of Superpowers. The README says nothing is sent about your project, your prompt or your agent. To turn it off there is the SUPERPOWERS_DISABLE_TELEMETRY environment variable; it also honours Claude Code’s DISABLE_TELEMETRY and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC settings.

Which skills help while you write code?

Most packs focus on one job. We put the skills that do the same job side by side; the numbers in brackets are the installs skills.sh shows per skill (21 October 2026). What decides which one suits you is not the number but what the skill has the agent do; read its SKILL.md before you install it.

Tests. The test-driven-development skill in obra/superpowers (256.4K) puts its rule in one line, “NO PRODUCTION CODE WITHOUT A FAILING TEST FIRST”, and has code written before the test deleted. The tdd skill in mattpocock/skills (1.1M) applies the same red-green-refactor loop by cutting the work into vertical slices. To try the interface, webapp-testing in anthropics/skills (183.6K) tests a local web app with Playwright, while vercel-labs/agent-browser (1.2M) is a CLI that lets the agent use the browser. We covered when the agent should try the interface itself and when it should write a lasting test in the computer use and Playwright post.

Debugging. systematic-debugging in superpowers (302.3K) forbids proposing a fix before the root cause is found, and splits the work into four phases. mattpocock’s diagnosing-bugs (819.4K) first has the agent build a feedback loop that reproduces the bug and goes red; then come minimising, a hypothesis, instrumenting, the fix and a regression test. verification-before-completion in superpowers (247.9K) asks the agent to run the verification command and show its output before it says “fixed” or “passing”.

Interface. frontend-design in anthropics/skills (1.0M) guides visual direction, typography and design choices so that the interface does not look like a template. Vercel’s vercel-react-best-practices (824.7K) gives performance rules for React and Next.js, ordered by impact; web-design-guidelines (766.1K) audits interface code against accessibility, performance and user experience rules. For a design language there are taste-skill (650.4K), ui-ux-pro-max (407.2K) and impeccable (349.3K).

Libraries. Some companies publish skills for their own products. Supabase’s supabase-postgres-best-practices (454.1K) is written to be loaded before anything is written or changed in a Postgres database; Prisma’s prisma-client-api (378.2K) explains the Prisma Client API for writing queries and filters. If the maker of a library you use publishes a skill, look at that one first.

Documents. The pptx (239.8K), pdf (214.4K), docx (204.7K) and xlsx (185.7K) skills in anthropics/skills are the skills behind Claude’s document creation feature. The README describes them as “source-available, not open source”: you can read the source, but there is no open source licence, and the licence file says “All rights reserved”. Read them as examples, and check the licence before you copy one into your own pack.

Skills that find and write skills. find-skills in vercel-labs/skills (4.0M) finds and installs other skills when you ask “is there a skill that does this?”. skill-creator in anthropics/skills (411.5K) has the agent write a new skill, improves an existing one and measures how accurately it triggers; writing-skills in superpowers (215.2K) does the same job with its own testing method. Codex comes with Skill Creator built in, and Gemini CLI added a skill-creator in version 0.26.0. We covered how to write your own skill in our post on what a skill is.

How safe is it to install someone else’s skill?

We listed what to check before you install in our post on what a skill is, covered the risk of MCP servers in the MCP security post, and the files in a repository that can run on their own in the workspace trust post. What follows is what we have read since those posts.

A plugin runs code. Claude Code’s plugin security page says it plainly: “A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges.” A plugin’s hooks and MCP servers run with your permissions. Claude Code’s permission rules and sandbox cover the tool calls Claude makes, not the code a plugin runs on its own. Superpowers, too, enters Claude Code as a plugin and runs a hook at the start of every session. Codex’s documentation asks you to review and approve plugin hooks before they run.

The version you read can change. If auto-update is on for the marketplace a plugin came from, Claude Code updates the plugin in the background, and the documentation spells out the result: “the files you reviewed can change on disk.” Auto-update is on by default in claude-plugins-official and most official marketplaces, and off in community and third-party marketplaces. The community catalogue, for its part, pins almost every plugin to a commit, and Claude Code installs nothing but that commit. The mattpocock/skills README puts the difference in one sentence: “A plugin updates itself.” npx skills, by contrast, copies the files into your project, and you update them yourself.

A copy does not fix itself. Skill Constellations measures the risk in the other direction: “Skill copies almost never change with their source, and a fix at the source therefore rarely reaches them.” That is why the study recommends distributing versioned references instead of copies. When you choose how to install, the real question is how the skill changes afterwards:

The install tool whose documentation spells out version pinning is GitHub CLI: gh skill install … --pin pins the skill to a tag or a commit, and a pinned skill is skipped when you update. But pinning also makes updating your job. The notes for Superpowers 7.0.0 say it closed a hole through which, on Windows, a repository could leave a file that would run at session start; an install that stays on an older version does not get this fix. Pin, read the release notes and upgrade yourself.

Security scans do not agree with each other. skills.sh, according to its announcement of 17 February 2026, scans skills with Gen, Socket and Snyk and removes the ones found malicious from its listings and search; its documentation also says it cannot guarantee the quality and security of every skill. There is reason not to trust a scanner’s verdict on its own. In the After the Party study of OpenClaw’s skill marketplace, three scanners looked at the same 61,990 skills and disagreed on 23,702 of them. From the other side, Context Matters found that marketplace scan reports flagged up to 46.8% of skills as malicious, while only 0.52% stayed suspicious once each skill was examined together with its own repository. So neither a “passed” badge nor a “malicious” warning is enough on its own.

Skills that are clean one by one can be risky together. CompoSkill and Runaway Reaction show that skills that each pass a scan can produce harmful behaviour when they are used together. SkillBloat looks at another attack on coding agents: a malicious skill can make the agent spend far more tokens than the task needs, so the damage shows up on the bill. All the studies in this section are preprints on arXiv and have not been peer reviewed.

The agents’ skill documentation also warns you to different degrees:

• OpenCode lets you use opencode.json’s permission.skill to set each skill, or a pattern, to allow, ask or deny; with ask, it asks you before the skill is loaded.
• Pi asks you to read unfamiliar skills and the files next to them before you trust a project.
• Copilot’s VS Code documentation tells you to always review shared skills before you use them.
• Cursor’s marketplace reviews every plugin by hand before listing it.
• Antigravity and Goose have no rule about safety on their skill pages: it is not in their documentation.

Which skill should you start with?

Start from your work, not from a list. What we suggest:

• Find the need first. If the agent keeps making the same mistake (code without tests, a patch that skips the root cause, an interface that looks like a template), look for a skill for that job. To change the whole flow, a pack like obra/superpowers; to fix one job, a single skill is enough.
• Pick a pack that is maintained and has a clear licence. Does the README say which agents it supports and what its licence is, and when did it last change? If the maker of a library you use publishes a skill, look at that one.
• Read before you install. Read the SKILL.md and the scripts next to it; if it is a plugin, look at its hooks and MCP servers too. In Claude Code, /plugin install does not install the plugin right away: it first opens the details panel, which shows the commands, skills, hooks and MCP servers the plugin will add.
• Pin the version and do the updating yourself. gh skill install … --pin or a commit; if it is a plugin, know whether auto-update is on or off.
• Do not install the same pack two ways. The mattpocock/skills README warns that if you install it both as a plugin and with npx skills, every skill comes twice.
• If you are looking at a number, read its counter too. Which counter, what does it count, when was it read? Do not put numbers from different counters side by side to compare them.

Frequently asked questions

What are agent skills?

A skill is a folder with a SKILL.md file in it: at the top are the skill’s name and description, and below them the instructions that tell the agent how to do a job. At the start of a session the agent reads only the name and the description, and when a task matches the description it loads the full instructions. We covered how to write one and which folder it goes in in our post on what a skill is.

How do you add a skill to Claude Code?

You put your own skill in .claude/skills/<name>/SKILL.md in the project, or in ~/.claude/skills for yourself. Other people’s skills mostly come in plugins: /plugin install <plugin>@<marketplace> first shows the plugin’s details and installs it once you choose a scope. Anthropic’s official marketplace (claude-plugins-official) is added on its own in the first interactive session; for another marketplace you first need /plugin marketplace add. Remember that a plugin can also run hooks and MCP servers.

How do you install a skill in Codex?

To install a skill from Codex’s own catalogue, type $skill-installer <name>; Codex picks up the new skill on its own, and if it does not appear, restart Codex. Plugins are installed with /plugins in the CLI and from the Plugins tab in the app; Codex’s documentation recommends plugins for distributing skills. Skills you add by hand live in .agents/skills in the project and in $HOME/.agents/skills for yourself. The old catalogue, openai/skills, is deprecated; the current examples are in openai/plugins.

Which folders does OpenCode read skills from?

In the project it reads .opencode/skills, .claude/skills and .agents/skills at every level from the folder you are in up to the root of the git worktree. For personal skills it looks in ~/.config/opencode/skills, ~/.claude/skills and ~/.agents/skills. The agent loads a skill with the built-in skill tool; with permission.skill in opencode.json you can allow each skill, have it ask first, or turn it off. Its documentation mentions no install command and no marketplace.

Do Gemini CLI skills still work?

They do, but not for everyone. On 18 June 2026 Google closed Gemini CLI to free users and to Google AI Pro and Ultra subscribers and put Antigravity CLI in its place. Gemini CLI carries on for people who use it with a company licence or a paid API key; the latest version in the release notes is 0.64.0 (13 October 2026). According to Google, Antigravity CLI keeps skills. If you put your skills in .agents/skills, both read them; in Gemini CLI that folder comes before .gemini/skills.

What is skills.sh, and what do its install counts count?

skills.sh is Vercel’s skill directory and the site of the npx skills CLI. Its ranking rests on anonymous telemetry collected from the CLI: it counts installs made with npx skills add, per skill. Installs from a plugin marketplace, with git clone or with gh skill are not in that number. A repository’s total is the sum of its skills; it does not tell you how many people installed it. DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 turns the telemetry off.

Does Superpowers work in Codex, OpenCode or Cursor?

The obra/superpowers README describes an install for all three. In Codex it is in OpenAI’s plugin directory: you search for it with /plugins in the CLI and install it. In Cursor you install it with /add-plugin superpowers or from the marketplace; it is listed on Cursor’s marketplace with a “Verified by Cursor” label. In OpenCode you tell the agent to read and follow .opencode/INSTALL.md in the repository; the README asks you to install Superpowers in OpenCode separately even if you already use it in another tool. Because other repositories share the name, type the full repository name: obra/superpowers.