The Ecosystem Audit: Scoring 167 Community Agent Skills

The Claude Code skill ecosystem is growing fast. Over 71,000 skills listed on SkillsMP alone. Vercel, Microsoft, HashiCorp, Cloudflare, Stripe, Sentry, Hugging Face, and dozens of smaller contributors are all shipping skills. The supply is real. The question is whether anyone is checking the quality.

We scored 167 community skills from 40+ organisations using the same six-dimension SupaScore rubric we apply to our own 1,278 published skills. Same weights, same criteria, same threshold.

Not a single community skill reached our 80.0 publishing threshold.

The sample

167 skills from a broad cross-section of the ecosystem. Corporate contributors like Vercel, Microsoft, HashiCorp, Cloudflare, Stripe, Sentry, and Hugging Face. Platform-focused builders like Expo and Supabase. Prolific independent contributors like softaworks (42 skills), TerminalSkills (24), obra, ComposioHQ, and machina-sports. Curated collections from awesome-skills and similar aggregators.

We excluded trivially broken skills (empty files, syntax errors) and focused on skills that were clearly intended for real use. If someone published it, we scored it.

Tier distribution

Community average: 54.6. SupaSkills average: 86.7. A 32-point gap.

For context: our quality gate requires a minimum score of 80.0, at least 6 research sources across 2+ source types, and a passed masterfile from our 8-phase pipeline. 98% of our 1,278 skills are Platinum tier. Zero community skills reached Platinum. 14 reached Gold.

The best of the community

The highest score in the entire sample: Move Code Quality by 1NickPappas, at 79.5. A focused skill for Move blockchain development with real domain expertise. It falls just short of our publishing threshold, but it is genuinely well-built.

The pattern is consistent. The best community skills come from domain experts who know their subject deeply:

• Move Code Quality (79.5, Gold). Blockchain-specific, technically precise, clear scope.
• Robotics skills from specialised contributors. Narrow focus, real engineering knowledge.
• Email marketing bible. Practical, opinionated, grounded in actual campaign experience.

What these have in common: a person who knows the domain wrote them by hand, with real constraints and real opinions. They are not generated from documentation.

Where the scores break down

Research Quality is universally weak

The weakest dimension across all 167 skills. Most cite zero sources. No academic references, no industry frameworks, no books, no standards documents. The skill is the author's knowledge, unverified and unattributed.

This is the single largest factor in the score gap. Our pipeline requires minimum 6 sources across 2+ types (books, academic papers, industry frameworks, standards, etc.). That requirement alone accounts for roughly a third of the difference.

To be fair: some authors may have done extensive research without citing it in the skill file. We cannot know. So we re-ran the entire audit without the Research Quality dimension, redistributing its 15% weight proportionally across the remaining five dimensions. The result: the community average rises from 55.5 to 58.1. The gap narrows from 31 points to 28. Two skills cross our 80.0 threshold (agent-browser by Vercel at 81.1 and Obsidian Agent Memory at 80.5). Zero reach Platinum. The structural gap persists across all dimensions, not just research.

Many skills are documentation snippets

A common pattern: take an API reference or framework documentation, paste it into a skill file, add a brief instruction header. Claude already has access to this information through its training data. The skill adds little that a well-written prompt would not.

softaworks (42 skills) and TerminalSkills (24 skills) are the most prolific contributors in our sample. Both score consistently in the Bronze range. Volume without a quality gate produces volume.

Corporate skills are better structured, still shallow

Skills from Vercel, Microsoft, and similar organisations tend to have cleaner prompt engineering, better formatting, and more thoughtful instruction design. They score higher on Prompt Engineering and Completeness.

But they still lack research depth. A Vercel skill for Next.js deployment is well-written, but it does not cite the Next.js documentation, performance benchmarks, or deployment best practices from external sources. It is the author's knowledge in prompt form, same as the independents.

Practical Utility is the strongest dimension

This is encouraging. Many community skills solve real workflow problems. Deployment automation, code review checklists, framework-specific patterns. The intent is practical. The skills want to be useful.

The issue is not ambition. It is infrastructure.

The structural gap

The 32-point gap between community average (54.6) and our average (86.7) is not about individual talent. Some community skill authors clearly know their domains well. The gap is structural.

Our 8-phase pipeline exists because individual expertise is not enough. Expert Council, Deep Research, Quality Gate, IP Audit, Cross-Validation. Each phase catches problems the others miss. The result is not that our authors are smarter. The result is that the pipeline catches more.

The security dimension

This is not just about quality scores. A recent arXiv study found that 26.1% of community skills contain security vulnerabilities. Prompt injection vectors, unsafe tool access patterns, missing input validation.

We run automated IP audits on every skill (1,278/1,278 audited, zero high-risk findings). We run a daily security scan with 25 checks. We have a canary skill that tests our delivery guard every 24 hours.

Most community skills have none of this. The ecosystem is growing faster than its safety infrastructure.

What we learned

Quality infrastructure makes a measurable difference. Not a marginal one. A 32-point, two-tier-category difference. The best community skill (79.5) would not pass our quality gate (80.0). That is not a coincidence. The gate exists precisely at the boundary where research depth, governance, and structured evaluation start to matter.

The best skills come from domain experts, not aggregators. Move blockchain, robotics, email marketing. Narrow focus, real knowledge, clear opinions. Aggregators who publish 20+ skills at once produce Bronze consistently.

The ecosystem needs quality infrastructure. 71,000+ skills on SkillsMP. 26.1% with security vulnerabilities. No scoring, no quality gates, no IP audits. The supply side is solved. The quality side is wide open.

The numbers

We built SupaSkills because we believe skills are the most important layer on top of Claude's already strong foundation. Claude is excellent at reasoning, coding, and analysis. Skills add domain structure, research depth, and specialised frameworks that make that foundation even more effective.

But skills only add value if they are good. The ecosystem audit suggests most are not there yet. The good news: the path from Bronze to Platinum is well understood. It is research, structure, and a quality gate that does not let anything through until it is ready.

We built that infrastructure. It is open for anyone who wants to use it.

Methodology: 167 skills scored using SupaScore (6 dimensions, weighted formula). Sources: GitHub repositories and skill directories from 40+ organisations. Scoring performed March 2026. All scores use the same rubric applied to our own skills. The full dataset is available on request.

Full Results: All 167 Skills Scored

Transparency matters. Here is every skill we tested, with author and score.

All skills scored using SupaScore 6D rubric (Research Quality 15%, Prompt Engineering 25%, Practical Utility 15%, Completeness 10%, User Satisfaction 20%, Decision Usefulness 15%). Same rubric applied to all 1,278 SupaSkills.

Disclaimer: This benchmark was conducted in good faith using a documented, reproducible methodology. The same rubric and scoring process is applied to our own skills. Errors are possible. If you are a skill author and believe your skill was scored unfairly, miscategorised, or evaluated based on an outdated version, please contact us. We are happy to re-score with an updated version, correct any factual errors, or discuss methodology. The goal of this audit is to improve the ecosystem, not to diminish anyone's work. The security vulnerability statistic (26.1%) is sourced from Liu et al., 2026 (arXiv:2601.10338), an independent academic study.