I indexed 75,000 Agent Skills so you can stop installing them blind

Agent Skills are one of the best things to happen to coding agents. A skill is a folder with a SKILL.md file: instructions, sometimes scripts, that Claude Code, Codex, Cursor and dozens of other agents load when a task calls for them.

There's just one problem: finding good ones.

They're spread across skills.sh, claude-plugins.dev, Smithery and thousands of GitHub repositories. Each registry has its own listing, its own popularity numbers, and its own blind spots. And once you find something, you usually install it without reading it, even though a skill runs with your agent's permissions.

So I built skills-atlas: one catalog of every public skill, sorted into themes, that you browse in your terminal or browser and install in one go.

npx skills-atlas

There's also a read-only web demo if you want to look around without installing anything.

Here's what building it taught me.

1. Merging three registries is mostly deduplication

Each source sees a different slice of the ecosystem:

Source	What it gives
claude-plugins.dev	a full listing: ~47,000 skills with descriptions, stars, installs
skills.sh	popularity: its sitemaps rank the 20,000 most installed skills
Smithery	categories (Coding, Design, Security…)
GitHub	the missing descriptions, read straight from each SKILL.md

The same skill shows up in two or three of them, with different casing, different descriptions and different paths. The key that holds up is owner/repo@name, compared case-insensitively. On top of that, one source served Chinese and Japanese text double-encoded in UTF-8, which needed its own repair step.

The result is a snapshot of about 75,000 skills, rebuilt every other day by a GitHub Action and shipped inside the npm package, so the tool also works offline.

2. The registries are full of ghosts

When I started recommending whole repositories, some installs failed. The registries kept listing skills that their repository had renamed or deleted: one popular repository still had 17 entries that no longer existed.

The fix was nearly free. To fill in missing descriptions, the crawler already fetches each repository's file tree from the GitHub API, one call per repository. If a skill's folder isn't in a complete tree, the skill is gone. (A truncated tree proves nothing, so those are left alone.)

The next crawl dropped 412 skills that could only ever fail to install.

3. A path is not always a directory

A user reported that previewing a well-known diagram skill returned a 404 for …/SKILL.md/SKILL.md.

The sources describe where a skill lives in different ways: skills/pdf, skills/pdf/SKILL.md, or just SKILL.md for a skill at the root of its repository. My cleanup only stripped /SKILL.md with a leading slash, so root skills ended up with SKILL.md as their folder. That was 803 skills. On one source it was even worse: the skill's name came from the last path segment, so a root skill could be called SKILL.md.

The fix is one small function, applied wherever a path enters the catalog, and again when reading older snapshots:

export function skillDir(path: string): string {
  return path.replace(/\\/g, '/').replace(/(^|\/)SKILL\.md$/i, '').replace(/^\/+|\/+$/g, '');
}

'' now means "the root", which is different from undefined, "we don't know".

4. Never print untrusted text to a terminal

Pressing p in the tree shows a skill's SKILL.md before you install it. That text comes from any GitHub repository, and terminals interpret escape sequences: a crafted file could clear your screen, rewrite what you see, or change your terminal's title.

So every preview goes through a filter that drops ANSI and OSC sequences and control characters, keeping only printable text, line breaks and tabs. It's a few regexes, and it's covered by a test with a deliberately hostile string.

The same idea applies to installs. Selection files you import and the skill names an AI agent sends to the MCP server are checked before reaching npx skills add. A name starting with - would otherwise be read as a flag.

5. Detecting updates without downloading anything

The skills CLI keeps a lock file. For global installs, it records each skill's skillFolderHash, which turns out to be the git tree SHA of the skill's folder. GitHub's trees API returns the same SHA for every folder in a repository.

So checking for updates is one API call per repository, in the background. If the folder's SHA on GitHub differs from the recorded one, there's a newer version. On my machine that's 20 repositories in about a second.

Updating turned out to be more interesting than detecting. skills update can exit with status 0 after skipping the skill. Reinstalling with skills add for the same agents is reliable, so that's what pressing u does.

(Project lock files record a content hash instead of the folder SHA, so only global skills can be checked this way.)

6. Letting the agent do it

The last step was letting the agents themselves use the catalog. There are three entry points:

• A skill that teaches any agent the non-interactive commands (list --json, show, install -y, outdated --json).
• An MCP server, skills-atlas mcp, with tools like search_skills, show_skill, outdated_skills and install_skills. It implements only the part of the protocol that tools need (JSON-RPC over stdio: initialize, tools/list, tools/call), in about 200 lines and without a new dependency.
• A Claude Code plugin that bundles both with a /skills-atlas command:

/plugin install skills-atlas --marketplace devohmycode/skills-atlas

Now I can ask "find me a skill to draw Mermaid diagrams, read it, and install it for this project", and the agent searches, reads the candidates' SKILL.md, and asks me before installing.

Try it

npx skills-atlas          # terminal tree
npx skills-atlas ui       # local web page

• Repository: https://github.com/devohmycode/skills-atlas
• Web demo: https://devohmycode.github.io/skills-atlas/demo/

It's MIT licensed, has no account and no server, and works with 79 agents.

I'd love to hear two things: are the 20 themes useful for how you look for skills, and which repositories deserve a place in the curated ★ Recommended list?