Agent Skills for VS Code

Browse, search, and install 1,625+ official vendor skills from companies like Anthropic, Microsoft, OpenAI, Vercel, Firebase, Stripe, and 20+ more — plus 91,000+ community skills from Vercel skills.sh — all from inside VS Code. Every install runs through a 9-stage security pipeline before any files touch your library.

Why this exists

AI agent skills are scattered across multiple marketplaces and GitHub repos with no unified way to search, compare, or vet them. This extension gives you a single pane of glass across all sources, with trust badges, quality filters, and security scanning built in.

Features

Marketplace with 1,625+ pre-loaded official skills

On first launch, the marketplace is pre-populated with skills from 28 official vendors including Anthropic, Microsoft, OpenAI, Vercel, Firebase, Stripe, Cloudflare, Supabase, and more. No configuration needed — browse immediately.

Multi-source search

Search across 5 sources in parallel: the pre-built catalog, Vercel skills.sh (91K+ skills), Anthropic's official marketplace, GitHub topic search, and SkillsMP. Results are deduplicated by repo URL and ranked by trust tier.

Rich filters and sorting

Filter by tool (Docker, Terraform, React, dbt, etc.), role (backend engineer, DevOps, data scientist, etc.), functionality (code review, deployment, testing, etc.), methodology, and vendor. Sort by stars, recency, name, or trust score. Toggle "Official vendor skills only" for curated results.

Quality badges and trust tiers

Every skill carries quality badges computed from GitHub metadata:

• Official Company — published by the vendor that builds the technology
• Popular — 1,000+ GitHub stars
• Open Source — permissive license (MIT, Apache, BSD)
• Recently Updated — pushed within the last 7 days
• Low Stars / Stale / No License — caution signals for informed decisions

Skill detail panel

Click any skill to inspect its metadata, description, repo link, and provider support before installing. Scan first, or install directly.

Security scanning

Every install passes through a 9-stage pipeline:

1. Resolve — parse source identifier
2. Fetch — sparse git checkout
3. Security scan — 50+ pattern rules (injection, exfiltration, privilege escalation, obfuscated code)
4. Provenance — verify GitHub stars, license, push date
5. Transform — normalize frontmatter
6. Categorize — auto-place into subcategories
7. Install — place files, register in manifest
8. Link providers — generate Claude Code, Codex, Copilot stubs
9. Record — update Skillfile for reproducibility

Post-install: run Agent Skills: Scan All Installed Skills to audit your entire library at any time.

Skill Builder

Create new skills without writing YAML frontmatter from scratch. Three creation modes:

• From template — pick from 9 built-in templates (code review, test generator, deployment, integration, documentation, security audit, migration, linter, generic)
• From description — describe what the skill should do in natural language, and the LLM generates the full skill body
• From docs — paste CLI --help output or API docs, and the LLM extracts actionable instructions

All three flows open the generated skill.md in the editor for review before installing.

Settings panel

Graphical settings panel for managing all accounts, API keys, and embedding providers. One-click GitHub OAuth, inline set/update/clear with status badges.

Skillfile editor

Visual manager for your Skillfile entries. See installation status at a glance, add/remove entries, and restore pending skills with one click.

Semantic search (RAG-powered)

Type a natural-language description and find the best matching installed skill in milliseconds. The retrieval engine supports 16 embedding backends — from cloud APIs to a bundled local model that works offline.

If you have GitHub Copilot, the extension can also use your existing AI subscription as a search backend with zero setup.

One-click GitHub sign-in

Click "Sign in with GitHub" to increase the API rate limit from 60 to 5,000 requests/hour. No PAT generation needed — uses VS Code's built-in OAuth. If you're already signed in via Copilot, the token is picked up automatically.

16 embedding providers

Set any of these via Agent Skills: Set API Keys to upgrade semantic search quality:

MCP server

The companion @agent-skills/mcp-server exposes a find_skill tool so any MCP-capable agent (Claude Code, Codex, Cursor, Cline, Gemini CLI) can search your skill library. See the MCP server docs.

Quick start

1. Install the extension from the VS Code Marketplace
2. Click the Agent Skills icon in the Activity Bar — official vendor skills are already loaded
3. Search for a tool, framework, or task in the marketplace
4. Click any result to inspect → scan → install
5. (Optional) Run Agent Skills: Set API Keys to sign in with GitHub or add an embedding provider

Commands

Settings

CLI companion

The @agent-skills/cli package ships a npx agent-skills binary that wraps the same library. Both read and write the same ~/.agent-skills/skills.json manifest — mix and match freely.

License

MIT