GitHub Trending Is Now a Skills Marketplace
Open GitHub Trending today and count the layers. ECC sits at 245,643 stars — a harness optimizer that ships 277 skills and 67 agents across Claude Code, Cursor, Codex, and beyond. awesome-design-md holds 112,505 stars — a library of DESIGN.md files that let agents generate pixel-matched UI from brand specs. scientific-agent-skills has climbed to 41,399 stars — 165 validated skills covering biology, chemistry, medicine, and drug discovery, used by 190,000 scientists. And Orca rounds out the board at 59,072 stars — an Agent Development Environment that orchestrates fleets of 25+ coding agents in parallel worktrees.
📖 Read the full version with charts and embedded sources on AgentConn →
These are not four random repos having a good week. They are four layers of the same stack. And that stack — harness optimizers, design-spec libraries, vertical skill packs, fleet orchestrators — is what a marketplace looks like before someone builds the storefront.
Daniel Cuthbert put it bluntly: "MCP is the new App Store. Claude picks a tool via MCP. No marketplace, no comparison — the AI picks one tool and the user never sees alternatives. This is the iPhone App Store in July 2008." He meant it as a warning. But the comparison holds in ways he did not intend — including the part where the early App Store shipped thousands of flashlight apps and fart soundboards before quality gates emerged. We are in that phase now. And the question for operators is not whether to participate, but which layer to invest in and which to ignore.
The Four-Layer Stack
The skills ecosystem did not emerge as a flat directory. It stratified into four distinct layers, each solving a different problem. Understanding the layers is the difference between adopting infrastructure and chasing stars.
Layer 1: Harness Optimizers. ECC is the archetype. At 245K stars and 289 contributors, it packages skills, agents, hooks, and security tooling that run across every major coding agent from a single repository. This is the foundation layer — the operating system for your agent's behavior. We covered the harness-as-moat thesis when DeepSeek open-sourced theirs in August; ECC is the community-driven version of the same idea, and its 277 workflow skills represent thousands of hours of collective configuration that no individual operator would replicate alone.
Layer 2: Design-Spec Libraries. awesome-design-md represents something genuinely new: agents that can match a brand's visual identity without Figma exports or JSON schemas. Drop a DESIGN.md file into your project root and the agent gets pixel-level context — colors, typography, spacing, components, interaction patterns. The OSS Insight analysis notes a fork-to-star ratio of 12.6%, which means developers are not starring out of curiosity — they are forking and integrating into production workflows. This layer bridges the gap between "the agent can code" and "the agent can code something that looks like it belongs in our product."
Layer 3: Vertical Skill Packs. scientific-agent-skills is the proof that skills are going domain-specific. With 165 validated skills across 100+ scientific databases, it turns any coding agent into a research assistant that knows how to query PubMed, parse crystallography data, and run statistical analyses in the right order. We tracked this trend when skills went vertical in May — the September numbers confirm it was not a blip. The vertical layer is where the real value accrues, because domain expertise is genuinely hard to replicate.
Layer 4: Fleet Orchestrators. Orca completes the stack by solving the problem of running multiple agents at once. As we covered in our Orca review, it went from first commit to 59K stars in five months by letting operators run Claude Code, Codex, OpenCode, and 20+ other agents in parallel git worktrees against their own subscriptions. The fleet layer assumes skills and harnesses exist — it orchestrates across them.
Cole Medin's "Harness Engineering" video captures the shift: the most valuable engineering skill in 2026 is not prompt writing or model selection — it is assembling and tuning the harness layer that sits between the model and your codebase. Skills are the atomic unit of that layer.
From Platform to Ecosystem: The App Store Arc
Every major computing platform eventually gets a marketplace. PCs got shareware catalogs, then download.com, then Steam. Phones got the App Store and Google Play. Browsers got the Chrome Web Store. The pattern is consistent: a platform ships, developers build on it, a distribution layer emerges, and then the real competition moves from "can you build on this platform?" to "can you find and trust what others have built?"
Agent skills are on this arc, and the data confirms it. Search volume for "agent skills" grew 19x over two years, from 21,000 to over 400,000 monthly searches. Twenty-plus AI coding agents now support the SKILL.md standard. SkillsMP indexes 1.9 million public skills. Paid marketplaces like Agensi offer 70/30 revenue splits to creators. The infrastructure for a marketplace economy exists.
But here is what the "skills are the new app store" framing gets wrong — and it matters for anyone deciding where to invest.
⚠️ Contrarian Corner: The App Store Had Gatekeepers From Day One
The iOS App Store launched with Apple reviewing every submission. Google Play followed with automated scanning plus human review for flagged apps. The skills ecosystem has no equivalent. An audit of 22,511 skills found 140,963 issues. Prompt injection was detected in 36% of tested skills. The average public skill scores 6.2 out of 12 on quality metrics.
The app-store analogy flatters skills. App stores had quality gates, review processes, and kill switches from the beginning. Skills directories have GitHub stars and README files. An unaudited skill is an unaudited dependency with code-execution rights — and we covered exactly this attack surface in our supply-chain security analysis.
The question is not whether curation will emerge. It is whether it emerges before a high-profile supply-chain attack forces it.
What the Community Is Saying
The Hacker News thread on agent skills for team coding standards captures the practitioner divide. One camp sees skills as the natural evolution of linting rules and style guides — codified team practices that agents enforce automatically. The other camp sees them as another abstraction layer that will fragment when the next generation of tools arrives. Both are right, and the tension is productive.
The Skly marketplace thread on HN surfaced a sharper debate: should skills be free open-source artifacts, or should creators be able to charge for them? The economics are real — a well-crafted vertical skill pack represents hundreds of hours of domain expertise compressed into a SKILL.md file. But the open-source ethos of the developer tool ecosystem pushes against paywalls. This is the same tension that played out with VS Code extensions, npm packages, and GitHub Actions — and it never fully resolves.
Meanwhile, Karpathy's Sequoia Ascent talk continues to frame the meta-narrative. His core claim — "you can outsource your thinking, but you can't outsource your understanding" — applies directly to skills adoption. Installing a skill is outsourcing execution. Understanding what the skill does, when it fails, and what it assumes about your codebase — that is the part you cannot delegate.
Riley Brown's video demonstrates what the best-case adoption looks like: skills composing into agent teams that handle end-to-end workflows. But the gap between "this works in a demo" and "this works in our production CI pipeline" is exactly where the four-layer stack matters. The harness layer (ECC) handles the runtime. The design layer (awesome-design-md) handles the output spec. The vertical layer (scientific-agent-skills) handles domain knowledge. And the fleet layer (Orca) handles parallelism. Skip a layer and you are building on sand.
The Marketplace Landscape Right Now
The Agentman ecosystem report maps the current landscape into three tiers:
| Tier | Examples | Catalog Size | Curation Level | Security |
|---|---|---|---|---|
| Premium | Anthropic official skills | Small | Manual review, verified | High |
| Managed | Agensi, Agentman | Curated | 8-point security + practitioner review | Medium-High |
| Open | SkillsMP, Skills.sh | 1M+ indexed | Minimal to none | Low |
The performance data is stark: curated skills raise agent pass rates by 16.2 percentage points on average. In healthcare domains, the gain reaches 51.9 points. Quality is not a nice-to-have — it is the difference between a skill that helps and a skill that hallucinates medical dosages.
For operators, the tier system maps directly to risk tolerance:
- Enterprise teams building governed internal libraries should draw from the premium and managed tiers, add their own review layer, and treat the open tier as a discovery source — never a deployment source.
- Indie builders optimizing for speed can pull from the open tier but must review every skill they actually ship with. The skills-vs-MCP architecture analysis we published covers the auth and gateway patterns that make this safer.
- Nobody should install a 0.5-star, 3-week-old skill from an anonymous GitHub account into a production agent without reading the SKILL.md file first. This is the "don't run curl | bash from a stranger" rule, adapted for the age of agents.
What This Means for You
The "agent skills are the new app store" framing is directionally correct but premature. Here is what operators should actually do right now:
💡 The Adopt-or-Skip Decision Framework
Adopt from Layer 1 (Harness). If you are running Claude Code, Codex, or any major agent, a harness optimizer like ECC or a curated skills bundle gives you the highest ROI per hour of setup time. This is table stakes.
Evaluate Layer 2 (Design Specs) if you ship UI. DESIGN.md files are high-signal, low-risk. They do not execute code — they provide context. If your team builds frontend, dropping a DESIGN.md into your repo costs nothing and may meaningfully improve agent output quality.
Invest in Layer 3 (Vertical Packs) only if your domain has one. scientific-agent-skills works because biology and chemistry have well-defined protocols. If your vertical has a mature skill pack, adopt it. If it does not, building your own is a multi-month investment — scope it accordingly.
Wait on Layer 4 (Fleet Orchestrators) unless you are already multi-agent. Orca is impressive, but fleet orchestration adds complexity that only pays off if you are already running multiple agents. Most teams are not there yet. We covered the fleet orchestration decision in detail — read that before committing.
Vet everything like a dependency. Read the SKILL.md. Check the contributor count. Look for an audit. Treat skills like npm packages, not like Chrome extensions.
The Prediction
By Q1 2027, one of three things will have happened:
A major supply-chain attack via a malicious skill forces every marketplace to add mandatory security scanning, and the open tier shrinks dramatically. This is the most likely outcome.
SKILL.md standardization deepens with versioning, dependency declarations, and capability scoping — turning skills from "instructions in a markdown file" into a real package format. This is already underway.
Platform vendors (Anthropic, OpenAI, Google) launch first-party skill stores with revenue sharing, quality gates, and featured listings. When this happens, the independent marketplaces either become premium curators or disappear.
All three can happen simultaneously. The first will happen first.
ℹ️ Karpathy's framing applies here: "Right now the agents are like interns. You still have to be in charge of aesthetics, judgment, taste, and oversight." The same is true for skills. A skill is an intern's playbook — useful when the intern is good, dangerous when the intern is bad, and only as trustworthy as the process that vetted it.
The model war may be cooling. The tooling war is heating up. And skills are the ammunition.
The repos mentioned in this article — ECC, awesome-design-md, scientific-agent-skills, and Orca — are open-source and actively maintained. Star counts are as of September 1, 2026.
Originally published at AgentConn
Top comments (1)
Karpathy nailed it with the intern analogy. Instructions help a good intern, but they don't fix a bad one - and they can actually do more harm than good.😉