DEV Community: Skillselion

The number 2 most-installed agent skill is seven lines long and delegates all of them

Skillselion — Sun, 30 Aug 2026 08:18:32 +0000

At 1,005,653 installs, the second most-installed agent skill in our catalog is seven lines long. Not seven hundred. Seven. As of August 30, 2026, Matt Pocock's grill-me skill trails only the find-skills skill from Vercel Labs, which holds 3,170,600. The installed file writes no code and contains no method. Its one working instruction hands off to a sibling.

Disclosure: we run Skillselion, an independent catalog refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. We read both files line by line at commit 885e2ca of mattpocock/skills on August 20, 2026, as part of our deep dive series. Every quote below is from that commit.

What does the seven-line grill-me skill actually do?

Call the Skill tool with "grilling".

Source: SKILL.md, full file at the grill-me folder in mattpocock/skills

That is routing, not laziness. The repo keeps one method skill named grilling and points two trigger skills at it: grill-me for plans, and the grill-with-docs skill for architecture decisions against a live codebase. grill-with-docs is itself at 856,939 installs, third in the catalog. The dependency matters when you install: seven lines have nothing to fall back on, so grill-me does nothing unless the grilling skill is present too.

Why can the agent not start grill-me by itself?

disable-model-invocation: true

Your agent cannot fire grill-me on its own. You say "grill me", or nothing happens. For a skill whose entire output is questions aimed at you, that is the right lock. The interesting part is where the lock is not: grilling, the method underneath, carries no such flag, and its description invites the agent to reach for it when you seem to want your thinking stress-tested. The trigger phrase belongs to you. The method keeps its own judgment.

How does grill-me structure its questions?

The method models your plan as a tree where every decision branches into the decisions hanging off it. The set of questions whose prerequisites are already settled is called the frontier, and the agent asks the whole frontier in one numbered round:

❓ Q1 - <question title>: <question body>
➡️ <your recommended answer>

Each question ships with the agent's own recommendation, so you can answer "yes to your suggestion" instead of writing an essay. A question that depends on another still-open question belongs to a later round, explicitly. Every answered round reshapes the tree.

How does grill-me avoid asking you to run ls?

Finding facts is your job, never the user's.

Source: grilling SKILL.md

Anything the agent could look up in the environment, it dispatches a sub-agent to find instead of asking you. A running lookup counts as an unsettled prerequisite, so only the questions downstream of it wait while the rest of the frontier gets asked. You never get asked to run ls.

The exit condition is testable rather than vibes based: the session ends when the frontier is empty, and even then the agent must not act until you confirm you have reached shared understanding.

What changes once grill-me is installed?

You say	Without grill-me	With grill-me
"Grill me on this plan"	The agent agrees and starts building	Numbered question rounds until no branch is silently assumed
"We should add a Postgres cache here"	"Great idea", then an implementation	The frontier fills with invalidation, the local dev story, and who owns the schema

npx skills add https://github.com/mattpocock/skills --skill grill-me

Install notes and the trigger vocabulary are in the grill-me guide.

Why do mattpocock/skills entries hold seven of the top ten?

Look at the top ten by installs on August 30, 2026 and seven slots belong to skills from the mattpocock/skills repository. The tell is the setup-matt-pocock-skills skill at 734,383 installs in eighth place. That skill does nothing but scaffold the per-repo configuration the other skills assume: issue locations, triage labels, domain-doc layout. On its own it is useless. The likeliest read is that people install the author's stack rather than picking individual files. The tdd skill at 797,033 and the improve-codebase-architecture skill at 824,417 ride the same wave.

The other pattern in that list: skills that stop the agent outrank skills that make it produce. The same shape shows up across the August 2026 agent economy census. If you want to compare planning skills against each other, the docs and planning hub ranks that category, and the full skills catalog covers the rest.

Install counts are live as of August 30, 2026. Quotes are from commit 885e2ca, verified August 20, 2026.

Vercel's web-design-guidelines skill is 39 lines long and contains zero rules

Skillselion — Sat, 29 Aug 2026 08:04:00 +0000

The UI review skill with 587,920 installs (August 29, 2026, Skillselion catalog) does not contain a single accessibility rule. web-design-guidelines, Vercel's UI review skill, is 39 lines including frontmatter, and every rule it checks lives in a second repository it fetches at review time, from a URL that tracks main.

We run Skillselion, a directory of Claude Code, Codex and Cursor extensions ranked by real installs, and we read the skill file at commit b8caa26 of vercel-labs/agent-skills for our deep dive on the skill. Here is what the architecture actually implies for your reviews.

The file is an instruction to go get instructions

One sentence defines the whole design:

Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.

Both halves of a review live somewhere else: what to check, and how to print what you find. The repo's README advertises "100+ rules covering accessibility, performance, and UX", and that number appears nowhere in the skill file. It arrives by download when the review runs.

That means the skill needs the network, and it asks for it by naming WebFetch, a Claude Code tool. In a sandboxed CI runner, or under an agent with no equivalent fetch tool, the skill still loads and still triggers, with nothing to check your code against.

The rules changed on August 18 and your install did not

The fetch target is raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md. main is a branch. GitHub's history for that path shows five commits, three of them dated August 18, 2026, adding accessibility and media rules and revising the curly-quote guidance.

So a component that came back clean in July can come back with findings in August, and the diff that caused it sits in vercel-labs/web-interface-guidelines, a repository you do not depend on and were never asked to watch. Your rules improve when Vercel improves them, which is the defensible intent. The bill arrives as reproducibility: two reviews of unchanged code, weeks apart, can legitimately disagree.

Teams that need a review to hold still have the usual escape hatch: vendor the rules file into your own repo and point the agent at your copy.

The sheet it fetches is missing the rules with numbers in them

Vercel publishes three rule documents in the guidelines repo. Read on August 20, 2026: the README carries 129 rule bullets, AGENTS.md carries 107 written as MUST, SHOULD and NEVER, and command.md, the one this skill hard-codes, carries 103.

The coverage gap is not random. Under "Targets & Input", AGENTS.md holds two MUST rules the command sheet has no equivalent of: a hit target of at least 24px (44px on mobile), and a mobile input font size of at least 16px so iOS Safari stops zooming on focus. The command sheet also drops focus management, tooltip timing and most of the README's Design section.

Ask this skill "are my tap targets big enough?" and you get a guess. The fetched sheet carries no minimum hit-target rule, and nothing in the report tells you the question was out of scope.

What it does cover is worth having: ARIA labeling and semantic elements, focus-visible rings, form autocomplete, compositor-friendly animation, Intl formatting, hydration-safe inputs. The gap is a subset problem, not a quality problem.

It is a template, and the copies inherit Vercel's edits

The same repo ships writing-guidelines, the prose review skill: the same file with five lines changed (name, description, heading, summary, URL). Any raw markdown URL can become a review skill this way, and every skill built this way needs the network at review time and tracks a branch somebody else controls.

Our Agent Skill Clone Census, frozen at August 12, 2026, ranks web-design-guidelines the second most-copied original in the catalog: 36 identical or near-identical copies, behind Anthropic's frontend-design at 59. Each copy inherits the one URL, which points into a repository the copier does not control. The copies that keep that URL fetch Vercel's rules on every run and inherit Vercel's edits, which is an unusual property for a fork to have.

Contrast the sibling skill in the same repo: vercel-react-best-practices, the React performance skill, ships 70 rule files on disk after install. Same author, opposite architecture.

Should you install it?

Install it if you review UI in Claude Code and want the check driven by a published external standard instead of whatever the model feels strongly about that session. The rules on the other end are genuinely good, and the cost of keeping them current is one fetch per review.

Skip it if your agent runs without network access, or if your reviews need to be reproducible. Vendor the sheet instead.

If you want the generation-side counterpart, the guidelines repo pairs this skill with its AGENTS.md on purpose: the skill reviews what exists, AGENTS.md shapes what gets generated. Installing the skill does not put AGENTS.md in your project.

For the taste-layer alternatives developers actually cross-shop, see our hub of frontend design skills: Anthropic's frontend-design generates UI under a design brief, impeccable applies Paul Bakaus's design playbooks, ui-ux-pro-max looks up palettes and WCAG rows, and design-taste-frontend is the landing-page taste layer. web-design-guidelines is the only one of the five that generates nothing: it grades the files you already have.

Every quote above is verified against the repository at the commit named, section by section, in the full deep dive. The dive series index is at Deep Dives, and the full catalog at the skills directory.

Disclosure: we run Skillselion. Counts come from our live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs.

Anthropic's frontend-design skill names the three cliché "AI looks", hex codes included

Skillselion — Fri, 28 Aug 2026 08:22:40 +0000

Anthropic ships an official Claude Code skill whose whole job is stopping your agent from designing the same page every other agent designs. It is called frontend-design, it is 55 lines of prose with no scripts and no component library, and it has 825,477 installs as of the August 27, 2026 Skillselion catalog sync, which makes it the third most-installed agent skill overall.

We read the file line by line for the frontend-design deep dive on its listing page. Disclosure: we run Skillselion, the directory the dive lives on.

The part worth your attention is one paragraph in the middle. Anthropic describes, with a hex code, exactly what AI-generated design collapses into when nobody stops it.

The paragraph to screenshot

"AI-generated design right now clusters around three looks: (1) a warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style layout with hairline rules, zero border-radius, and dense newspaper-like columns. All three are legitimate for some briefs, but they are defaults rather than choices."

Source: SKILL.md, "Process" section, anthropics/skills on GitHub. Quotes verified against the upstream file on August 19, 2026; the file last changed June 9, 2026.

If you have shipped an agent-built landing page this year, you have probably shipped look number one.

A blacklist became a description, and that is the interesting engineering

The earlier version of this skill banned aesthetics by name: Inter, Roboto, purple gradients on white. The rewrite drops the blacklist entirely and replaces it with descriptions of the failure modes. A banned-fonts list rots the day a new default font appears. A description of the cliché generalizes: the agent can recognize the cream-serif-terracotta pattern in any font, any framework, any year.

That is a prompt-engineering pattern worth stealing for your own skills: describe the failure mode you want avoided instead of enumerating instances of it.

What the other 50 lines do

The file changes agent behavior in eight moves. The short version:

A focused trigger. The frontmatter description scopes it to visual design for new or reshaped UI, so it does not fire on every request that touches pixels.
A role with stakes. "Approach this as the design lead at a small studio" whose client "has already rejected proposals that felt templated". The load-bearing line: "take one real aesthetic risk you can justify".
Subject grounding. If the brief is vague, the agent must pin a concrete subject, audience, and the page's single job before designing, out loud.
Six design principles. One paragraph each: hero as thesis, typography as personality, "Structure is information", motion as "an orchestrated moment", complexity matched to the vision, and copy as a principle of its own.
The calibration warning. The three looks above.
A two-pass process. Plan a compact token system (named palette, type pairing, layout, one signature element), then critique the plan for genericness before writing any code. Code comes third.
A restraint rule. "Spend your boldness in one place", plus Chanel's mirror advice: remove one accessory.
A writing chapter. Roughly a fifth of the file is about words: "A person manages notifications, not webhook config", "Save changes" not "Submit", and errors that never apologize and are never vague.

The full walkthrough with every quoted section lives in the deep dive on the frontend-design listing.

What it will not do for you

Two honest caveats from our read. It optimizes for distinctiveness, so on plain internal tools it can over-art-direct; constrain it with your own brief. And it contains almost no engineering: one CSS-specificity warning and a quality floor (responsive, keyboard focus, reduced motion), no accessibility depth, no performance budgets. It tells your agent what designed means, not how to ship it.

One more thing to check before installing: a repackaged clone of this skill circulates under a different owner. Verify the repo owner is anthropics.

Where it sits in the taste stack

frontend-design is the biggest entry in a cluster of skills that all attack the same problem: agent output that looks generated. If you are building out a design-side setup, these are the neighbors, with installs as of the same August 27 catalog sync:

Grill Me, the plan-interrogation skill by Matt Pocock, 985,753 installs. It now sits above frontend-design at number 2 overall; the two are often installed together, one for the plan, one for the pixels.
anti-ui-slop, the UI cliché blocker, 528,289 installs. The community's harder-edged answer to the same three looks.
web-design-guidelines by Vercel Labs, 582,881 installs. Built on explicit rules where frontend-design leans on a role; a useful contrast in approach.
design-taste-frontend, the taste layer, 410,792 installs, and its sibling minimalist-ui skill.
impeccable, the frontend polish skill, 250,618 installs, for the final polish pass.
emil-design-eng, Emil Kowalski's design-engineering skill, 233,965 installs, for the motion-and-microinteraction end.

We keep the whole category ranked by real installs on the frontend design skills hub, and the section-by-section reads for other major skills in the Deep Dives library. If you want to see how a discovery skill does the instructions-only trick at even larger scale, the find-skills listing sits at 3,135,861 installs, and the broader skills directory is refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs.

Install line, if you want it:

npx skills add https://github.com/anthropics/skills --skill frontend-design

825,477 installs, as of the August 27 sync, for a file that is mostly a client brief. Read the file before you let it art-direct you.

8,433 MCP Servers, Zero Install Counts: What Star-Ranked MCP Lists Actually Measure

Skillselion — Wed, 26 Aug 2026 02:48:22 +0000

On 2026-08-14 we dumped every MCP server in the Skillselion catalog and counted what the rankings you read are made of. The result became the MCP Server Census: 8,433 servers from 5,392 publishers, and not one of them carries an install count.

Disclosure: we run Skillselion, the directory this data comes from.

No install number exists. Not a low one, none at all.

Agent skills report installs through public registries, which is how our Agent Economy Census can count 158M installs across 79,827 listings. MCP has no per-server install event. All 8,433 servers in the census carry no install figure. Partial signals exist (npm, PyPI and Docker download counters for servers shipped as packages), but nothing that covers the ecosystem.

So every "top MCP servers" table you have seen ranks on something else. Usually stars.

Stars belong to the repository, not the server

79.8% of servers (6,731) map to a GitHub repository, and 175 repositories host more than one server, covering 969 servers. Each of those servers inherits the star count of whatever it ships inside.

Concretely: the Metabase MCP server shows 48,750 stars, which belong to the business-intelligence platform. The PostHog MCP server shows 37,662, earned by the analytics product. ByteDance's UI-TARS browser MCP server inherits 38,581 stars from the desktop app it lives with. The top of a star-ranked MCP table is largely a list of whole products, with a server attached.

The inequality is close to the theoretical maximum

Run a Gini coefficient across the star counts of all 8,433 servers and it comes out at 0.986. The top 1% (84 servers) hold 89.1% of every star in the ecosystem. The top ten alone hold 43.6%. Meanwhile 54.9% of servers have never been starred once, and the median starred server holds 5.

Publish an MCP server today and the most likely measurable outcome is silence.

The code is alive anyway

Half the catalog having zero stars sounds like abandonware. The push dates disagree: of the 5,926 servers with a last-push date, the median pushed about 50 days ago, and 43.4% pushed within the last 30 days. Only 6.2% of dated servers have gone six months untouched. Stars measure visibility. They do not measure whether anyone is working on the thing. We ran the same test on agent skills in the Maintenance Census and found the same disconnect.

87.3% of publishers ship exactly one server

5,392 publishers account for the census, and 4,707 of them published a single server. The ten largest publishers together hold only 11.27% of all servers, nothing like the suite concentration in the skill economy. The largest publisher by volume, CSOAI-ORG, ships 192 servers that hold 15 stars between them. Volume is cheap here. Being noticed is not.

What to check instead of stars

Recency: last push under 60 days beats a four-digit star count from a repo the server shares. The MCP server directory exposes recency per listing, and the ranked MCP servers for the build stage apply it.
Repo scope: check whether the stars are for the server or for a product it ships inside.
Audit trail: our Security Census found most of the ecosystem has never been audited; the Clone Census measures how much of it is copies.
Publisher shape: a one-server publisher and a 192-server publisher carry different maintenance expectations.

Every number above is frozen to 2026-08-14 so you can check it; the dataset and limits are in the research methodology. Our catalog is not the whole ecosystem (PulseMCP reported 22,070 servers the same day), which is exactly why none of these numbers claims to measure usage.

Nearly half of all AI agent skill installs run on code pushed in the last 7 days

Skillselion — Sat, 15 Aug 2026 17:32:50 +0000

Disclosure: I work on Skillselion, an independent directory of Claude Code, Codex and Cursor extensions, not affiliated with Anthropic, OpenAI or Cursor. This post is built entirely on a public dataset we published and froze, so you can check every number yourself.

We expected a graveyard. We read the last-push date of the repository behind every listing in our catalog, 79,848 of them, and got the opposite result. Weight every listing by its installs and take the median: the code behind it was pushed six days before the census date. 79,875,458 installs, 48.5% of all installs in the census, sit on repositories pushed within the previous seven days. 66.8% sit on code pushed within the previous month. The unweighted median listing is 26 days old, so the code people actually install is fresher than the catalog at large.

The full study, with the frozen numbers and the CSV, is The Agent Skill Maintenance Census.

Half the catalog idles, and almost nobody installs it

The tail behaves nothing like the core.

Staleness cutoff	Share of dated listings	Share of installs
No push in 30 days	47.9%	23.8%
No push in 90 days	28.2%	2.6%
No push in 180 days	9.5%	1.0%

Idle code exists in bulk, but almost nobody installs it. At the 90 day cutoff more than a quarter of dated listings qualifies as quiet, and all of it together accounts for 2.6% of installs.

The two largest stale listings in the census are humanizer-zh at 43,355 installs and 204 days, and design-doc-mermaid at 32,625 installs and 225 days. Both are small next to anything in the live core of the skills catalog.

Three listings out of 75,800 went a year without a push

That is not a typo. Exactly three, and between them they hold zero installs.

This is a young distribution format. It took off in late 2025 and has not existed long enough to decay. The honest reading cuts both ways: nothing here has survived long enough to prove it lasts either. The 180 day bucket, 9.5% of dated listings today, is the number worth watching edition over edition.

The uncomfortable one: the risky code is the fresh code

If you assume unmaintained code is where the security risk lives, this dataset disagrees.

Cross this census with our security census and the overlap of listings that are stale past 180 days, shell-capable, and never audited by any provider comes to 208 listings holding 7,335 installs. The security census's full audit blind spot holds 15,858,667 installs.

So more than 99% of the unaudited, shell-capable install mass sits on actively maintained code. Waiting for a repository to go quiet before you worry about it will not find the exposure, because almost none of it is there.

If you audit agent extensions, that reorders the queue: sort by install count and permission surface, not by last commit date. The security category hub lists the tooling side of that job.

Does a recent push mean a skill is safe?

No. Two limits, stated because they change how you should cite this.

pushed_at is repository level. A monorepo holding fifty skills refreshes all fifty with one commit, so per-skill freshness is overstated wherever large multi-skill repositories dominate. Staleness stays reliable in the other direction: an untouched repository is untouched for every skill inside it.

And a push timestamp measures activity, not quality or safety. All it tells you is that someone was in the repository recently.

75,800 listings, 94.9% of the catalog and 90.6% of installs, carry a usable date and form the denominator for every staleness figure here. 259 rows report an epoch-zero timestamp, a registry artifact, and are excluded along with the remaining undated rows.

The rest of the series

Each of these is a frozen edition with its own downloadable dataset:

The Agent Skill Security Census covers who audits agent skills and what the five providers disagree about.
The Agent Use-Case Census covers what people actually point agents at.
The Agent Skill Clone Census covers duplication and forks across the catalog.
The Agent Economy Census covers publisher concentration and the install Gini.
The State of AI Agent Skills 2026 carries the live totals rather than a frozen edition.
Everything else sits on the research index.

If you would rather browse than read, the MCP servers and marketplaces listings are the two ranked shortlists worth starting from, and the AI and agents category is the closest hub to this dataset.

Sources: live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs.

The census CSV is CC BY 4.0. Numbers are frozen to 2026-08-12, so anything you quote stays checkable. The full edition, the per-cutoff tables and the CSV are at The Agent Skill Maintenance Census.

Skillselion Agent Skill Maintenance Census, August 2026
https://skillselion.com/research/agent-skill-maintenance-census-2026-08

One thing I want to hear from this comment section: when you vet an agent skill before installing it, do you look at the last commit date at all? If yes, what does it change for you?

87.8% of AI Agent Skills Have Never Been Audited: 41,791 Verdicts Across 79,848 Listings

Skillselion — Thu, 13 Aug 2026 08:25:05 +0000

Security audits of AI agent skills go where the installs are: the audited 12.2% of listings holds 83.3% of all installs, and the other 70,090 listings have no published review at all.

That is the core finding of the Agent Skill Security Census, a frozen-edition study published this week. Disclosure: I run Skillselion, the independent directory behind the census. It is not affiliated with Anthropic, OpenAI, or Cursor. Every number below is frozen to August 12, 2026, and you can re-derive all of it from the CSV linked on the census page.

Why this week, of all weeks

Agent security stopped being theoretical this month. At Black Hat USA 2026 on August 5, researchers from Novee Security showed that an unprivileged GitHub issue could reach CI runner secrets in the vendors' own repositories for Claude Code and Gemini CLI, and on OpenAI's Codex repository could hijack the next agent run. The Claude Code flaw, CVE-2026-54316, abused Hugging Face's public download counter as a covert channel, leaking an API key character by character. It was fixed in Claude Code 2.1.163. The Gemini CLI bug scored a perfect CVSS 10.0.

In the same stretch, the Claude Code v2.1.228 release hardened skills synced from claude.ai: synced skills can no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and their bodies no longer run ! commands or expand @ files on your machine.

Vendors patched the harnesses this month. Nobody had measured the skill ecosystem itself, so we did.

What the census counted

The census is a complete dump of the Skillselion production catalog taken on August 12, 2026: 79,848 listings and 164,841,042 cumulative installs, drawn from a live catalog refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. On top of that catalog sit 41,791 audit verdicts published by 5 independent providers: Socket, Snyk, Gen Agent Trust Hub, ZeroLeaks and Runlayer. The census counts each listing's worst verdict as its risk level and never re-scores anything itself.

For the market-shape numbers behind the same catalog, the companion Agent Economy Census is the place to look, and the live-updating totals live in The State of AI Agent Skills 2026.

Audits follow installs, almost nowhere else

9,758 listings, 12.2% of the census, carry at least one audit. That thin slice holds 137,238,408 installs, which is 83.3% of every install counted. The median audited listing has about 1,700 installs. The median unaudited one has 7.

Auditors triage by popularity. That is rational, and it genuinely protects the crowd: five out of six installs land on code somebody has reviewed. It also means 70,090 listings sit in the dark, and the census puts it bluntly: "If you install from the long tail, you are the review."

More than half of audited skills carry flags

Take the worst verdict each audited listing received and 55.7% land at MEDIUM or above. 1,346 listings are flagged HIGH or CRITICAL, and together they hold 15,221,597 installs. 1,366 listings, 14.0% of everything audited, fail at least one provider's audit outright.

A flag records capability and findings: shell execution, browser control, network reach. The census is explicit that a flag is never an accusation of malice, and the next section shows why that distinction matters.

The flagged list includes every major vendor

The most striking table in the study is who shows up flagged. These are per-listing public verdicts, visible on each listing page:

Skill	Publisher	Worst verdict	Installs	Listing	Repo
azure-validate	Microsoft	CRITICAL	517,228	Skillselion	GitHub
agent-browser	Vercel Labs	HIGH	659,465	Skillselion	GitHub
skill-creator	Anthropic	HIGH	348,833	Skillselion	GitHub
pdf	Anthropic	HIGH	177,212	Skillselion	GitHub
playwright-cli	Microsoft	HIGH	116,690	Skillselion	GitHub

By publisher, ByteDance Lark leads flagged install mass with 9 flagged listings and 2,440,132 installs, ahead of Microsoft (14 flagged listings, 1,153,302 installs), Vercel (24, 731,729), Anthropic (13, 577,993), Google (11, 94,343) and OpenAI (12, 50,785).

Read those flags correctly. A CRITICAL on azure-validate describes what a deploy-validation tool can reach, and a HIGH on a browser driver tracks the fact that it drives a browser. Risk in this ecosystem concentrates in the most useful, most installed code, whoever publishes it. That is exactly why "big vendor" is a poor proxy for "nothing to review."

What to do before you install a skill

Concrete steps that follow from the data, frozen date and all:

Check the listing's audit verdicts first. 99.6% of audited listings carry verdicts from at least two providers, so a popular skill with zero verdicts is a signal in itself. Start from the security category or the full skills catalog.
Read declared permissions. Shell plus network in one skill means code that can both execute commands and phone out. The census found 2,754 such listings carrying 51,755,286 installs.
Treat an unaudited long-tail skill as unreviewed code, because that is what it is. The median unaudited listing has 7 installs; nobody went before you.
If your agent loads skills at runtime over MCP, the same questions apply to the server you connect.
Unfamiliar with the audit vocabulary? The glossary covers the terms the verdicts use.

Reproduce it yourself

The full dataset, 79,848 rows with per-provider verdicts, worst risk level, declared permissions and installs, is downloadable from the census page under CC BY 4.0 (1.8 MB gzipped). Cite it as "Skillselion Agent Skill Security Census, August 2026". The methodology section on the page spells out the limits, including that declared permissions are documentation claims rather than sandbox measurements.

The week's CVEs got patched. The 70,090 unreviewed listings are still there, and they will still be there next week. Knowing which side of the 12.2% line a skill sits on takes about ten seconds. After this week, it seems worth the ten seconds.

Developers are installing taste: 4 of today's 7 fastest-rising Claude Code skill searches are design skills

Skillselion — Wed, 12 Aug 2026 08:09:25 +0000

Disclosure: I run Skillselion, a live catalog of agent skills refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. Every number in this post was pulled from it on August 12, 2026.

Here is the finding up front: of the seven fastest-rising skill searches on Skillselion today, four are design skills. Together those four skills have 1,659,726 installs, and the search growth on them ranges from +20% to +70%. Agents can already produce a working frontend; the search now is for output that looks like a person cared.

What are developers searching for right now?

The full trending list, with search growth as shown on our homepage today:

#	Skill	What it does	Search growth
1	Grill Me	Pressure-tests your plan until every decision is resolved	+160%
2	Ui Ux Pro Max	Instant UI/UX decisions and component recommendations	+70%
3	Ponytail	Forces the simplest, most minimal solution at every step	+60%
4	Frontend Design	Production-grade interfaces that avoid generic AI aesthetics	+50%
5	Caveman	Targets a roughly 75% cut in output tokens while keeping technical detail	+50%
6	Impeccable	Polished, distinctive web and app UI in real code	+40%
7	Design Taste Frontend	Overrides generic LLM frontend output with intentional taste	+20%

Four of the seven (Ui Ux Pro Max, Frontend Design, Impeccable, Design Taste Frontend) are about visual and interaction quality. The other three are about discipline, and I will come back to them.

Which design skills are developers actually installing?

Ranked by install count, fetched from the live catalog today:

Frontend Design by Anthropic, 767,871 installs. Details | GitHub
Design Taste Frontend by leonxlnx, 350,625 installs. Details | GitHub
Ui Ux Pro Max by nextlevelbuilder, 311,742 installs. Details | GitHub
Impeccable by pbakaus, 229,488 installs. Details | GitHub

Worth noting: the taste-skill repo is not a one-off. The same author ships a whole family, and two siblings of the trending skill are themselves large: high-end-visual-design at 265,273 installs and stitch-design-taste at 223,682, both fetched today from the same catalog.

Why is taste the thing being installed?

Anthropic's own Frontend Design skill states the goal in its description: help with "making choices that don't read as templated defaults." That sentence, in an official skill from the company that makes the model, is the most honest admission in the ecosystem. Left alone, coding agents converge on the same rounded cards, the same gradient heroes, the same three-column feature grids. The output works. It also looks like everyone else's output.

A skill fixes this in a way a one-off prompt cannot. It is a versioned, reviewable file of opinions: spacing scales, type choices, what to refuse to build. When you install a taste skill, you are importing someone's design judgment into every session, the same way a lint config imports someone's code judgment. The install counts say developers understand this trade perfectly well.

What about the other three?

The non-design entries on the list share a different theme: restraint.

Grill Me by mattpocock, 832,797 installs, interrogates your plan before any code is written. Details | GitHub
Caveman by juliusbrussee, 429,065 installs, compresses agent communication to cut token spend. Details | GitHub
Ponytail by dietrichgebert, 33,353 installs, forces the smallest possible change and deletes what is not needed. Details | GitHub

Put the two themes side by side and today's list reads as one sentence: developers want agents that think before building, spend less doing it, and produce something distinctive at the end. Nothing on the list makes an agent generate more.

What should you install first?

If your frontend output looks generic, pick one taste skill, not all four. They overlap heavily, and stacking them mostly burns context. Frontend Design is the safe default given its adoption; Design Taste Frontend and Impeccable are the opinionated alternatives worth trying if the default still feels flat. The full frontend-design ranking lives at skillselion.com/best/skills-for-frontend-design. Pair whichever you choose with Grill Me at the planning stage, since bad plans produce confident, well-styled versions of the wrong thing. And treat install counts as adoption evidence, not proof of fit for your stack: the counts above are today's snapshot and they move daily.

Developers are not searching for skills that make agents produce more. They are searching for skills that make the output worth shipping.

I run Skillselion, where all install and trending data in this post comes from. Figures are a live snapshot taken August 12, 2026.

We ran the Gini coefficient on 58,751 AI agent skills. It came out at 0.96.

Skillselion — Tue, 11 Aug 2026 12:18:36 +0000

Disclosure: we run Skillselion, the directory this census was pulled from. Every number below is reproducible from the free CSV.

On 2026-08-09 we dumped the entire Skillselion production catalog and counted it: 79,827 public listings covering agent skills, MCP servers, plugins and marketplaces, holding 157,833,061 cumulative installs. Then we ran the statistic economists use for income inequality across the 58,751 of those listings that are agent skills.

The Gini coefficient came out at 0.96.

Gini measures how unevenly a quantity is spread across a population: 0 is perfectly even, 1 is one holder taking everything. Applied to install counts across 58,751 AI agent skills in August 2026, it is 0.96.

South Africa, which reports the highest national income Gini the World Bank publishes, sits near 0.63. Brazil is around 0.52. A 0.96 is not a country. It is closer to a raffle.

One honest caveat before you quote that. Income and software installs are different measurement domains, so read the comparison as a sense of scale and not a like-for-like ranking. A catalog where a tenth of entries have zero installs can reach a Gini that no national income distribution ever will. Long-tail software distributions run hot on this measure in general.

What 0.96 looks like from the inside

Half of all 158 million installs go to 198 skills. That is 0.34% of the catalog.
The median skill has 56 installs.
59.3% have fewer than a hundred installs. 9.9% have none at all.
The top 1% of skills hold 77.4% of every install in the census.

The median skill sits at 56 installs, and these are cumulative all-time totals, so anything published this week starts from zero against a field that has been accumulating for months. For most people who publish a skill, release produces no measurable adoption. That is worth knowing before you read your own numbers as a verdict on the work.

The economy sitting on top of it has almost no money in it

Of the 79,827 listings, 55 carry a price. That is 0.07%. Another 1,404 ask you to bring your own API key and 184 run a freemium tier. Everything else is free.

Adoption on this scale normally arrives with a paid tier, a store cut or a marketplace fee. Almost none of that has been built here yet. If you are weighing whether to charge for a skill, that is the competitive context: you would be one of 55.

Publisher rank stops matching company size

Combining the two publisher tables from the census, where ByteDance is broken out separately for the reason below:

Rank	Publisher	Installs
1	ByteDance Lark/Feishu (70 listings, bundled, see caveat)	24,261,658
2	Microsoft	11,153,893
3	Matt Pocock (independent educator)	10,584,924
4	Vercel Labs	5,576,605
5	Anthropic	3,484,550
6	Google	730,896
7	AWS	171,446
8	OpenAI	150,665

One caveat we owe you on row 1. ByteDance's Lark/Feishu suite holds 15.4% of every install in the census, but Lark skills frequently install as bundles: one user action installs several skills at once, and the counts record each bundled skill separately. Those per-skill totals are therefore not comparable to a hand-picked install, and row 1 should not be read as 24 million deliberate choices. The share is real, and the mechanism producing it is documented in the methodology.

Now look at row 3. One person, publishing TypeScript education material, sits above Vercel Labs, Anthropic, Google and AWS, and roughly 70 times ahead of OpenAI on installs. Reach here tracks what developers choose to install, which is a different contest from benchmarks or funding.

The fastest-growing thing in the census is a skill that argues with you

One whole category exists to give the developer a hard time. Across 88 skills built for interrogation the cluster reaches 2,425,925 installs, about 1.5% of the census. What makes it notable is the slope: it is the platform's #1 rising search at +160% over the census window, and nothing else in the census grew faster.

Skill	Installs	Repo
grill-me	787,155	mattpocock/skills
grill-with-docs	669,499	mattpocock/skills
triage	534,688	mattpocock/skills
grilling	380,693	mattpocock/skills

Install counts above are frozen to the census date of 2026-08-09. The linked pages show live totals, which have moved since.

A second cluster sits on the meeting layer. Skills that write standup updates, summarize meetings, triage inboxes, tailor resumes and draft performance reviews reach 2,101,631 installs between them. Standups, meeting notes and status reports account for 1,889,988 of that across 111 skills. Every cluster here automates the reporting of work.

Method, and the raw file

The census is a complete dump of our production catalog taken on 2026-08-09: 79,827 listings, of which 58,751 are agent skills and the rest are MCP servers, plugins and marketplaces. Install counts are cumulative all-time totals. They aggregate public registry data, chiefly the skills.sh registry, alongside GitHub and other public sources, and they count install events rather than active users.

The category clusters were built by keyword matching over names and descriptions, then curated by hand to drop false positives. A "brutalist" UI-design skill is not an interrogation skill.

All five findings, the charts and the full methodology: The Agent Economy Census

The raw dataset, all 79,827 rows as a CSV, is downloadable on that page. Take it, check our arithmetic, disagree with us in public. Cite it as "Skillselion Agent Economy Census, August 2026".

We run Skillselion, an independent directory of Claude Code, Codex and Cursor extensions ranked by real installs. Not affiliated with Anthropic, OpenAI, Cursor, Claude, Claude Code or Codex.

Developers now install the author, not the skill: 'matt pocock skills' searches are up 160%

Skillselion — Fri, 07 Aug 2026 12:43:29 +0000

The fastest-rising Claude Code skill search this week is not a skill name. It is a person.

"matt pocock skills" is up 160% as a search term on our trending rail today. Sitting at number 5 on the same rail is caveman, up 50%. Caveman is the brand name of a seven-skill set. Developers search for an author, then install everything the author ships.

Three numbers from today's catalog data make the case.

1. The #9 skill in the catalog exists to serve other skills

setup-matt-pocock-skills has been installed over 540,000 times, which makes it the ninth most-installed skill in our catalog. It is the companion setup skill for mattpocock/skills: it wires his issue-tracker conventions, triage labels and docs layout into your repo so the rest of his set works the way he intends.

Nobody installs a companion setup skill because they liked one skill. You install it because you adopted the system.

The weekly numbers show the subscription still compounding. Between July 29 and August 7, grill-me, his most-installed skill at over 750,000 installs, gained 96,462 installs. The setup skill gained 76,531 in the same window. For every 100 installs grill-me picked up this week, the setup skill picked up 79. Most developers arriving at the front door take the whole house.

2. The caveman family moves as one unit

caveman compresses agent output to cut token usage. It ships from juliusbrussee/caveman with six sibling skills. Here is what each gained between July 29 and August 7 in our catalog data:

Skill	Gained (Jul 29 to Aug 7)	Total installs
caveman	26,831	410,000+
caveman-commit	21,202	293,000
caveman-review	21,148	291,000
caveman-compress	21,126	289,000
caveman-help	21,001	283,000
caveman-stats	20,860	240,000
cavecrew	20,722	235,000+

Six of the seven gained between 20,722 and 21,202 installs. That is a spread of 480 on gains of about 21,000 each, or roughly 2%. The flagship runs about 5,600 ahead, which is the slice of developers who stop at the front door. Everyone else takes the family.

The same shape shows up in obra/superpowers: six of its skills sit on today's trending 100 together, including brainstorming at over 310,000 installs and using-superpowers at over 200,000.

3. Three trending slots are left for anyone without an author brand

On Tuesday we published 92 of today's 100 fastest-growing Claude Code skills come from three publishers. Two days later, 97 of today's 100 trending entries belong to just six author accounts (two of them are the same vendor, Lark). Three slots are left for everyone else.

That piece was about supply, meaning who ships the skills. Today's data is about demand, meaning how developers adopt them. The rising search terms are author names. The #9 skill in the catalog is an author's setup shim. The install curves inside each set move in lockstep. All three signals point the same way: the unit of adoption in the Claude Code ecosystem is now the author.

What this means if you ship skills

Distribution attaches to names. grill-me added 96,462 installs this week, second only to find-skills among today's trending 100, and the demand around it carried 28 entries from the same author onto the list.
A single standalone skill is fighting for three slots. Only three of today's 100 trending entries came from authors with a single entry on the list. If your skill stands alone, your bottleneck is discovery.
A setup skill is a subscription button. The install count on setup-matt-pocock-skills is the cleanest public measure of author-level trust we have seen in the catalog. If developers trust your system, they will run your setup.

There is one counterweight. find-skills by vercel-labs, the most-installed skill in the catalog at over 2.8 million installs, is the opposite bet: let the agent pick the right skill per task instead of following an author. Both bets are growing. What is fading is the middle, where a developer browses for one capability at a time.

The numbers at a glance

Signal	Value (August 7 catalog data)
"matt pocock skills" search trend	+160%
setup-matt-pocock-skills installs	540,000+ (#9 all-time)
Setup installs gained per 100 grill-me installs, Jul 29 to Aug 7	79
caveman family gain spread (6 of 7 skills, same window)	480 installs on ~21,000 each
Trending-100 entries held by six author accounts	97 of 100

Sources: our live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. Search trend figures are what our homepage trending rail shows today.

We run Skillselion, an independent directory of Claude Code, Codex and Cursor extensions ranked by real installs. Not affiliated with Anthropic, OpenAI or Cursor.

92 of today's 100 fastest-growing Claude Code skills come from three publishers

Skillselion — Wed, 05 Aug 2026 08:50:17 +0000

I pulled the 100 fastest-growing Claude Code skills this morning (August 5 data, ranked by installs added in the last day). 92 of them belong to exactly three publishers.

54 rows are the Lark suite (published under open.feishu.cn and larksuite)
31 rows are mattpocock/skills
7 rows are Julius Brussee's caveman family

Publisher	Trending rows	Installs added per day
Lark suite	54	14,122
Matt Pocock	31	3,018
Julius Brussee (caveman)	7	588
find-skills (the installer)	1	224
Everyone else	7	366 combined

One more slot goes to find-skills (repo), the installer that installs other skills, at +224 installs a day. That leaves 7 of the top 100 slots for everyone else.

The Lark bloc moves as one organism

The 54 Lark rows added a combined 14,122 installs in a day. Individually they run from +175 to +345 installs a day, and the biggest 27 of them sit between +342 and +345, which is as close to perfect lockstep as install data gets. Their totals cluster the same way: lark-approval leads at 528,408, with fifteen siblings packed within about a thousand installs of it.

Nobody hand-picks 54 skills at identical rates. This is what suite distribution looks like: the skills ship and install together, so every member of the bundle climbs the leaderboard together. The bloc now occupies more than half of the trending board on its own.

The Pocock bloc is a different machine

Matt Pocock's 31 trending rows added 3,018 installs a day combined, from grill-me at 754,978 installs (+188 a day) down to wizard, the slowest of the set at +45 a day (111,964 installs). All 31 point at the same repo.

The install pattern says subscription, not selection: developers add the repo once and take the whole set, so the author's entire roster rises on one decision. Google's search data backs that up. In this month's rising queries around Claude Code skills, "matt pocock" is up 180% and "matt pocock skills" is up 160% (Google Trends, worldwide, past month, captured today). Developers are typing the author's name into the search box.

The caveman family shows the same shape at smaller scale: seven trending rows, +81 to +92 installs a day each, led by the 410,360-install main skill, and "caveman skill" up 50% in the same rising-queries capture.

The Claude Code skills that break through alone

Seven skills made the top 100 outside the three big blocs, and even here the bloc pattern creeps in: four of the seven are obra's superpowers set, a fourth mini-bloc at around +50 a day per row, led by writing-plans. The genuinely solo climbers:

agent-browser (repo), Vercel's browser automation CLI, 628,408 installs, +52 a day
nia, a 54,152-install recent arrival on the board, +60 a day
wind-mcp-skill, a finance-data skill at +59 a day

A standalone skill growing +50 a day is doing well. The same day, every single Lark row grew at triple that rate or better.

What this does to install counts

Install counts used to be a decent proxy for "developers chose this". On today's board, they are mostly a measure of distribution: whether a skill ships inside a suite, inside a followed author's repo, or alone. If you are evaluating a skill, the question is not just how many installs it has. It is whether those installs arrived one decision at a time or 54 rows at a time.

Numbers source: live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. Search figures: Google Trends rising queries, worldwide, past month, captured August 5.

I run Skillselion, an independent directory of Claude Code, Codex and Cursor extensions ranked by real installs. Not affiliated with Anthropic, OpenAI, Cursor or ByteDance.

grill-me just passed Anthropic's frontend-design to become the #2 most-installed Claude Code skill

Skillselion — Tue, 04 Aug 2026 10:12:53 +0000

On the August 4 skills leaderboard, Matt Pocock's grill-me sits at 745,804 installs, 7,599 ahead of Anthropic's own frontend-design at 738,205. Six days ago it trailed by 25,070. A community skill that interrogates your plan before any code gets written now outranks the skill Anthropic ships for its flagship use case, and only Vercel's find-skills (2,806,813) sits above it.

We wrote on July 29 that the entire top 10 belonged to three authors: Matt Pocock with 5 skills, Vercel Labs with 4, Anthropic with 1. Six days later that snapshot is already broken, in two places.

Break 1: the #2 slot changed hands

Between July 29 and August 4, grill-me added 55,111 installs. frontend-design added 22,442 over the same six days. That is roughly 2.5x the pace, and it was enough to close a 25,070 deficit and open a 7,599 lead.

grill-me does not write code. It runs a relentless interview about your plan or design until every branch of the decision tree is resolved, then lets you build. The fact that it now outranks frontend-design, a code-generating skill from Anthropic itself, says something about where developers feel the pain. The misunderstandings that pile up before generation starts seem to hurt more than the generation itself.

Break 2: a media-automation bundle took two top-10 slots

The July 29 cut line for the top 10 was 495,226 installs. Today, positions 9 and 10 belong to ai-video-generation (570,274) and ai-image-generation (568,471), both from the 101-skills repo (which now redirects to inference-sh/skills on GitHub). Two more from the same repo, ai-avatar-video (568,250) and twitter-automation (568,202), sit at 11 and 12. Four skills, one repo, all within 2,072 installs of each other.

That spread is the tell. When four skills from one repo track each other that tightly at half a million installs, the simplest explanation is that they are being installed as a set rather than chosen one by one. Since they all sat below the 495,226 cut on July 29, each has added at least 72,900 installs in six days. Whatever is driving that bundle, it is moving faster than any skill whose July 29 number we published.

Compare that to Matt Pocock's repo, where his five top-25 entries alone spread from 745,804 (grill-me) down to 536,845 (setup-matt-pocock-skills), and the rest of the repo runs lower still. His skills rise at different speeds because developers pick them individually. Inside one repo, a wide spread is the signature of per-skill demand and a tight spread is the signature of a bundle. Raw install rank cannot tell you which skill developers actually reached for; the spread can.

The new top 10, August 4

#	Skill	Author	Installs
1	find-skills	Vercel Labs	2,806,813
2	grill-me	Matt Pocock	745,804
3	frontend-design	Anthropic	738,205
4	grill-with-docs	Matt Pocock	632,931
5	agent-browser	Vercel Labs	622,750
6	improve-codebase-architecture	Matt Pocock	609,303
7	vercel-react-best-practices	Vercel Labs	603,739
8	tdd	Matt Pocock	587,398
9	ai-video-generation	101-skills	570,274
10	ai-image-generation	101-skills	568,471

Out since July 29: setup-matt-pocock-skills (536,845, now #14) and Vercel's web-design-guidelines, which no longer appears in today's top 25.

The three-author monopoly lasted less than a week. The ownership count now reads Matt Pocock 4, Vercel Labs 3, Anthropic 1, and one media bundle 2. The interesting question for next week is whether the bundle keeps its lockstep climb, and whether any single hand-picked skill besides grill-me can hold a top-10 slot against sets that install four at a time.

We run Skillselion, an independent directory of Claude Code, Codex and Cursor extensions ranked by real installs. Numbers in this post come from our live catalog, refreshed daily from skills.sh, GitHub and MCP registries, and were verified against the live leaderboard on August 4, 2026.

Vercel's agent-browser just crossed 600k installs: the fastest-accelerating skill in the Claude Code top 100

Skillselion — Sun, 02 Aug 2026 16:59:57 +0000

Vercel's agent-browser sits at 612,890 installs on the skills.sh leaderboard as of August 2. It was under 600,000 on July 29. Over those four days it averaged roughly 5,450 installs a day, against roughly 3,370 a day across the previous week. That +62% jump in daily rate is the sharpest acceleration of any skill in the top 100 right now, and it is not close: the next-fastest is at +17%.

We track daily install snapshots for every skill in the Skillselion catalog, so we can compare each skill's current install rate against its own recent baseline. The top 100 as a whole is not surging: the median skill is running at 0.94x its late-July rate, slightly below it. The four fastest-accelerating skills, though, are all the same kind of skill. (The next block after them is a five-skill AI-media bundle from one author, all at +13% in lockstep, which is bundle behavior rather than individual demand.)

The acceleration top 4 is browser hands and frontend eyes

agent-browser (GitHub) - 612,890 installs, 39.7k stars. ~3,370/day in the last week of July, ~5,450/day since July 29 (+62%). A Rust CLI that gives a coding agent a real browser: navigate, click, type, screenshot, read the accessibility tree.
web-design-guidelines (GitHub) - 509,313 installs. ~2,460/day to ~2,880/day (+17%). Audits existing frontend code against Vercel's web interface guidelines.
vercel-react-best-practices (GitHub) - 599,350 installs, about to cross 600k itself. ~2,550/day to ~2,960/day (+16%).
frontend-design (GitHub) - Anthropic's own design skill, 732,170 installs. ~3,580/day to ~4,100/day (+15%).

For contrast, the biggest skill on the leaderboard, find-skills, is dead flat: ~15,160/day in late July, ~15,090/day since (2,783,463 installs total). The catalog is steady. This specific cluster is not.

The demand side agrees

Our homepage trending rail tracks which skill searches are rising on Google. Right now search interest in Anthropic's frontend-design skill is up 120%, and searches for ui-ux-pro-max, a UI/UX decision skill with 290k installs, are up 140%. Developers are searching for frontend taste at the same moment they are installing browser control and design review at above-baseline rates.

What we think is happening

Claude Code shipped an in-app browser in early July, and agents that can see a rendered page need two things: hands to drive the browser and eyes that know what good frontend looks like. agent-browser is the hands. The other three are the eyes. We cannot attribute the acceleration to a single launch or post, and we are saying so rather than inventing one. What the data supports: the growth is concentrated in one coherent capability cluster, not spread across the leaderboard.

Methodology, honestly

Numbers come from our own daily install snapshots of the skills.sh all-time leaderboard. Our snapshot series has a gap between July 29 and August 2 (three missed collection days), so the "since July 29" rates are that four-day window averaged per day. Late-July baselines are true daily snapshots, July 23 to 29. Every install count above is the live number at time of writing and every skill link goes to a page showing the same data.

Data: live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. We run Skillselion, an independent directory of Claude Code, Codex and Cursor extensions. Not affiliated with Anthropic, OpenAI, Vercel or Cursor.