Claude Skills Marketplace: Where to Find and Vet Skills

There is no single Claude skills store. In Claude Code, you add a plugin marketplace and install a skill from it. On claude.ai, you use Customize > Skills. Before you install a skill from anyone else, read every file in the package.

The simplest places to start are Anthropic's official marketplace, the anthropics/skills repository, or a marketplace run by your own team. Public directories can help you find candidates. They do not remove the need to inspect the package before you let it run.

Where Claude skills actually come from

The word marketplace covers several routes. Choose the route that matches who controls the skill and where you use Claude.

A Claude Code marketplace is a directory or repository with a .claude-plugin/marketplace.json file. That file lists the plugins and tells Claude Code where to fetch them. A marketplace can be public, private, local, or hosted as a JSON file.

Add a marketplace and install a skill in Claude Code

Start Claude Code, then add only the marketplace you intend to use. Anthropic's skills repository gives this exact command:

```
/plugin marketplace add anthropics/skills
```

Once the marketplace is registered, install a named plugin with its marketplace suffix. Anthropic's repository lists these examples:

```
/plugin install document-skills@anthropic-agent-skills
/plugin install example-skills@anthropic-agent-skills
```

In a Claude Code session, the install command first opens the plugin details. It does not install at once. Read the details, choose the scope, and confirm only after the package matches the task.

Use claude.ai for personal and organization skills

On claude.ai, open Customize > Skills. Members can turn on example skills, use skills supplied by their organization, and upload personal skills when the feature is enabled. Enterprise owners can also provide skills to everyone in the organization.

This route is separate from the Claude Code plugin marketplace. Use it when the skill belongs in the claude.ai experience rather than a terminal workflow.

Run your own team marketplace

A team marketplace gives one group control over the catalog. Its repository can be private, and an administrator can require it on each machine. Every plugin entry in marketplace.json names the plugin and its source.

This is useful when a team wants one reviewed collection instead of asking each person to find and install packages alone. Keep the marketplace small enough to review, and record who owns each plugin.

Check a skill before you install it

Treat a skill like software, not like a prompt you can skim. Skills can contain instructions and executable code. Anthropic warns that a malicious skill can direct Claude to call tools or run code outside the package's stated purpose.

1. Confirm the source. Prefer a skill you wrote, one from Anthropic, or one approved by your organization.
2. Read SKILL.md from top to bottom. Check that its trigger and promised task agree.
3. Open every script, image, template, and supporting file. A harmless-looking main file can load another resource later.
4. Look for network calls, broad file access, shell commands, and dependencies that do not fit the stated task.
5. Test with narrow permissions and non-sensitive files before you use the skill on real work.

Anthropic's guidance says to review all bundled files and watch for unexpected network calls or file access. Snyk's skill scanner says prompt injection appears in 91% of the malicious skills it confirmed. That figure is a reason to inspect behavior, not a promise that a scanner can make a package safe.

Our example: inspect Anthropic's skill-creator package

We reviewed the files for skill-creator in Anthropic's repository. This was a file review, not an installation or execution.

The top level contains LICENSE.txt, SKILL.md, agents/, assets/, eval-viewer/, references/, and scripts/. The frontmatter begins:

```
name: skill-creator
description: Create new skills, modify and improve existing skills, and measure skill performance.
```

Source: Anthropic's skill-creator SKILL.md, viewed 29 October 2026.

1. Source: it sits in Anthropic's public anthropics/skills repository, so the owner and package path are clear.
2. Trigger and promise: the frontmatter says it creates, improves, and measures skills. The body follows that scope with drafting, testing, review, and benchmarking steps.
3. Bundled files: the package is not one Markdown file. It includes agents, references, assets, scripts, and an evaluation viewer, so each folder needs review.
4. Access: the instructions use bundled scripts, write evaluation files, and start a local viewer. That access fits the package's stated purpose, but it is broader than a text-only helper.
5. Test plan: do not begin with a live repository. Use a temporary folder and non-sensitive sample files, then inspect every created file before wider use.

The safe sequence is to find a candidate skill, add its marketplace, read every file, install with narrow permissions, and test it on non-sensitive work.

Public marketplace listings: 29 October 2026 snapshot

The search results mix installable repositories, directories, a sales guide, a publishing tool, and a feature proposal. Use this table to choose the next page to inspect, not as a safety rating.

Public marketplace results snapshot

Source: adrianpuiu, Agent37, Agent Skills, Token-Eater, Aviv Sinai, Developers Digest, MCP Market, and mattpocock issue 3, viewed 29 October 2026.

Use a listing to discover, not to delegate trust. Stars, category labels, and short descriptions do not explain every script or network call. Return to the source repository, read the package, then add its marketplace on purpose.

Common mistakes

Do not paste an install command before you know which marketplace it adds. Do not assume a colleague's link is safe because the person is trusted. Their source may have changed after they used it.

Do not review only SKILL.md when the package also contains scripts. Do not grant broad file access for a small task. If the package is too large to understand, pause and choose a smaller or better documented option.

Official sources

These pages define the marketplace routes, install commands, skill controls, and security guidance used in this guide.

• Anthropic: Discover and install plugins
• Anthropic: Create and manage a plugin marketplace
• Anthropic skills repository
• Anthropic: Agent Skills overview and security guidance
• Anthropic Help Center: Using skills in Claude
• Snyk: Skill security research

Turn an internal skill check into an external visibility check

The skill-creator example keeps an internal workflow repeatable and reviewable. Xtrusio handles the outside question: how AI engines describe your brand, which pages they cite, and where the answer lacks evidence. Use both when you want a controlled process inside the team and a clear view of what customers see outside it.

Get your free AI visibility check and see which answers and citations need attention first.