How to install and use agent skills in Claude Code, Cursor and Codex (with a free plugin marketplace)

Kevin Blancaflor — Sat, 31 Oct 2026 23:27:13 +0000

Agent skills are one of the most useful features of coding agents, and one of the least explained. This guide covers what a skill is, the three ways to install one, how the Claude Code plugin marketplace works, and what makes a skill actually get used.

For the examples I'll use a repo I maintain: nex-ai-skills, 79 free MIT-licensed skills. Any skills repo works the same way.

What a skill is

A skill is a folder with a SKILL.md file:

secret-scan/
  SKILL.md
  scripts/        # optional
  references/     # optional

SKILL.md starts with YAML frontmatter:

---
name: secret-scan
description: "'Find leaked API keys and tokens in files, commits or history."
  Use when: checking a repo before making it public; blocking commits that
  contain keys; stopping the agent from hardcoding a key.'
license: MIT
---

Below the frontmatter are normal Markdown instructions.

The important part is progressive disclosure. At startup the agent reads only the name and description of each skill. It loads the full body, and any scripts or references, only when your request matches the description. So you can install dozens of skills without filling your context window, unlike one giant CLAUDE.md or rules file.

Option 1: the Claude Code plugin marketplace

Claude Code can install skills from any Git repo that has a .claude-plugin/marketplace.json file. A marketplace lists plugins, and every plugin bundles one or more skills.

Add the marketplace once:

/plugin marketplace add NexaiGuy/nex-ai-skills

Then install only the plugin you need:

/plugin install nex-dev-essentials@nex-ai-skills

The format is plugin-name@marketplace-name. Run /plugin without arguments to browse what's available, enable or disable plugins, or update the marketplace later.

This is the best option for teams: commit the marketplace to your project settings and everyone gets the same skills.

A minimal marketplace.json looks like this:

{
  "name": "nex-ai-skills",
  "owner": { "name": "Nex AI", "url": "https://nex-ai.be" },
  "plugins": [
    {
      "name": "nex-dev-essentials",
      "source": "./plugins/nex-dev-essentials",
      "description": "Secret scanning, checkpoints, context files"
    }
  ]
}

Each plugin folder has its own .claude-plugin/plugin.json and a skills/ directory.

Option 2: the skills CLI (Cursor, Codex, Claude Code and others)

The open-source skills CLI installs skills into many agents from the same source:

# pick skills interactively
npx skills add NexaiGuy/nex-ai-skills

# one specific skill
npx skills add NexaiGuy/nex-ai-skills --skill secret-scan

# target a specific agent
npx skills add NexaiGuy/nex-ai-skills --skill secret-scan -a cursor
npx skills add NexaiGuy/nex-ai-skills --skill secret-scan -a codex

Public repos installed this way also show up on skills.sh, which is a good place to find skills from other people.

Option 3: copy the folder

No tooling needed. Copy the skill folder into the agent's skills directory:

Agent	Project-level path
Claude Code	`.claude/skills/`
Cursor	`.cursor/skills/`
Codex	`.codex/skills/`

Restart the agent or start a new session, and the skill is discovered.

Using a skill

You usually don't call skills by name. You describe the task:

I'm about to make this repo public. Check it for leaked keys first, including old commits.

The agent sees that the request matches the secret-scan description and loads the skill. In Claude Code you can also call a skill explicitly with /skill-name, or ask "which skills do you have?" to check what's loaded.

If a skill never triggers, the problem is almost always the description and not the body.

Writing descriptions that trigger

From writing a few hundred of these, here's what works:

One job per skill. "Audit a landing page for conversion blockers and rank them by severity" triggers reliably. "Marketing expert" doesn't.
Put "Use when:" phrases in the description in the words users actually type, like "before making a repo public" or "check my site for EAA compliance".
State limitations in the body. For example: "Analyzes HTML/CSS only, does not judge copywriting." This stops the agent from over-promising.
Watch the name rules. Names are lowercase with hyphens, and reserved words like claude or anthropic aren't allowed. My claude-md-writer had to become md-context-writer.
Keep the body short and move detail into references/. It's only loaded when needed.

What's in the repo

The 79 skills are split into six plugins, so you only install what you need:

nex-dev-essentials: secret scanning, an agent checkpoint before risky changes, writing and auditing AGENTS.md/CLAUDE.md, hardening AI-generated prototypes
nex-web-audits: landing-page conversion, EU accessibility (EAA / WCAG 2.1 AA), making a site readable for AI agents
nex-compliance: EU e-invoicing (DE/FR/ES/PL), GDPR registers, EU webshop law, ISO 27001 for SMEs
nex-browser-extensions, nex-finance-property, nex-business-operations

A transparency note: each folder in the repo has the skill's SKILL.md. Some skills reference scripts or templates from their original package that aren't in the repo yet. I'm adding them over time. The complete free packages, and my paid skills, are on Agensi. Disclosure: I'm the author of all of them.

Issues and PRs are welcome, and I'm especially interested in descriptions that trigger when they shouldn't.

I'm Kevin, I run Nex AI, a small applied-AI studio in Ghent, Belgium. This article was written with AI assistance and reviewed and tested by me.

DEV Community: Kevin Blancaflor