Use AgentSkillsHub before install
Use it when you need source links, permission context, security grades, and a rollout checklist for an MCP server or agent skill. Treat those grades as screening signals, not certification.
Source checkedJuly 19, 2026
AgentSkillsHub vs Skills.sh: Directory, CLI, and Safety Differences
The useful difference is not “enterprise versus startup.” Skills.sh gives developers a public skills directory, install leaderboard, and documented npx skills CLI. AgentSkillsHub focuses on source context, permission risk, security signals, and rollout guidance before a skill reaches a real workspace.
Direct answer
Choose by the job you need to complete
Use Skills.sh to discover and install
Use it when you want a current directory and leaderboard plus the documented CLI routenpx skills add owner/repo.
Use both for higher-risk work
Discover a candidate, verify its upstream source and access, install it into a disposable workspace, then promote it only after a real test and rollback check.
AgentSkillsHub vs Skills.sh at a glance
| Decision point | AgentSkillsHub | Skills.sh | What to do |
|---|---|---|---|
| Primary job | Evaluate source, permission, security, and rollout context | Discover, rank, and install agent skill packages | Start with the surface that matches your immediate job. |
| Main interface | Web directory, comparison pages, review methodology, and analyzer | Web directory and leaderboard plus an open-source CLI | Do not assume the two sites provide the same install path. |
| Install workflow | Per-listing guidance; no replacement for the Skills.sh CLI | Documented npx skills add owner/repo command | Confirm repository and destination before running a command. |
| Ranking or review signal | Published security grades and editorial review context | Aggregated anonymous CLI install telemetry drives leaderboard discovery | Popularity and a grade are inputs, not final approval. |
| Safety boundary | Directional checks; no warranty that every skill is safe | Routine audits; documentation says quality and security are not guaranteed | Inspect permissions, install scripts, network calls, and rollback. |
| Best combined use | Pre-install review and test-plan support | Discovery and documented installation | Use a sandbox between discovery and production adoption. |
Discovery signals are not trust signals
Skills.sh install activity is useful evidence that developers are trying a package. It can surface an active project faster than a manually maintained list, and trending or all-time views can reduce the time spent searching GitHub by hand. But install activity does not explain why a skill was installed, whether the first run succeeded, which permissions were accepted, or whether the package remained in use. Read it as an ecosystem-discovery signal rather than a production-readiness score.
AgentSkillsHub grades and review notes answer a different question: what should an operator inspect before testing this skill? Source ownership, permission scope, install clarity, maintenance signals, and failure boundaries can make review more efficient. They still cannot reproduce your environment or internal policy. A low-risk local writing helper and a cloud administration skill should not pass the same approval path simply because both have a visible grade.
Practical rule
Use popularity to decide what deserves a look. Use source and permission evidence to decide what deserves a test. Use a representative task, logs, and rollback evidence to decide what deserves continued access.
What Skills.sh actually provides
Skills.sh is more than a list of links. Its documentation describes a public directory and leaderboard powered by aggregated install activity, while the open-source skills CLI handles installation for supported agents. The documented basic command is npx skills add owner/repo, with agent-specific destinations selected by the CLI.
The CLI documentation also states that anonymous telemetry is enabled by default for leaderboard ranking and can be disabled with DISABLE_TELEMETRY=1. That makes Skills.sh useful when installation speed and ecosystem discovery matter, but an install count still does not establish source ownership, least privilege, or fit for your production environment.
What AgentSkillsHub adds before installation
AgentSkillsHub is designed as a review surface. Its public methodology checks package identity, source ownership, permission scope, maintenance signals, security-sensitive behavior, documentation depth, and whether a page gives an operator a concrete next test. The site also publishes skill pages, comparison guides, permission context, and a repository analyzer.
This does not make AgentSkillsHub a package manager or a security warranty. A grade can help prioritize review, but the final decision still belongs to the person or team controlling the workspace, credentials, network, and deployment environment.
When to choose or skip each surface
Choose AgentSkillsHub when...
The candidate can touch repositories, files, browsers, databases, cloud accounts, or credentials and you need a compact source and permission review before deciding how to test it.
Do not use AgentSkillsHub as...
A package manager, a complete inventory guarantee, or proof that a third-party skill is safe for your environment. Follow the current upstream install route and your own approval policy.
Choose Skills.sh when...
You know the workflow you want, prefer an open-source command-line installer, and need to discover a current owner/repository package for a supported coding agent.
Pause before using the CLI when...
The repository name looks unofficial, the requested destination is unclear, install scripts are opaque, or the skill expects broad filesystem, shell, network, or secret access.
A 10-minute workflow for evaluating one skill
1. Find the canonical source
Match the directory entry to the maintainer, repository, package, and current documentation.
2. Read the requested access
Look for filesystem, shell, browser, network, cloud account, and secret access before install.
3. Inspect the install route
Prefer the maintainer or registry command. Do not run a command copied from an unverified mirror.
4. Choose a disposable destination
Install into a temporary project or low-risk agent profile rather than a production workspace.
5. Run one representative task
Check the first useful result, failure behavior, logs, and whether the skill stays inside its declared scope.
6. Record rollback
Know which files were added, how to remove them, and which tokens or permissions must be revoked after a failed test.
Pre-install questions worth recording
A short decision record is more useful than a vague “approved” label. For every skill that may reach a team workspace, record answers to these questions:
- Who owns the upstream repository, and does the package identity match that source?
- Which project and global directories will the installer create or modify?
- Can the skill execute shell commands, read arbitrary files, or make outbound network requests?
- Which credentials or environment variables are required, and can their scope be reduced?
- What representative task proves value without exposing production data or accounts?
- How will you remove installed files, revoke access, and identify a failed or stale version?
Three practical decisions
You need a skill installed now
Start with the Skills.sh documentation and CLI. Verify the repository string before execution, then choose the intended agent and project scope.
The skill can read files or credentials
Slow down. Use AgentSkillsHub's source and permission context, inspect the upstream code, and test with throwaway data before granting real access.
Your team wants one standard
Standardize the review process, not just the directory. Record source, version, permissions, test result, owner, and removal path for every approved skill.
What this comparison does not prove
- It does not prove that either catalog is complete.
- It does not benchmark task quality, speed, or success rate.
- It does not certify every listed repository or package as safe.
- It does not replace your organization's permission and change-control policy.
Sources checked July 19, 2026
Verify the current behavior at the source
- Skills.sh documentation — directory purpose, leaderboard telemetry, install overview, and safety boundary.
- Skills.sh CLI reference — current
npx skills addsyntax and telemetry opt-out. - vercel-labs/skills on GitHub — open-source CLI, supported agents, and install destinations.
- Vercel's skills ecosystem announcement — first-party product framing for the CLI and directory.
- AgentSkillsHub review methodology — published review dimensions, limitations, and re-review process.
- AgentSkillsHub editorial policy — source standards, corrections, and commercial independence.
Frequently asked questions
What is the main difference between AgentSkillsHub and Skills.sh?
AgentSkillsHub is a web directory focused on source, permission, security, and rollout context before adoption. Skills.sh combines a web directory and install leaderboard with the open-source skills CLI for adding skill packages to supported agents.
Can AgentSkillsHub replace the Skills.sh CLI?
No. AgentSkillsHub can help with pre-install research and per-listing guidance, but Skills.sh provides the documented npx skills CLI workflow. Use the CLI only after checking the upstream repository, requested access, and install destination.
How does Skills.sh rank skills?
Skills.sh says its leaderboard uses aggregated anonymous install telemetry from the skills CLI. Its documentation also explains how to disable that telemetry with the DISABLE_TELEMETRY environment variable.
Does either directory guarantee that a skill is safe?
No. Skills.sh explicitly says it cannot guarantee every listed skill, and AgentSkillsHub describes its grades as directional risk signals rather than warranties. Review source ownership, permissions, install scripts, network access, and rollback options yourself.
Can a team use AgentSkillsHub and Skills.sh together?
Yes. A practical sequence is to use Skills.sh for discovery and its documented install route, while using AgentSkillsHub for source checks, permission context, and a safer test plan before a higher-risk skill reaches a real workspace.