Every AI Agent Skills Platform You Need to Know in 2026

In December 2025, Anthropic released the SKILL.md open standard — and OpenAI immediately adopted it for Codex CLI. Within weeks, an entire ecosystem exploded: 96,000+ skills on SkillsMP, 5,700+ on ClawHub, 17,000+ MCP servers on MCP.so.

But here's the problem: finding the right skill feels like drinking from a firehose. Some platforms have great search but terrible security. Others are safe but tiny. And 7% of one major registry literally leaks your API keys.

I spent a week mapping every platform, scanning for security, and testing quality. Here's the complete guide.

The Landscape at a Glance

                    AI Agent Skills Ecosystem (Feb 2026)



    ┌─────────────────────────────────────────────────────────┐

    │                    SKILL.md Standard                     │

    │         (Claude Code / Codex CLI / Gemini CLI)          │

    └──────────────────────┬──────────────────────────────────┘

                           │

         ┌─────────────────┼─────────────────┐

         │                 │                 │

    Claude Code        OpenClaw           MCP Servers

    Skills             Skills             (Universal)

         │                 │                 │

    SkillsMP (96K)    ClawHub (5.7K)    MCP.so (17K)

    SkillHub (7K)     awesome-oc (3K)   mcpservers.org

    awesome-* (many)  LobeHub            LobeHub MCP

Part 1: Claude Code Skills Platforms

Tier S: Official & Verified

These are the only platforms where you can install without reading the source code first.

Tier A: Large Directories

Pro tip: On SkillHub, filter by S-Rank only. On SkillsMP, search by keyword then check the GitHub repo before installing.

Tier B: Curated Awesome Lists

Part 2: OpenClaw Skills Platforms

The Official Registry

ClawHub — 5,705 skills, semantic search, CLI install (openclaw skill install <name>).

As of February 2026, ClawHub now integrates VirusTotal scanning for all new submissions. This was a direct response to the ClawHavoc incident (more on that below).

Community Collections

Part 3: MCP Server Platforms (Works With Everything)

MCP (Model Context Protocol) servers work with Claude Code, OpenClaw, and most AI agents. They're complementary to skills — skills teach behavior, MCP servers provide tool access.

Part 4: Security — Read This Before Installing Anything

The Incidents

ClawHavoc (Feb 2026): 341 malicious skills on ClawHub distributed macOS malware. Skills looked legitimate but contained obfuscated download-and-execute payloads.

Snyk ToxicSkills: Scanning the entire ClawHub registry revealed 7.1% of skills (283) leak API keys — hardcoded credentials in source code that get copied into your environment.

The Register investigation: Demonstrated how easy it is to backdoor OpenClaw skills and exfiltrate data through seemingly innocent file operations.

Security Tools

My Install Checklist

Before installing ANY skill from a non-official source:



[ ] Check the author's GitHub profile (age, other repos, stars)

[ ] Read SKILL.md — does the description match what the code does?

[ ] Search for network calls (fetch, http, curl, requests)

[ ] Search for file system writes outside the project directory

[ ] Search for environment variable reads (process.env, os.environ)

[ ] Run SecureClaw if it's an OpenClaw skill

[ ] Check if the skill asks for permissions it shouldn't need

Part 5: The SKILL.md Standard (Quick Reference)

All platforms now use the same format:

~/.claude/skills/my-skill/SKILL.md    # Claude Code (personal)

.claude/skills/my-skill/SKILL.md      # Claude Code (project)

~/.codex/skills/my-skill/SKILL.md     # Codex CLI

Structure:

name: my-skill          # becomes /my-skill slash command

description: "..."      # used for auto-discovery

license: MIT



# My Skill



Instructions for the agent go here.

Keep under 500 lines / 5,000 tokens.

Compatible with: Claude Code, Codex CLI, Antigravity, Gemini CLI, Cursor, OpenCode.

My Recommendations

If you want safety first

Start with awesome-agent-skills. 380+ skills from Anthropic, Vercel, Stripe, Cloudflare, Sentry, HuggingFace, Trail of Bits. Every skill is from an official dev team.

If you want volume

SkillsMP has 96K+ skills with good search. But always check the source repo before installing.

If you want quality scoring

SkillHub S-Rank skills (9.0+/10) are generally solid. The AI scoring isn't perfect but filters out the worst.

If you're on OpenClaw

ClawHub + SecureClaw. Install SecureClaw first, then use it to audit everything else.

If you need MCP servers

MCP.so for discovery, official repo for reference implementations.

Numbers at a Glance

The agent skills ecosystem is growing fast — faster than anyone can curate. The SKILL.md standard was the inflection point that unified everything. But with 100K+ skills and counting, the real skill is knowing where to look and what to avoid.

Start small. Start official. Audit everything else.

Built with Claude Code. If you found this useful, follow me for more AI tooling deep dives.