Where do your agent prompts live right now? If you are honest, the answer is messy. The rulebook you wrote for Claude Code sits in one project's .claude directory. The one for Cursor was copied to a second machine and diverged. The Codex configuration exists only in a chat scrollback. Change one convention and you sync four or five places by hand; switch agents and you retype the whole prompt set. These assets most deserve version control and one-command installation, yet they have lived as copy-paste text.
Vercel Labs decided to tidy the sprawl. vercel-labs/skills states its purpose in a single line: "The open agent skills tool - npx skills." It turns a skill, a reusable instruction pack stored in a Git repository, into an installable, updatable, distributable dependency. Repository address: github.com/vercel-labs/skills.
Here are the measured numbers (GitHub API, verified 2026-10-14): 34,494 stars and 2,952 forks, MIT license (the LICENSE file reads "MIT License, Copyright (c) 2026 Vercel, Inc."), TypeScript as the primary language, and an npm package literally named skills. The repository was created on January 14, 2026, last pushed on October 9, 2026, ships a website at skills.sh, and sits on the GitHub Trending daily chart (measured at roughly +190 stars per day on 10-14). One outlet called it "npm for agent skills" (mangodeveloper headline). The comparison is not hype: it does for prompt packs what npm did for JavaScript packages.
A boundary with our existing coverage first. We have already published pieces on the MCP protocol, an MCP client comparison, an MCP server development SOP, and Claude Code subagents. This article takes a different angle: skill as a portable distribution layer across agents, covering installation, updates, discovery, and the emerging standards fight, not the protocol itself.
What a Skill Actually Is
A skill is an instruction package in a repository: a SKILL.md that says what the skill is, when to use it, and how to use it, plus reference resources loaded on demand. It binds to no single agent and no single session. Like a codebase, it has a version, a repository, and an author. The content form has existed informally inside agent directories; what was missing was a unified installation and update channel. This CLI is that channel.
Per the README, it supports 79 coding agents: OpenCode, Claude Code, Codex, Cursor, and 75 more. Note the strategy: it does not unify the agents themselves; it unifies the skill layer above them, a vendor-neutral distribution shelf any agent can hang from.
The difference from a plain prompt file matters too. A rule in .cursor/rules is local text: no author, no version, no dependency graph, and sharing means copying. A skill is a repository plus manifest, versioned in Git and shareable by address. Moving from text to package is exactly the infrastructure this tool provides.
The Command Arsenal
The command table reads like what a package manager should look like:
add: install. Project-level symlink by default,--copyto copy instead,-gfor user-level global,-ato target a specific agent, and--all -yfor unattended CI runs.use: write into a temporary directory and print only the generated prompt to stdout, pipeable into any agent, or launch interactive mode directly with--agent claude-code.list/ls: show installed skills.find: added in v1.1.1, an fzf-style interactive keyword search.remove: uninstall.update: update installed skills.check: look for new versions.init: scaffold a fresh SKILL.md.
use deserves its own paragraph. It answers the try-before-you-install scenario: faced with a skill from an unfamiliar repository, you never have to pollute a project to see what prompt it generates or whether it collides with your configuration. Printing to stdout also means the prompt can be piped into any agent, since the tool assumes nothing about your vendor. For a layer that advertises vendor neutrality, that is the most honest command in the set.
A Typical Workflow
Chained together, the commands form a loop. Browse the 24-hour trending on skills.sh or search with find, then run npx skills add owner/repo -a claude-code to install for a chosen agent and list to confirm. Maintenance is two commands: check for new versions, update to refresh. In CI, --all -y installs everything unattended in one line. Evaluating something unfamiliar? Fall back to use. Discovery, trial, install, audit, update: the closed loop a package manager should have, complete.
symlink vs --copy: Two Gears of Installation
By default, add symlinks the skill from the repository into the agent's skill directory. The benefit is direct: repository updates propagate to everything the agent directories point to, so multiple agents share one source with no manual sync. But symlinks have environmental temperaments: they break in some Windows and network-drive setups. That is why --copy ships as the standard fallback: better a copy in each agent directory than a link that fails to install. Link or copy is really a trade between single-source sync and environmental robustness, and the tool offers both gears.
Sources and Private Repositories
add accepts every everyday source format: GitHub shorthand (owner/repo), full URLs, a direct path to one skill inside a repository, GitLab, Azure DevOps, any git URL, and local directories. Private repositories reuse the Git credentials, GitHub CLI, or SSH already on your machine, so the tool needs no separate token. The documentation further declares that stored GitHub CLI tokens are not read into the tool process (zendot). For a CLI that lives on a development machine for years, that declaration beats any marketing line.
Size Limits: 10MB, 25MB, and 1000 Files
The download side has explicit caps (mangodeveloper): direct URL downloads up to 10MB, 25MB after decompression, and at most 1000 files in an archive. These can be overridden with environment variables such as SKILLS_DOWNLOAD_MAX_BYTES. These numbers do not block normal skills; they block abuses like stuffing model weights into a repository. For a prompt pack, 10MB is generous to begin with.
skills.sh: A Discovery Platform Filled by Telemetry
Installation is half of distribution. Discovery is the other half, and the official site skills.sh carries it. The catalog is populated by anonymous telemetry emitted during CLI installs, and it surfaces 24-hour trending plus per-agent download statistics (dplooy). In other words, the directory is not an editor's pick but an aggregation of real install behavior. Telemetry is on by default, and DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1 turns it off. On by default, off by hand is a debatable combination, but at least the switch sits in plain sight.
The Standards Fight: GitHub Repos or .well-known
The more interesting story is underwater. Cloudflare filed a competing proposal, agent-skills-discovery-rfc: use RFC 8615's .well-known/skills/ plus an index.json so organizations can publish skills on their own domains (dplooy). The two routes are isomorphic in their progressive disclosure pattern, both splitting into L1 index metadata, L2 the SKILL.md body, and L3 on-demand resources. The disagreement is only about where things get discovered: the Vercel route (GitHub repositories plus skills.sh) is lighter for independent developers, while the Cloudflare route (publishing on your own domain) is more standardized for large institutions. The Agent Skills spec itself is open and decoupled from the discovery mechanism, so this contest is over distribution channels, not skill formats. For users that is good news: write a skill once and both routes can carry it.
The three disclosure layers explain why skills are cheap. L1 puts only index metadata into context, so the agent learns which skills exist and what each covers; when one is relevant, L2 loads the SKILL.md body; L3 reference resources are not read until actually needed. Context windows are an agent's most expensive resource, and this design drives the standing cost of a skill close to zero, which is what makes hanging dozens of skills off one agent engineering-plausible. The distribution layer solves installation; progressive disclosure solves usage. The two are designed to work together.
The Official Collection: A Showroom of Five Skills
A CLI alone is not enough; you need exemplary content. The official collection repository vercel-labs/agent-skills plays the showroom role. Repository address: github.com/vercel-labs/agent-skills. Numbers, again verified (GitHub API, 2026-10-14): 32,367 stars, 2,825 forks, JavaScript, created December 8, 2025, last pushed August 28, 2026. One caveat stated plainly: the GitHub API shows no license marker and no LICENSE file was found at the root, so this article makes no claim about its license; check the official site before reusing its content.
The collection covers five areas (agskills.dev/dplooy):
- react-best-practices: the Vercel engineering team's React/Next.js performance guide, with 40-plus rules in 8 categories, graded by impact. Critical covers eliminating request waterfalls and bundle optimization; High covers server and client data fetching; Medium-High covers re-renders; Medium covers rendering performance; Low-Medium covers JavaScript micro-optimizations. That grading scheme is itself a model for skill authors: a priority order, not a rule dump.
- web-design-guidelines: 100-plus web interface specification audits spanning accessibility, performance, and UX.
- react-native-guidelines: 16 rules across 7 sections.
- composition-patterns: compound components, state lifting, and avoiding boolean prop sprawl.
- vercel-deploy-claimable: deploy directly inside the conversation, producing a "claimable" deployment link whose ownership can transfer to your own Vercel account.
That last one states the format's full imagination: an instruction pack can not only teach an agent how to write code, it can get the work done for you.
Adoption Evidence: Corporate Install Commands in Autocomplete
Whether a distribution tool has arrived is visible in real install commands. In the S1 autocomplete dataset (verified 2026-10-14), the suggestions under "npx skills add" include a long list of genuine install commands: wecomteam/wecom-unified, heygen-com/hyperframes, okx/agent-skills, tencent/wechatreading, alchaincyf/*, and more. WeCom, Tencent, and OKX are already distributing their own skills through this CLI. Search autocomplete does not invent these combinations; they come from installs that actually happened. For a concept this young, that is the hardest adoption evidence available.
For background: the Vercel Labs incubator previously produced v0, and one author (mangodeveloper, opinion) called skills "infrastructure, not a demo," while cautioning that the project is young. 34,494 stars, nine-plus months, 79 agents, and install commands from several large companies: the verdict has support, but the finish is for time to judge.
It is also worth pouring cold water on the "npm for agent skills" analogy itself. That is a media headline, not an official positioning. npm took more than a decade to build today's registry, security auditing, and dependency resolution; skills is nine months old, its registry is a single directory at skills.sh, and its security model is basically a Git repository plus anonymous telemetry. The analogy explains the positioning; it does not certify maturity.
Honest Boundaries
The boundaries, all factual:
First, the project is young. The repository was created on January 14, 2026, barely nine months ago, so the risk of breaking changes is real. Pin versions before binding anything in production.
Second, skill quality depends on the author and the paired model. The CLI only moves bits; it does not judge content. A vaguely written skill mismatched to the model's ability will steadily produce wrong results, and the smoother the distribution layer, the faster bad content spreads. Reading the generated prompt with use before installing costs less than uninstalling afterward.
Third, symlinks break in some Windows and network-drive environments. When it happens, switch to --copy; this is mandatory coursework, not an option. The symptom is usually a link pointing at an empty address, skills appearing and disappearing, and no reproduction on another machine.
Fourth, telemetry is on by default. If that bothers you, set DISABLE_TELEMETRY=1 or DO_NOT_TRACK=1.
Fifth, the agent-skills collection repository's license is unstated (no API marker, no root LICENSE file), so verify on your own before commercial use of its content.
Related reading
- MCP protocol resource: the standard between agents and tools
- Claude Code subagent SOP: multi-agent division of labor
- diagram-design SOP: editorial diagrams inside Claude Code
FAQ
Q1: How do skills relate to MCP? Will one replace the other?
They are different things, not mutually exclusive. MCP standardizes the calling protocol between agents and tools; skills standardize prompt asset distribution. One agent can use both at once. This article covers only the latter; for the protocol layer, see the site's MCP series.
Q2: Does using this tool lock me into the Vercel ecosystem?
No. The CLI itself is MIT-licensed and vendor-neutral: install anyone's skills, use any agent. The official collection contains Vercel content, but that is a showroom, not a requirement.
Q3: symlink or --copy: how do I choose?
Single machine, local disk, multiple agents sharing one source: use the default symlink, and repository updates propagate everywhere. Windows or network-drive environments where symlinks break, or when you want each agent's configuration isolated: use --copy, at the cost of losing automatic sync.
Q4: How do I install a skill from a private repository?
add supports GitHub shorthand, full URLs, in-repository paths, GitLab, Azure DevOps, any git URL, and local directories. Private repositories reuse existing Git credentials, GitHub CLI, or SSH on the machine; per the documentation, stored GitHub CLI tokens are not read into the tool process (zendot).
Q5: How do I discover good skills written by others?
Two entry points: the 24-hour trending and per-agent download statistics on skills.sh (filled by install telemetry, which can be disabled), and the fzf-style interactive search in find. Note that directory rankings reflect install popularity, not quality certification.
Closing Thoughts
What this tool actually changes is a habit: prompts get a package manager for the first time. Install, uninstall, update, version checks, discovery, scaffolding. Everything npm ever did for code packages, it does again for instruction packs. The 34,494 stars are heat; the WeCom, Tencent, and OKX install commands in autocomplete are adoption; the Cloudflare proposal is an ecosystem position. It is still young, and the pitfalls around symlinks, telemetry, and licensing are all on the table. The era of scattered prompts is ready to be rounded up.