Claude Code Marketplace: Browse, Install & Discover Skills in 2026

"Claude Code" now draws over 360,000 US searches a month, with single-month spikes approaching a million, according to Google Ads keyword data. As the user base exploded, so did the ecosystem of reusable skills: prompt templates, tool definitions, and multi-step workflows that extend what the agent can do. The problem is finding, evaluating, and installing those skills when they're scattered across GitHub repos, blog posts, and Discord threads. That is what a Claude Code marketplace solves, giving you one place to discover, vet, and install skills in seconds.

This guide walks through everything a Claude Code skills marketplace offers: what kinds of skills exist, how to find and install them, how they're vetted for safety, and how to publish your own.

Why Skills Are the Next Step for AI Coding Agents

Claude Code is powerful out of the box. It reads your codebase, runs commands, edits files, and reasons through multi-step problems. But every team has unique needs (coding conventions, deployment pipelines, domain-specific knowledge, compliance requirements) that no single agent configuration can cover.

Skills package that reusable expertise into portable units. A skill might encode your team's API design conventions so Claude Code follows them automatically. Another might define a multi-step deployment workflow that checks staging, runs integration tests, and opens a PR. A third might add tool definitions for interacting with an internal service.

This shift from "one agent, one config" to "one agent, many skills" mirrors what happened with VS Code extensions, Vim plugins, and browser add-ons. The base tool handles the core experience. The ecosystem handles everything specific to your workflow.

Several Claude Code skill directories have emerged: PolySkill, SkillsMP, claudemarketplaces.com, and others. Whether you call it a Claude Code plugin marketplace, a skills registry, or an extension store, the premise is the same: skills are more useful when they're discoverable, installable, and vetted.

What Types of Claude Code Skills Are Available?

Skills in the PolySkill registry fall into four types, each serving a different purpose:

These skills are organized across 10 categories:

• Productivity:task management, note-taking, workflow optimization
• Automation:CI/CD, infrastructure, DevOps scripts
• Coding & Data:linters, formatters, data pipelines, code generation
• Creative & Media:content creation, image processing, design tools
• Research & Learning:documentation, tutoring, knowledge management
• Security:vulnerability scanning, compliance checks, secret detection
• Marketing & Sales:SEO, analytics, outreach automation
• Crypto & Web3:smart contracts, wallet tools, DeFi integrations
• Finance:accounting, reporting, financial modeling
• Legal:contract review, compliance, regulatory research

Skills are LLM-agnostic by design. The skill.json manifest includes an adapters field that maps instructions and tools to different agent formats, so the same skill works across Claude Code, Codex, OpenClaw, and other agents.

How to Browse and Search the Claude Code Skills Marketplace

Whether you're looking for the best Claude Code skills in a specific category or exploring what's new, there are three ways to discover them: the web UI, the CLI, and the REST API.

Web UI

The Browse Skills page shows all skills organized by category. The top of the page features a category grid; click any category to filter. A search bar with typeahead suggestions lets you search by name, description, or keyword. You can sort by newest, most relevant, or alphabetical.

Each skill card shows the name, author, category, type, and a short description. Click through to the detail page for the full manifest, instructions, tool definitions, and scan results.

CLI search

The PolySkill CLI has a built-in search command:

polyskill search "deploy"

Filter results by category, type, or verification status:

polyskill search "deploy" --category automation --type workflow

Search results show the skill name, version, description, and category, enough to decide whether to install.

REST API

For programmatic discovery, hit the skills endpoint directly:

GET /api/skills?q=deploy&category=automation&type=workflow&sort=newest&limit=20

The API returns full skill metadata including instructions, tools, and adapters. This is useful for building custom UIs, integrating skill discovery into your own tools, or fetching skills at runtime in an agent pipeline.

How to Add Skills to Claude Code

Once you've found a skill, there are two ways to install it: the CLI for local development, and the API for programmatic/agent use. (Prefer Claude Code's built-in /plugin browser or a manual filesystem install? Our dedicated guide on how to add skills to Claude Code walks through all three approaches.)

CLI install (recommended for developers)

Three steps:

# 1. Install the CLI (once)
npm install -g @polyskill/cli

# 2. Find a skill
polyskill search "weather"

# 3. Install it
polyskill install @author/weather

The CLI auto-detects your agent. For Claude Code, it places the skill in ~/.claude/skills/. For Codex, OpenClaw, or others, it writes to the appropriate directory. You can also specify an output directory manually:

polyskill install @author/weather -o ./my-skills/

After installing, the skill is immediately available in your next Claude Code session, with no restart required.

API install (for agents and automation)

Fetch a skill's full definition over HTTP:

GET /api/skills/@author%2Fweather

The response includes the complete skill manifest: instructions, tool definitions, adapters, metadata. An agent can fetch this at runtime and apply the skill's instructions and tools without writing anything to disk. This is the pattern for skills-as-a-service: discover, fetch, and use in-memory.

How Skills Are Vetted for Safety

This is the part most marketplace guides skip, but it matters. Running third-party code in an AI agent that has shell access, file system permissions, and network capabilities is a real security concern; the OWASP Top 10 applies just as much to agent skills as it does to web apps. A skill is just instructions plus tool definitions, and a malicious one can attempt credential theft, data exfiltration, prompt injection, or destructive commands the moment the agent runs it. That is why PolySkill scans every published skill rather than trusting author reputation.

PolySkill runs a multi-layer scanning pipeline on every skill at publish time:

Supply-chain protection

Before a skill even reaches the scanner, it goes through name-based checks:

• Homoglyph detection:blocks names that use look-alike Unicode characters to impersonate existing skills (e.g., replacing 'o' with Cyrillic 'о')
• Edit-distance blocking:rejects names within 1 edit of an existing skill by a different author (catches typosquatting like recat vs react)
• Description similarity:flags skills whose descriptions are suspiciously similar to existing ones (Jaccard similarity > 0.50)

Content analysis

A static analyzer runs more than 30 regex patterns across the skill's instructions, tool descriptions, parameter schemas, and string fields. It checks for:

• Pipe-to-shell commands:curl | bash, wget | sh, and variants (always blocks, with an allowlist for trusted installers like rustup, pnpm, and brew)
• Credential access:reading SSH keys, AWS credentials, Docker configs, or browser password stores
• Data exfiltration:combining file reads with network calls, encoding data in URLs, posting to external services
• Prompt injection:hidden instructions attempting to override the agent's behavior
• Destructive commands:rm -rf, DROP TABLE, FORMAT, with exceptions for safe paths

Behavioral scanning

Beyond pattern matching, skills are analyzed for behavioral indicators: persistence mechanisms, privilege escalation, obfuscation techniques, and social engineering patterns.

Current status

Verification badges are currently in alpha. Scanning runs on every published skill and results are recorded, but the verified/unverified badge is not yet displayed publicly. This is intentional; we're tuning false-positive rates before the badge carries weight. All scan results are available for admin review, and skills flagged with HIGH severity findings are manually investigated.

How to Publish Your Own Skill

Publishing a skill to the PolySkill registry takes three commands:

# 1. Scaffold a new skill
polyskill init my-skill

# 2. Edit the generated skill.json manifest
# Add instructions, tools, keywords, category, etc.

# 3. Publish
polyskill publish

The skill.json manifest is the core of every skill. Here's a minimal example:

{
  "name": "@yourname/my-skill",
  "version": "1.0.0",
  "description": "A short description of what this skill does",
  "keywords": ["keyword1", "keyword2"],
  "category": "coding-data",
  "type": "prompt",
  "license": "MIT",
  "instructions": "Your skill instructions go here..."
}

Key fields:

• name:scoped format: @author/skill-name
• version:semver (publishing a new version overwrites the previous)
• category:one of the 10 categories listed above
• type:prompt, tool, workflow, or composite
• instructions:the natural-language instructions the agent follows
• tools:optional array of tool definitions with JSON Schema parameters

For automated publishing (CI pipelines, agent-generated skills), PolySkill supports agent self-registration: register an agent, get an API key, and publish programmatically without a GitHub account. The agent can be claimed later by a human via GitHub OAuth.

The full publishing guide, manifest reference, and adapter documentation are at polyskill.ai/docs.

Related guides: How to Add Skills to Claude Code (2026) | Claude Code Router: Complete Guide (2026) | Codex vs Claude Code: Full Comparison (2026) | Claude Code vs Cursor (2026) | Claude Code vs Gemini CLI (2026)

Back to Blog