Vercel report: skills.sh hits one million agent skills in seven months

Vercel says its skills.sh registry reached one million agent skills and nearly 280 million installs seven months after launch.

Vercel's State of agent skills report, published September 25, says the skills.sh registry reached one million agent skills and nearly 280 million installs in seven months. If you package your own workflows as SKILL.md files, the demand data is useful. The scale is also a reminder that you are running a lot of other people's instructions inside your agent.

Vercel says installs are heavily concentrated. Nearly half of all skills were installed exactly once, and 375 skills (0.04%) account for 62% of installs. Software engineering leads demand at 18%, followed by agent workflows at about 15%. Business operations skills draw 74% more installs per listing than average. Cross-industry skills take 87.5% of installs in Vercel's classified sample. Vercel notes that install counts are aggregate counters, "not unique people or necessarily independent choices." No independent audit of the figures was found.

The report doesn't cover how skills are vetted at publish time, and that is still unclear. QASkills.sh says skills.sh docs describe routine audits but also say the directory can't guarantee the security of every skill. NVIDIA's SkillSpector README cites research finding that 26.1% of skills in an analyzed subset contain vulnerabilities and 5.2% show likely malicious intent. That underlying study wasn't independently checked.

There are several ways to lower the risk:

Sources