Is there an official Claude skills marketplace?
Yes. Anthropic's official Claude skills marketplace is a plugin marketplace called claude-plugins-official, which Claude Code adds for you, and you can browse the same catalog on the web at Claude Marketplace. Skills arrive inside plugins, so "skills marketplace" and "plugin marketplace" mean the same catalog in Claude Code.
Anthropic actually publishes several catalogs. Its page on Anthropic's marketplaces lists three general ones:
- Official (
claude-plugins-official): plugins Anthropic maintains plus plugins from partners and other authors. Claude Code adds it the first time you start an interactive terminal session. - Community (
claude-community): third-party plugins their authors submitted to Anthropic. You add it with/plugin marketplace add anthropics/claude-plugins-community. - Demo (
claude-code-plugins): a few example plugins in theanthropics/claude-coderepo. Most are also in the official marketplace.
There is also Anthropic's directory on claude.ai, the catalog people browse in the Claude app and Cowork. A plugin you add there reaches Claude Code through account sync. And there is the anthropics/skills repo, Anthropic's open collection of example skills, which you add as a marketplace named anthropic-agent-skills.
Outside Anthropic, a handful of independent directories list skills from public GitHub repos. They differ a lot in what they check before listing something.
Which skills directories and marketplaces exist?
These are the main places to find Agent Skills as of October 2026, in no particular order. Counts change daily and are reported in different ways, so this guide doesn't rank by size.
| Directory | Run by | What it lists | How you install | Security signals shown |
|---|---|---|---|---|
claude-plugins-official and Claude Marketplace |
Anthropic | Plugins (with skills) from Anthropic, partners and other authors | /plugin install <name>@claude-plugins-official |
"Anthropic verified" badge on some listings |
claude-community |
Anthropic | Third-party plugins submitted to Anthropic | /plugin install <name>@claude-community |
Nearly every entry pinned to a commit SHA |
| anthropics/skills | Anthropic | Example and document skills | /plugin marketplace add anthropics/skills |
Labeled for demonstration and education |
| Claude org directory | Your organization | Skills your owners provisioned or approved | Customize, Skills in the Claude app | Owner review; Enterprise security scanning |
| skills.sh | Vercel | Skills from GitHub repos, ranked by installs | npx skills add <owner/repo> |
Gen Agent Trust Hub, Socket and Snyk audits per skill |
| ClawHub | OpenClaw | Skills and plugins for OpenClaw | openclaw skills install <skill> |
Scan state on each detail page; reporting and moderation |
GitHub CLI (gh skill) |
GitHub | Any skill in a GitHub repo | gh skill install <owner/repo> <skill> |
None; GitHub says skills are not verified |
| ChatGPT and Codex plugin directory | OpenAI | Plugins that bundle skills | From the directory in ChatGPT or Codex | Not covered in OpenAI's skills docs |
| SkillsMP | Independent community project | Open-source skills aggregated from GitHub repos | From each skill's source repo | Source-evaluation guidance in its Agent Skills guide |
How do they compare on vetting and install method?
skills.sh is the closest thing to a cross-agent app store. Vercel's changelog from 17 February 2026 says audits from Gen, Socket and Snyk cover "over 60,000 skills and counting," that "Security audits appear publicly on each skill's detail page," and that skills flagged as malicious are hidden from the leaderboard and search. On the audits page, Gen Agent Trust Hub and Snyk give risk labels such as Safe, Low Risk, Med Risk and High Risk, and Socket shows an alert count. Since version 1.4.0 of the skills CLI, the audit result also shows when you add a skill.
Anthropic's marketplaces are curated catalogs rather than open uploads. The official marketplace isn't open to submissions through the directory portal, and Anthropic's publishing guide says to ask a partner contact about an official listing. Third parties can submit to the community marketplace or to Anthropic's directory on claude.ai, which needs a paid plan to submit from. Claude Code accepts official and community marketplace names only from github.com/anthropics/ repos, so an impostor can't present itself under those names.
ClawHub is open by default. OpenClaw's ClawHub docs say "anyone can upload, but publishing requires a GitHub account old enough to pass the upload gate." It runs automated checks on new releases, shows the latest scan state before install, hides releases that scans hold or block, and lets signed-in users report skills to moderators.
GitHub CLI installs straight from any repo. GitHub's April 2026 changelog says installed skills record the Git tree SHA of their source, --pin locks a version, and gh skill preview lets you read a skill first. It is also blunt: skills "are not verified by GitHub." The gh skill manual marks the command as in preview.
SkillsMP is a search index across GitHub. Its own site summary calls it "an independent community project, NOT affiliated with Anthropic," says all skills are open source and sourced from GitHub repositories, and links an Agent Skills guide that covers source evaluation and installation.
One caution applies to every row with automated scanning. In June 2026, Trail of Bits reported bypassing ClawHub's malicious skill detector, Cisco's skill scanner and all three scanners on skills.sh. A clean audit is useful evidence, not a guarantee.
Which marketplace works with which agent?
The open SKILL.md format is why the same skill can come from any of these places. What changes is the installer:
| Agent | Anthropic marketplaces | skills.sh (npx skills) |
gh skill |
ClawHub |
|---|---|---|---|---|
| Claude Code | Yes, native /plugin |
Yes | Yes | Copy the folder |
| Claude app and Cowork | Through Anthropic's directory on claude.ai, not the Claude Code marketplaces | Zip and upload | Zip and upload | Zip and upload |
| Codex | No | Yes | Yes | Copy the folder |
| Cursor and GitHub Copilot | No | Yes | Yes | Copy the folder |
| OpenClaw | No | Yes | Yes (--agent openclaw) |
Yes, native |
"Copy the folder" and "Zip and upload" are manual workarounds that follow from the shared SKILL.md format, not installer features any of these directories document. The skills.sh home page lists 20 supported agents, including Claude Code, Codex, Cursor, GitHub Copilot, Gemini and OpenClaw. GitHub's changelog names GitHub Copilot, Claude Code, Cursor, Codex, Gemini CLI and Antigravity for gh skill, and the gh skill install manual lists many more --agent values, OpenClaw among them. For agent-specific folders, see our guides to Codex skills and Cursor skills.
How do you judge a skill before you install it?
A marketplace listing tells you who published the catalog, not what each skill does. Anthropic's plugin security page puts it plainly: "A Claude Code plugin you install can execute arbitrary code on your machine with your user privileges." Before you install anything:
- Open the source repo. Check who maintains it, how active it is, and whether the skill folder matches what the listing describes.
- Read SKILL.md and every script. Look for network calls,
curl | bashstyle downloads, "prerequisite" steps that ask you to install something, and encoded text. - Check the audit, if there is one. On skills.sh, read all three results and their dates, not only the headline.
- Look at what a plugin adds. In Claude Code, the
/plugindetails pane lists skills, hooks and MCP servers before you install. - Prefer pinned versions. A pinned commit can't change under you after you've read it.
Our Agent Skills security guide goes deeper on what to look for. To find candidates in the first place, the find-skills skill searches skills.sh from inside your agent, and best Claude Code skills is a shorter, opinionated list.
Should you install from a marketplace or keep your own copy?
Installing straight from a marketplace is fastest, and updates arrive without effort. That same convenience means the files you reviewed can change later. Anthropic's security page notes that when auto-update is on, plugin files on disk can change in the background.
Keeping your own copy trades a little effort for control. You review a skill once, store it in a repo you own, and update it on purpose. Trail of Bits recommends curated internal collections and pinned versions for exactly this reason, and teams can host their own private plugin marketplace, as our Claude Code plugin marketplace guide explains.
A practical middle path: browse the marketplaces to discover skills, then copy the ones you trust into your own library. Kipt keeps prompts and skills as Markdown in a private GitHub repo you own. It imports a skill from a GitHub link, a folder or a .zip, and when a repo holds many skills it shows a list so you pick only the ones you want. Every saved skill then installs into Claude Code or Codex with one command, npx skills add https://github.com/<you>/<repo>.git --all -g.