Every skill gets a score out of 100 from a public formula: adoption 35 points, upkeep 20, trust 20, quality 15, reader answers 10. Security scans are shown apart, and no one can pay for a position. We read each skill's instructions but have not run them.
What gets a skill onto the list?
We started from 14,650 skills that public search on skills.sh returned on November 2, 2026, and looked closely at the 2,000 most installed. Many people install skills straight from GitHub, so install counts miss some well-known ones. We also searched GitHub for popular repositories, read the 244 with at least 5,000 stars that contain a SKILL.md, and add those whose main product is a skill or a set of skills when they have at least 10,000 stars. These come on top of the 200 most installed, under the same rules. A skill stays out if:
- Its source is not a public GitHub repository we can read.
- It is a copy of another skill. We compare the text of the instructions.
- A scanner rated it critical risk.
- Its install count has no support elsewhere: over 15,000 installs and more than 400 installs per GitHub star, unless the publisher makes the product it covers.
- It is under 30 days old, or it exists to evade detection systems.
- We read its instructions and found nothing of its own: a placeholder, a note that it moved, a setup helper that only installs a program, or a translated copy of a skill already listed.
- Its name suggests a company made it when it did not, it imitates real people or builds a copy of someone without their consent, it gives buy and sell signals, it is an attack toolkit, or it resells accounts.
Each publisher gets at most three places, and skills that only work together share one entry. Without these two rules, a few publishers would fill most of the list. Anthropic gets up to ten places: its own repository is the reference set that Claude's documentation points to, and people look for those skills by name.
How is the score calculated?
| Part | Points | What it measures |
|---|---|---|
| Adoption | 35 | Installs (60%), eight-week growth (25%), GitHub stars divided by the square root of the number of skills in the repository (15%). Installs run on a log scale from 1,000 to 2 million; stars from 10 to 100,000. |
| Upkeep | 20 | Days since the repository last changed (80%) and repository age up to 180 days (20%). |
| Trust | 20 | The publisher makes the product (35%), scan results (35%), a stated license (15%), no download piped into a shell in its instructions (15%). |
| Quality | 15 | Our check of the file: valid settings, a description that says when to use it, under 500 lines as Anthropic advises, worked steps or examples, enough substance. |
| Reader answers | 10 | The share of readers who said it did the job, after at least 30 answers. |
When a part has no data, it does not count as zero. Its points are shared across the others, and the page's data confidence drops. Formula version 1. Each item is rechecked about once a day.
What keeps a skill out of the top ten?
A high-risk result from any scanner, an install count we could not back up, or low data confidence. The skill stays on the list with a visible warning and its full score, but it sits below tenth place.
What do the security labels mean?
- No warnings: every scanner that checked it passed it.
- Scanners disagree: at least one raised a medium warning.
- High-risk warning: at least one rated it high risk or failed it.
- No scan yet: we found no result.
The results come from Gen Agent Trust Hub, Socket, Snyk, Runlayer and ZeroLeaks through skills.sh. They do not always agree, and a Tencent study found little overlap in what scanners catch. A clean result lowers the risk. It is not our guarantee. If a skill's text changes after we read it, the page says so.
What can't this ranking tell you?
- Whether a skill works well. We read the instructions; we have not tested the output.
- All installs. The count comes from the skills command line tool. Installs through Claude Code's
/plugincommand are not in it, so skills that ship mainly as plugins look smaller than they are. Skills.sh does not fully document how it counts, and install counts can be inflated. - Upkeep of one skill. We see when its repository last changed, which may not be the skill itself.
- Satisfaction, until readers answer. We found no public source for it, and we will not make one up from GitHub stars.
- Growth, until we have eight weeks of our own history. It starts on November 1, 2026.
Token counts are estimates: about four characters per token.
How are plugins and connectors treated?
They have no public install counts, so we rank them separately and never against skills. Plugins use stars, upkeep and trust. Connectors are not scored at all: there is too little public data to do it honestly, so they are listed from A to Z.
Who makes this, and does money affect it?
Skill Finder is an independent project of What the tech, with no connection to Anthropic. The text is written with AI assistance from each skill's own instructions and checked by the desk. No publisher pays for a place, and the formula has no input for money. If we ever carry sponsorship here, it will be labelled and kept out of the ranking.
How do I report a mistake?
Write to info@whathetech.net with the page and the problem. If you publish a skill and think we have it wrong, tell us the same way. The full data is public, so you can check our work.