Most engineering teams already use AI coding agents. The Anthropic skills repository alone has 123K GitHub stars, and obra/superpowers has reached 149K. Yet the majority still run those agents with default instructions, generic prompts, and zero customization. The result: AI that writes plausible code requiring hours of review, cleanup, and rework.
The gap between having an agent and having an effective agent is the skill file.
A SKILL.md file is a structured instruction set that tells an agent exactly how to behave in a specific domain: which patterns to follow, which anti-patterns to avoid, and when to activate. Research on 55,315 skills found that well-structured skill files improved functional quality by 2.8% over unoptimized originals, with less content producing better output. The right skill file transforms a general-purpose assistant into a specialist.
The problem is finding the right ones. More than 900,000 skills are now indexed across marketplaces. Most are low quality. A large-scale study of 55,315 skills found that 26.4% lack routing descriptions entirely, and over 60% of body content is non-actionable filler. Worse, 36% contain security flaws.
This article cuts through the noise. Here are the 21 SKILL.md files that pass the quality bar, grouped by the friction they eliminate, with security context you need before installing any of them.
What Makes a Skill Worth Installing
Before diving into recommendations, it helps to understand what separates a production-grade skill from a bloated prompt dump. The SkillReducer study (arXiv:2603.29919) analyzed tens of thousands of skills and found a counterintuitive result: compressed skills improved functional quality by 2.8% over originals. Less content, better performance. The optimal compression ratio was 48% for descriptions and 39% for body tokens.
That "less is more" finding points to five quality criteria worth evaluating before you install anything.
Trigger Precision
The description field is the only metadata an agent reads for routing. If it is vague, the skill either fires when it should stay silent or stays silent when it should fire. The best skills use precise trigger language and include negative triggers that clarify when to skip activation. Every word in the 1,024-character limit must earn its place.
Token Efficiency
A skill that loads 10,000 tokens of boilerplate into the context window leaves less room for actual work. The recommended range is 1,500 to 2,000 words for the body, with a hard cap of 500 lines. Workflow skills should target 400 to 800 tokens. Tool wrappers should stay under 400. The best skills use progressive disclosure: a lean SKILL.md that routes to reference files for detailed content only when needed.
Information Density
This is the ratio of actionable content (code blocks, specific instructions, structured data) to total text. Higher density means less filler and less context window waste. Skim a skill before installing it. If it reads like documentation rather than routing instructions, it will underperform.
Testability
Skills with acceptance criteria and test scenarios demonstrate reliability. Microsoft's official skills repository includes 1,158 test scenarios across 126 skills. Minko Gechev's skillgrade framework enables unit tests specifically for agent skills. Testable skills are trustworthy skills.
Security Posture
This one is critical enough to warrant its own section.
Before You Install Any Skill: The Security Warning
Snyk's ToxicSkills research revealed stark findings:
- 36.82% of community-authored skills contain security flaws
- 13.4% of those flaws are critical-severity
- 76 confirmed active malicious payloads were found in the skills ecosystem
- 91% of verified malware combined language jailbreaks with executable payloads
Skills are just text files. But text files that instruct an agent to run shell commands, fetch remote resources, or modify system configuration can do real damage when the instructions are malicious. 36.8% of community-authored skills contain security flaws, with 76 confirmed malicious payloads in the wild.
Four verification steps before every install:
- Check the source. Prefer official team repositories (Anthropic, Vercel, Angular, Google Labs, Microsoft) and established security firms (Trail of Bits). Individual maintainer skills require more scrutiny.
- Scan the file. Run npx @snyk/agent-scan or use the OWASP AST10 scanner before adding any community skill to your project.
- Read the content. Look for embedded curl|bash commands, suspicious URLs, instructions to disable security features, or prompts that override system-level protections.
- Use security-scanning platforms. Skills.sh has a partnership with Snyk for supply chain scanning. AgentSkill.sh runs two-layer security scanning and defaults to showing only grade-A skills.
For a complete walkthrough, see our security audit guide for agent skills.
With the security context established, here are the 21 skills worth installing.
The 21 Best SKILL.md Files, Grouped by Category
Code Review and Quality
AI-generated code now accounts for 42% of all committed code, yet 38% of developers say reviewing it takes more effort than reviewing human-written code. These four skills bring review criteria into the generation step, catching issues at authoring time rather than review time.
1. Web Quality Audit
Source: addyosmani/web-quality-skills | Creator: Addy Osmani, Google Chrome team
Friction it eliminates: Lighthouse audits happen late in the development cycle, after anti-patterns are already entrenched. Teams run audits, find 30 issues, and spend the next sprint fixing them. This skill brings those same audit criteria (performance, Core Web Vitals, accessibility, SEO, best practices) into the code generation step so issues are caught during authoring.
What makes it distinctive: each skill includes a table of common excuses agents use to skip steps, with documented counter-arguments. The agent is trained to self-correct before producing shortcuts.
npx skills add addyosmani/web-quality-skills2. React Best Practices
Source: vercel-labs/agent-skills | Installs: 185K on skills.sh
Friction it eliminates: AI-generated React code introduces performance waterfalls, unnecessary re-renders, and bundle bloat. Developers spend hours tracing these issues through profiler flamegraphs. This skill applies 57 performance rules prioritized by real impact, addressing waterfalls before micro-optimizations. It encodes Vercel Engineering's production experience directly into agent output.
npx skills add vercel-labs/agent-skills3. Composition Patterns
Source: vercel-labs/agent-skills
Friction it eliminates: AI-generated React components accumulate boolean props over time ("isLoading", "isError", "isCompact", "showHeader"), creating brittle APIs that break with every new feature. This skill teaches agents to use compound components, render props, and context providers instead, producing component libraries that actually scale.
npx skills add vercel-labs/agent-skills4. Web Design Guidelines
Source: vercel-labs/agent-skills | Installs: 133K weekly on skills.sh
Friction it eliminates: Manual accessibility audits require specialized knowledge and consume hours per page. Teams discover WCAG violations late in QA, triggering expensive rework cycles. This skill audits UI code against 100+ rules covering accessibility, performance, and UX patterns automatically during generation, catching issues before they reach review.
npx skills add vercel-labs/agent-skillsContent Writing and SEO
Writers juggle 3 to 5 tools during a single article: keyword tool, SERP analyzer, readability checker, CMS, analytics dashboard. These skills consolidate that multi-tool workflow into a single agent session.
5. SEO Content Writer
Source: aaron-he-zhu/seo-geo-claude-skills
Friction it eliminates: SEO-optimized content requires simultaneous attention to keyword density, heading hierarchy, meta descriptions, internal linking, featured snippet targeting, and E-E-A-T signals. Writers context-switch between tools for each of these. This skill's 12-step workflow automates the entire process, producing drafts with embedded SEO elements and a self-scored CORE-EEAT checklist.
npx skills add aaron-he-zhu/seo-geo-claude-skills6. Marketing Skills Collection
Source: coreyhaines31/marketingskills | Stars: 12.9K | Skills: 33 across 7 categories
Friction it eliminates: Every marketing task (CRO audits, email copywriting, analytics dashboards) requires context about the product, audience, and positioning. Developers and marketers re-explain that context every session. The product-marketing-context foundation skill loads once, and all 33 subsequent skills reference it, so the business context carries forward automatically.
npx skills add coreyhaines31/marketingskillsTesting and QA
Manual test authoring costs 30 to 45 minutes per scenario. AI-powered test generation has reduced CI/CD pipelines from 47 minutes to 12 minutes while maintaining the same confidence level. In one case study, AI testing generated 2,400 test cases for a single codebase, catching 67 bugs before production.
7. Playwright Skill
Source: lackeyjb/playwright-skill
Friction it eliminates: End-to-end tests are tedious and repetitive. Each scenario requires crafting selectors, writing assertions, handling waits, and managing test data. This skill lets the agent autonomously write and execute Playwright automation with proper Page Object patterns, visual regression support, and CI/CD pipeline templates. A 30-minute manual task becomes a 5-minute agent session.
npx skills add lackeyjb/playwright-skill8. LambdaTest Test Automation Skills
Source: LambdaTest/agent-skills | Skills: 46 | Frameworks: Selenium, Playwright, Cypress, Appium, and 33 more | Languages: 15+
Friction it eliminates: Every test framework has its own patterns, locator strategies, assertion libraries, and debugging quirks. Switching between Selenium and Cypress, or between Java and Python test runners, requires remembering framework-specific boilerplate. These 46 skills encode best practices and common error/fix tables for each framework, eliminating the context-switch penalty across testing ecosystems.
npx skills add LambdaTest/agent-skillsDevOps and Infrastructure
Infrastructure workflows involve repetitive patterns that agents handle well, but only with the right constraints around safety and idempotency. Engineering teams spend an average of 6 hours per week on routine infrastructure tasks: writing Terraform modules, debugging Kubernetes manifests, and configuring CI pipelines. Companies that automate these workflows with AI report productivity gains exceeding 110%. These skills encode infrastructure knowledge directly into agent sessions.
9. Superpowers
Source: obra/superpowers | Stars: 149K | Cross-agent: Claude Code, Cursor, Codex CLI, Gemini CLI, Goose CLI, and more
Friction it eliminates: Multi-step development tasks require developers to hand-coordinate agent work: break the problem into steps, dispatch subtasks, review each piece, then integrate. Superpowers automates brainstorming, plan-writing, subagent dispatch, and code review in a single orchestrated flow with TDD enforcement. The chardet maintainer rewrote chardet v7.0.0 using Superpowers, achieving a 41x performance improvement.
npx skills add obra/superpowers10. Microsoft Azure Skills
Source: microsoft/skills | Skills: 126 (5 core + 121 language-specific) | Test scenarios: 1,158
Friction it eliminates: Azure's service catalog is enormous. Configuring Cosmos DB, Foundry IQ, or AZD Deployment correctly requires navigating documentation across dozens of pages, learning service-specific naming conventions, and understanding language-specific SDK patterns for Python, .NET, TypeScript, and Java. These 126 skills encode that knowledge with 1,158 test scenarios that prove correctness.
npx skills add microsoft/skills11. Stitch Skills
Source: google-labs-code/stitch-skills | Creator: Google Labs | Cross-agent: Antigravity, Gemini CLI, Claude Code, Cursor
Friction it eliminates: Converting design mockups to production code requires manual translation of layouts, spacing, and interaction patterns. The stitch-loop skill enables autonomous website development: generating designs, validating HTML, converting to framework-specific code, and decoupling static content into mock data, all without manual intervention at each step.
npx skills add google-labs-code/stitch-skillsData Analysis and Research
Research workflows typically span 3 to 5 platforms (Reddit, X, YouTube, Hacker News, general web). Data extraction from websites requires custom scrapers per site. These skills provide universal extraction and document generation capabilities.
12. Document Skills: PDF, DOCX, XLSX, PPTX
Source: anthropics/skills | Creator: Anthropic (official)
Friction it eliminates: Agents can describe documents in text, but producing the actual file has always been the gap. These skills create real files: extract PDF form fields, generate branded Word documents, build PowerPoint presentations, and create formatted spreadsheets. This bridges the distance between "tell me about it" and "produce it."
npx skills add anthropics/skills13. Firecrawl
Source: Firecrawl CLI
Friction it eliminates: Agents operate within their training data boundary. When you need current pricing, live documentation, or competitor analysis, the agent is working with stale information. This skill gives agents reliable web scraping, search, and browser automation capabilities, enabling real-time research, content verification, and data extraction during development sessions.
Install: Available via Firecrawl CLI integration
API Design
SDK customization costs 4 to 8 hours per language per API. OpenAPI spec authoring requires deep knowledge of naming conventions and schema patterns that most developers learn through trial and error over months.
14. Speakeasy OpenAPI Skills
Source: speakeasy-api/skills | Skills: 21 covering the full API lifecycle
Friction it eliminates: Writing clean OpenAPI 3.1 specs, generating SDKs across 7 languages, and diagnosing generation failures requires deep protocol knowledge that accumulates slowly. These 21 skills cover the entire lifecycle from spec authoring to SDK generation to failure diagnosis, replacing hours of manual SDK customization per language. The speakeasy-context skill loads foundational knowledge, and specialized skills handle SDK projects, OpenAPI writing, and debugging.
npx skills add speakeasy-api/skillsSecurity
Professional security audits cost $200 to $400 per hour and happen infrequently, usually only at major milestones. Meanwhile, 36% of agent skills themselves contain security flaws. These skills bring continuous security analysis into every coding session.
15. Trail of Bits Security Skills
Source: trailofbits/skills | Creator: Trail of Bits (professional security audit firm) | Skills: 28+
Friction it eliminates: Security reviews are expensive and slow. Most teams defer them until release gates, by which point vulnerabilities are deeply embedded. This skill encodes professional audit firm methodology directly into the agent context: static analysis with CodeQL and Semgrep, SARIF result parsing, variant analysis to find related vulnerabilities, fix verification, and differential review between versions. It brings $300/hour expertise to every session at zero marginal cost.
npx skills add trailofbits/skillsDocumentation
Architecture Decision Records are the highest-value documentation a team can write. Yet most teams skip them because the effort to write exceeds the perceived immediate benefit. README files are perpetually outdated. API docs drift from implementation.
16. Documentation and ADRs
Source: addyosmani/agent-skills | Creator: Addy Osmani, Google Chrome team
Friction it eliminates: ADR write time is typically 30 minutes or more per decision. Most teams skip the practice entirely because the overhead feels disproportionate to the immediate value. This skill generates ADRs following the MADR template with systematic completeness checking, reducing write time to under 5 minutes. It makes the highest-value documentation practice the lowest-effort one.
npx skills add addyosmani/agent-skills17. Skill Creator
Source: anthropics/skills | Creator: Anthropic (official) | Installs: Part of the 277K+ Anthropic skills ecosystem
Friction it eliminates: Writing a good SKILL.md file requires understanding frontmatter conventions, trigger optimization, progressive disclosure patterns, and token budgets. Most developers learn these requirements through trial and error, reading other skills, and debugging unexpected behavior. The skill-creator skill provides interactive guidance for building team-specific workflow automation, turning a 2-hour research task into a 15-minute guided session.
npx skills add anthropics/skillsFramework-Specific and Creative
Framework APIs change faster than agents learn. Developers generate Angular or Remotion code only to discover the agent used deprecated patterns from two versions ago. These skills keep agent output current with the latest framework conventions.
18. Frontend Design / Impeccable
Source: anthropics/skills + pbakaus/impeccable | Installs: 277K+ (Anthropic original) | Cross-agent: Cursor, Claude Code, Gemini CLI, Codex CLI
Friction it eliminates: AI-generated UIs default to generic aesthetics: Inter font, muted grays, uniform spacing. Every prototype looks the same. This skill injects a design philosophy before code generation begins: bold typography choices, cohesive color palettes with sharp accents, and purposeful animations. Impeccable extends the Anthropic original with 18 commands and 25 anti-pattern detection rules covering typography, color, layout, motion, and quality.
npx skills add anthropics/skillsnpx skills add pbakaus/impeccable19. Angular Developer
Source: angular/skills | Creator: Angular team (official)
Friction it eliminates: Angular's API surface is large and evolving. New features like signals, linkedSignal, and resource change how components should be written, but agents trained on older patterns keep generating outdated code with decorators and lifecycle hooks that the team has moved past. The official skill uses progressive disclosure through 30+ reference files, keeping the agent current on reactivity, forms, dependency injection, routing, SSR, accessibility, and testing.
npx skills add angular/skills20. Remotion Best Practices
Source: remotion-dev/skills | Installs: 150K (reached in 8 weeks) | Ranking: #1 among non-platform creators on skills.sh
Friction it eliminates: Programmatic video generation with React requires understanding 28+ rule domains: animations, audio sync, captions, 3D rendering, FFmpeg encoding. Agents produce Remotion code that renders incorrectly or uses deprecated APIs because the framework's surface area is too large to encode in training data alone. This skill loads rule files dynamically based on what the developer is building, providing targeted guidance for each domain.
npx skills add remotion-dev/skills21. Skills Best Practices (Meta-Skill)
Source: mgechev/skills-best-practices | Creator: Minko Gechev, Angular team lead at Google
Friction it eliminates: Most custom skills are bloated and ineffective because developers treat SKILL.md files like documentation rather than routing instructions. This meta-skill teaches agents (and developers) how to write professional-grade skills: name conventions, trigger-optimized descriptions, token budgets, and testing with the skillgrade framework. Install this one first if you plan to write your own skills.
npx skills add mgechev/skills-best-practicesTwo Frameworks for Evaluating Any Skill
Before you install a skill outside this list, two mental models help separate signal from noise.
Capability Uplift vs. Encoded Preference
Firecrawl's analysis framework divides skills into two categories:
- Capability Uplift skills enable abilities the agent fundamentally lacks. Firecrawl for web access, Document Skills for file creation, Webapp Testing for browser automation. These deliver the highest marginal value because they unlock entirely new workflows.
- Encoded Preference skills encode team-specific patterns the agent already conceptually understands. React Best Practices, Frontend Design, Superpowers. Their value scales with how specific and opinionated the preferences are. Generic preferences add little. Highly specific ones (like Osmani's "excuse table" approach) add a lot.
When budgeting context window space, prioritize capability uplift skills first, then layer encoded preferences on top.
The SkillReducer Test
If a skill's body is mostly paragraphs of advisory text ("consider using...", "be careful about..."), it is probably filler. The SkillReducer study showed that removing 60% of a skill's body content often improved performance by 2.8%. Look for skills that lead with code blocks, structured data, and directive instructions. Hedge-heavy skills waste context tokens.
Where to Find More Skills
| Criteria | Skills Indexed | Key Feature | URL |
|---|---|---|---|
| Skills.sh (Vercel) | 90,000+ | Real-time leaderboard ranked by install telemetry, Snyk security partnership | skills.sh |
| SkillsMP | 900,000+ | Smart search with occupation-based filtering | skillsmp.com |
| LobeHub Skills | 169,739 | Polished discovery experience within LobeHub ecosystem | lobehub.com/skills |
| ClawHub | 13,000+ curated | Semantic vector search with natural language queries | clawhub.ai |
| AgentSkill.sh | 110,000+ | Two-layer security scanning, grade-A default filter | agentskill.sh |
| Agensi | 10,000+ | Only marketplace with paid skills ($5 to $15), creator monetization | agensi.io |
| GetAgentSkills | 10,000+ | Premium tier ($299 one-time) with executable code skills and multi-agent orchestration | getagentskills.com |
| Agent-Skills.md | Community | Submit any GitHub URL pointing to a skills folder; minimal browse-focused interface | agent-skills.md |
| Skills Directory | Curated | Security-first approach with all skills verified and tested; grade-A default filter | skillsdirectory.com |
Curated GitHub collections worth bookmarking:
anthropics/skills (123K stars) for official, high-quality baseline skills
ComposioHQ/awesome-claude-skills (51.7K stars) for community-verified skills with editorial curation
VoltAgent/awesome-agent-skills (16.5K stars) for cross-agent compatible skills covering Claude Code, Codex, Gemini CLI, and Cursor
sickn33/antigravity-awesome-skills (1,400+ skills) with npm CLI installer and workflow bundles
block/agent-skills for skills compatible with Goose (Block's open-source agent framework) and Claude Desktop
What to Do Next
Browse the full directory. Our Skills Hub provides editorially scored recommendations across every category, with quality ratings, security assessments, and friction-first descriptions for each skill.
Verify before you install. Read our security audit guide for agent skills to understand how to vet any skill before adding it to your project. With 36% of community skills containing security flaws and 76 confirmed malicious payloads in the ecosystem, verification is a required step.
Start with three. Pick one Capability Uplift skill (Document Skills, Firecrawl, or Trail of Bits Security) and two Encoded Preference skills from your primary stack (React Best Practices + Composition Patterns for React teams, Angular Developer for Angular teams, Speakeasy for API-first teams). Measure the difference across one sprint before expanding your skill set.
