SkillVerdict
All verdicts

find-skills

Install with caution vercel-labs/skills

What vercel-labs' skill-discovery skill does, that it installs other skills via npx, safety notes, install command and alternatives.

Verified · Repo on GitHub

What it does

A discovery helper. When you ask 'is there a skill for X?', it tells the agent to check the skills.sh leaderboard first, then run npx skills find [query], verify quality (install counts, source reputation, GitHub stars in its own guidance), and offer npx skills add <package>. It is instructions, not code.

Who made it / license / last checked

vercel-labs (Vercel) · License: MIT (repo LICENSE, checked in clone) · Repo last commit checked: 2026-10-29 (Europe/Madrid reporting; commit timestamp in source repo)

Install

npx skills add vercel-labs/skills@find-skills

Pattern verified in its own SKILL.md: npx skills add <owner/repo@skill> and npx skills find [query]. Exact per-skill flag syntax can vary by CLI version — run npx skills add --help first if unsure.

What files / scripts it runs

One file only in the skill folder: SKILL.md (5,472 bytes, unchanged since 19 Oct). No scripts in the skill itself. The risk is downstream: it instructs the agent to run the Skills CLI, which downloads and installs other people's skills.

Pros

  • Dead simple — one markdown file, nothing hidden to execute
  • Bakes in sensible vetting advice: check leaderboard, prefer well-known sources
  • The right front door if you install skills often

Cons

  • It is a supply-chain front door: its job is installing third-party code/prompts
  • Its own advice to trust install counts is weak — counts measure distribution, not quality (see our security-review copy case)
  • You still have to read every skill it finds

Alternatives

Browsing skills.sh yourself and reading SKILL.md on GitHub; Anthropic's skill-creator if you want to author rather than discover (not reviewed as a standalone page in this batch).

Notes

Skills.sh listed it at 3.9M installs on 19 Oct 2026 and 4.1M, still #1, on 30 Oct 2026. Treat that as a distribution number, not proof of quality — this skill's own workflow leans on it too heavily.

Sources

Checked 19 Oct 2026 (Europe/Madrid) from local clones of the repos above. Repo last-commit is a repo date, not a per-skill release date. Install counts, where quoted, are skills.sh leaderboard figures fetched that day and are distribution, not quality.

Verified on 2026-11-04 through the GitHub API: it has had no commit since the 30 Oct check, so the files, sizes and verdict above still hold. Previous check on 2026-10-30, against a fresh clone (repo commit 92a9a34, 2026-10-29). Since 19 Oct: SKILL.md unchanged (5,472 bytes; its last commit, 773fb2c, is from 10 Jul 2026). Still one file, no scripts. Its vetting advice still leans on install counts (1K+), GitHub stars and source reputation. Verdict unchanged.