The top 100 moved: 94 of today's most-installed skills were not in our corpus
The skills.sh half of this corpus was a snapshot of the most-installed skills taken in February 2026. We re-pulled the top 100 by all-time installs on 2026-10-22 and compared it with what we had.
Six skills overlapped: find-skills, agent-browser, frontend-design, two vercel-labs best-practices guides, and remotion-best-practices. The other 94 came from twelve sources we had never scanned, including two that are not GitHub repositories at all. This post covers what the refresh found. The companion post on running a second scanner over the whole corpus went out the same day.
What the top 100 looks like now
| Source | Skills in top 100 | Ranks | Scanned | Flagged |
|---|---|---|---|---|
| open.feishu.cn (Lark) | 27 | 31 to 76 | 28 | 0 |
| mattpocock/skills | 22 | 2 to 93 | 38 | 1 HIGH |
| microsoft/azure-skills | 16 | 77 to 96 | 93 | 13 (11 CRITICAL) |
| heygen-com/hyperframes | 12 | 5 to 95 | 26 | 8 CRITICAL |
101-skills, magentosh, qu-skills superpowers |
12 (4 each) | 25 to 100 | 258 | 18 HIGH |
| vercel-labs (three repos) | 4 | 1 to 55 | in corpus | |
| flowkit-labs/skills | 1 | 11 | 1 | 1 CRITICAL |
| anthropics/skills | 1 | 13 | in corpus | |
| designed-by-ai/skills | 1 | 18 | 1 | 0 |
| uizze.sh | 1 | 61 | 2 | 0 |
| remotion-dev/skills | 1 | 73 | in corpus |
Four observations before the findings.
The registry is a different place than it was in February. The February top list was dominated by individual developer-productivity skills. Today it is dominated by vendor suites: 27 Lark skills from a single .well-known site, 16 Azure skills, 12 HeyGen skills. Install counts for a suite move together, so when one skill in a suite is popular the whole suite occupies a block of ranks. Ranks 31 to 52 are all Lark; 77 to 91 are all Azure.
Two of the sources are not repositories. open.feishu.cn and uizze.sh publish skills through the .well-known/skills/index.json convention: a JSON index on the vendor's own domain, with files served from the same host. skills.sh lists them as site/<host>. Our pipeline could not fetch them until this week. Anyone whose corpus is built from git clone is missing them, and the seven-scanner disagreement study, which worked from GitHub, would be too.
Install counts are large and flat. The hundredth skill has 513,690 installs. Position 25 has 831,089. The top 100 together report 80 million installs. A skill does not have to be good to be here; it has to be in a suite, or be installed by something automated.
The old scanning sample is stale. Our February list represented the top of the registry at the time. It no longer does. Any claim this site makes about "popular skills" has to be re-based on the new list, and the list has to be re-pulled on a schedule.
Finding 1: one vendor's skill set, at least seven owners, twelve slots in the top 100
Ranks 25 to 28, 62 to 66, and 97 to 100 are the same four skills, ai-video-generation, ai-image-generation, twitter-automation, and ai-avatar-video, published three times under three GitHub organisations: 101-skills, magentosh, and qu-skills. Each repository is named superpowers. Each contains 86 skills. They are byte-identical, and all three sit at the same commit, becc2564, dated 2026-08-03.
The skills belong to inference.sh, a pay-per-run API for image, video, audio, and text models with its own CLI. Its official repository is inference-sh/skills, created in January and actively maintained. The commit author on every copy is the company's founder. In August the official repository was forked to skills-101/superpowers, then to magentosh/superpowers, while 101-skills and qu-skills received direct copies. Each of those organisations was created between June and August 2026 and holds exactly one public repository.
Three was an undercount. Pulling the full all-time skills.sh listing, 600 rows, and searching for the same skill under other owners:
| Owner / repository | Rank of ai-avatar-video |
|---|---|
| 101-skills/superpowers | 28 |
| magentosh/superpowers | 64 |
| qu-skills/superpowers | 95 |
| skills-shell/superpowers | 205 |
| prime-skills/runcomfy-agent-skills | 206 |
| its-a-skill-issue/superpowers | 221 |
| bankai-skills/superpowers | 233 |
Below rank 600, further single-repository owners (inference-shell, inf-sh, inference-sh-3) publish the same set. We count at least six repositories named superpowers and around ten owners carrying one vendor's skills.
We are not in a position to say why the copies exist, and we did not contact the company. We can say what the effect is. skills.sh ranks by owner/repo/skill, so one skill set occupies twelve of the top hundred slots, and many more below, under a name that collides with obra/superpowers, the most-starred skills framework on GitHub. A user who searches the registry for "superpowers" and installs the first four results gets inference.sh's commercial API skills. Those skills instruct the agent to run curl -fsSL https://cli.inference.sh | sh and then belt login, which is where their 18 HIGH findings come from. The credential they ask for is an inference.sh API key, not a third-party provider key.
On this site, the three copies in the corpus now point a canonical link at one page and the other two are out of the sitemap, with an "identical copies" note on all three. We did not remove any of them. The duplication is the finding, and it is a registry-design finding more than a skill-content one: a ranking keyed on owner and repository can be multiplied by anyone willing to create organisations.
Finding 2: two false positives in the top 60
Scanners are tested on malicious skills. Popular skills are a different test: they are mostly written by careful people, and every finding is read by many users.
reddit-automation, flowkit-labs, rank 11, CRITICAL. The single finding is a YARA prompt-injection match on SKILL.md line 86. The matched text is inside a paragraph instructing the agent to treat all Reddit content as untrusted and to disregard any post that says "ignore your instructions". The skill is defending against the pattern it was flagged for. NVIDIA SkillSpector gives it a score of zero.
implement, mattpocock, rank 56, HIGH. Flagged as "active instruction acquires and executes remote content" for the sentence "If the user passes a ticket reference, fetch it from the issue tracker and state its title before starting." Reading a ticket title is not executing remote content. SkillSpector rates it SAFE.
Both are now in the false-positive register as confirmed. Both are in the top 60 by installs. If the scanner's output were gating installs, the eleventh most popular skill on the registry would be blocked for telling the agent to be careful.
Finding 3: Microsoft's Azure skills, read by hand
microsoft/azure-skills is 93 scanned skills, 13 flagged, 11 of them CRITICAL. That is the worst flag rate of any new source and the one most likely to be quoted. So we read every HIGH and CRITICAL finding against the source.
First, the repository ships two copies of itself: the skills/ tree and a .github/plugins/azure-skills/ tree are identical, so 13 flagged is really 7 distinct skills, each counted twice.
| Skill | Finding | What the code does | Our reading |
|---|---|---|---|
| microsoft-foundry, finetuning | CRITICAL, cross-file env var exfiltration across 11 scripts | Reads AZURE_OPENAI_API_KEY and the endpoint from the environment and calls the Azure OpenAI fine-tuning API |
Expected. The key goes to the endpoint the user configured. The scanner cannot see the destination; a reader can. Not a false positive in the strict sense, but not exfiltration. |
| microsoft-foundry, finetuning | CRITICAL, exec() in calibrate_grader.py |
Loads a user-supplied grader file as Python and runs it, with a docstring warning that says exactly this | Real, disclosed, by design. A fair MEDIUM. |
| microsoft-foundry, toolbox | 5 HIGH, "jailbreak" YARA | Matches the words "references", "citation", and "admin key for the next steps" in a reference doc | False positive. The rule fires on a section heading. |
| microsoft-foundry, toolbox | HIGH, bearer token to a network sink | Sends an Azure token to eastus.api.azureml.ms, the Azure ML asset gallery |
Expected. |
| azure-deploy | CRITICAL, exfiltration via curl |
curl -f "$ENDPOINT/health" after deploy |
False positive. It is a health check. |
| azure-app-onboard, scaffold | CRITICAL, find -exec chain |
find "$INFRA_PATH" -name '*.bicep' -exec cat {} + |
False positive. It concatenates the Bicep files it is about to validate. |
| aks-network-capture | CRITICAL, remote fetch then execute | wget -q -O /dev/null inside a pod to generate test traffic |
False positive. The fetched content goes to /dev/null. |
| entra-agent-id | HIGH, dynamic process execution in SKILL.md | A documented Python sample calls az ad signed-in-user show through subprocess.run |
False positive as a HIGH. It is example code for the Azure CLI. |
Net: of 11 CRITICALs, we would keep one as a MEDIUM and call the rest expected behaviour or false positives. We would not describe this repository as dangerous, and the per-skill pages now say so. The Azure findings are a clean illustration of a general problem: infrastructure tooling reads credentials and talks to the network because that is what deploying infrastructure is, and a static rule that treats "environment variable near a network call" as exfiltration will flag every cloud SDK ever written.
The rest of the new sources
- heygen-com/hyperframes, 8 of 26 flagged, all CRITICAL, all
child_processand dynamic-execution patterns in a Node video-rendering toolkit. Expected for the tool; a 414 MB package that an agent is asked to install is a supply-chain surface in its own right, and that is the risk to think about, not the shell calls. - leonxlnx/taste-skill, 1 of 1, CRITICAL for 30
page.eval()calls. These evaluate JavaScript inside a headless browser page to take design measurements, not on the host. False positive at CRITICAL. - juliusbrussee/caveman, 2 of 28 flagged HIGH: "credential file access" and "sensitive source reaches a network sink". The first is a deny-list of credential file names the tool refuses to compress. The second sends the user's own API key to the LLM endpoint the user configured, with a carefully unredirected header so the key cannot follow a redirect to another host. Both are the skill being careful.
- open.feishu.cn, 28 Lark skills, zero findings. The first non-GitHub source in the corpus is also the cleanest.
- mattpocock/skills, 38 skills, one HIGH, discussed above.
What we changed
The fetcher that pulled the February snapshot stopped working when skills.sh retired its JSON API. The pipeline now reads a daily CSV mirror of the registry, can fetch .well-known sites, and scans a repository or site under a name prefixed with its source so that two sources with a skills/tdd cannot overwrite each other. The whole refresh, 476 skills across 12 sources, took about ninety seconds of scanner time. The re-pull will run monthly.
Method and limits
Ranks and install counts are the all-time view from the skills.sh listing on 2026-10-22, via the best-skills CSV mirror. "In corpus" means the skill was already scanned in the February or May runs; we matched by skill name, so a skill renamed since then would be counted as new. All scans used Cisco skill-scanner 2.3.1 with the static, behavioral, and trigger analyzers and no language model. Hand reading covered every HIGH and CRITICAL finding on microsoft/azure-skills and the individual skills named above, not the full set of 44 flagged skills. Repository metadata is from the GitHub API on 2026-10-22; we did not contact any of the repository owners.