What Are the skills CLI and find-skills? Vercel's Skill Installer, npx skills add, Supported Agents and Security

A skill is an instruction folder that tells an AI agent how to do a specific job; it contains a SKILL.md file with a name, a description and steps. The skills CLI is a command-line tool (npm package skills) that downloads these folders from repositories such as GitHub and puts them in the folder that agents like Claude Code, Codex and Cursor read. The README describes it as the CLI for the open agent skills ecosystem and labels it a Vercel Labs product.

skills.sh is the same team's skill directory: a leaderboard ranking skills by install count, topics, and an install command for every skill. The ranking comes from the anonymous install data the CLI collects (skills.sh docs).

Who it's for: anyone who wants to add ready-made skills to agents like Claude Code, Codex and Cursor. Who it's not for: people who don't use a terminal; the tool has no interface (official sources mention none).

The CLI needs no installation; it runs directly with npx. You need a terminal and Node.js 22.20.0 or later (the npm package's engines field; the README states no version). The commands are exactly as given in the README and on the skills.sh page. During installation the CLI detects the agents on your computer itself; if it finds none, it asks which one to install for.

There are two install methods: symlink (recommended; every agent links to a single copy, easy to update) and copy (--copy; when symlinks aren't supported). Operating system differences are not covered in the README.

find-skills is not a program but a skill in Vercel's skills repository (skills/find-skills), meaning a set of instructions given to the agent. According to its SKILL.md it kicks in when: you ask questions like "how do I do X", say "find a skill for X" or "is there a skill that does X", want to extend the agent's capabilities, or ask for help in an area such as design, testing or deployment.

1. 1Understands the need: the domain (such as React, testing, design) and the task.
2. 2Checks the leaderboard first: whether there's a well-known skill in that area in the skills.sh ranking.
3. 3Otherwise, searches: runs npx skills find [query].
4. 4Verifies: install count (prefers over 1,000, flags caution under 100), the source's reputation and the repository's GitHub stars (skeptical under 100).
5. 5Presents: the skill name, what it does, install count, install command and skills.sh link.
6. 6Installs if you want: npx skills add <owner/repo@skill> -g -y.

!The SKILL.md says the agent can run the install with -g -y if the user asks: -g installs at the user level for everything, -y skips confirmation. To keep the agent from installing on your behalf, write "don't install without my approval" in your prompt. The criteria it checks (install count, stars, source) measure popularity, not security.

After installation, the agent's own skill mechanism loads the skill; how it's triggered varies by agent and is not covered in the skills CLI docs (the README links to each agent's own docs). The CLI's job is to install and manage.

Installing and updating fetch the skill as it is at that moment; its content may have changed. Before updating an important skill, read the new SKILL.md.

The README's first line says "OpenCode, Claude Code, Codex, Cursor and 75 more" and gives each agent's --agent name and project/global folder path in a table. The table below counts as "yes" only those named in that table.

VS Code is not named in the README; GitHub Copilot (github-copilot) is.

What is Claude Code? Detailed guide →

!Security check (October 15, 2026): GitHub Security Advisories (vercel-labs/skills) list no entries, and OSV has no record for the skills npm package. The repository has no SECURITY.md; the skills.sh docs point to security.vercel.com for security reports. The package has no preinstall, install or postinstall script that runs during installation; releases are signed with npm provenance. No recorded advisories are listed; this does not mean "safe".

The skills.sh/audits page shows Gen Agent Trust Hub, Socket and Snyk results for skills side by side. On October 15, 2026, find-skills showed Gen "Safe", Socket "0 alerts" and Snyk "Med Risk" (Snyk "Warn" on the skill page). These are third-party scans, not guarantees.

Yes. The skills CLI is MIT-licensed open source; it doesn't require a plan, an account or an API key, and the README mentions no fee. No prices or plans appear on the skills.sh pages. The skills you install have their own licenses and required services; your agent's (Claude Code, Codex, Cursor) plan and limits also apply separately. Official sources list no paid plan, so there is no price to show.

Source: vercel-labs/skills README, GitHub license info and npm registry (October 15, 2026). This is not legal advice.

Based on issue titles only; check the issue itself for its resolution status.

1. 1Remove a skill: npx skills remove <skill-name>. Remove a global one with --global, from a specific agent with --agent; to delete everything, npx skills remove --all (no confirmation).
2. 2Remove find-skills: It's a skill too: npx skills remove find-skills.
3. 3The CLI itself: If you ran it with npx, there's no permanent install; only the package manager's cache remains.
4. 4Turn off data sending: Environment variable DISABLE_TELEMETRY=1 (or DO_NOT_TRACK=1).