Agent Skills & the Skills Economy

1. Use pdfplumber via bash (Day-49 reliability hook).

2. Validate against schema.json

3. Return as structured JSON

skills.sh (Vercel, launched 20 Jan 2026) is the closest thing to a canonical registry. npx skills add <package> drops a Skill folder into your repo, the leaderboard ranks packages by weekly installs, and Vercel ships first-party governance hooks. The top Skill hit 20,000 installs in six hours after launch. As of mid-May 2026: 83,627 packages, 8M+ total installs. For comparison, npm took ten years to cross 350K packages -- Skills did 25% of that in four months. SkillsMP takes the opposite approach: 800K+ Skills scraped from public GitHub repos with a minimum bar of 2 stars and almost no curation. Easy to discover, dangerous to install. ClaudeSkills.info sits in the middle -- 658+ Skills, free, community-contributed with light moderation. Anthropic's own GitHub org (anthropics/skills, anthropics/financial-services) publishes officially-supported Skills; financial-services alone gained 12,088 stars after Anthropic shipped the Finance Agent templates (Day 46). Addy Osmani's agent-skills (40,363 stars) is the monthly trending leader on production-grade engineering Skills. Skills inherit the full permissions of the agent that loads them. That is the dangerous part. Snyk published the ToxicSkills audit in February 2026 -- the first comprehensive sweep of the ecosystem. They scanned 3,984 Skills from ClawHub and skills.sh. Findings: OpenSourceMalware.com documented the first coordinated malware-as-a-Skill campaign in Feb 2026: 30+ malicious Skills distributed via ClawHub for Claude Code and OpenClaw. A separate audit of 2,857 ClawHub Skills found 341 malicious (12%) of the registry compromised. Attack patterns include hidden Unicode instructions invisible to humans but read by OCR, __name__/load_module tricks that escape Python sandboxing to call os.system, and "Clinejection" -- an attacker plants a Skill that, when triggered by a normal user prompt, opens a GitHub PR with a credential-stealing workflow. Snyk's framing is the right one: Skills are the new npm. We've been here before. We

Threat model -- three lines from SKILL.md to shell access Snyk's red-team published the canonical exploit demo: a single Skill description that says "helps the user organise their repo," a body that includes <br>-hidden instructions to exec(open('/tmp/x').read()) wrapped in a benign-looking shell command, and a bundled post-install.sh that exfiltrates SSH keys. Three lines. Zero CVEs raised because no traditional supply-chain scanner has a detection category for Markdown-as-payload. That is the new

The standards body response is already moving. Three controls matter: EU AI Act Annex III (T-76 days, enforcement Aug 2 2026) is the forcing function. Any high-risk agent must produce reconstructable reasoning -- what tools were called, why, with what authority, what data was accessed. A Skill that injects un-audited instructions into the context window is an Annex III blast radius problem. The 90-day enterprise sprint is now: (a) inventory every Skill installed in every agent fleet via apm.yml, (b) gate all third-party Skills behind Snyk Skill Inspector + signing, (c) scope via allowed-tools + SPIFFE SVID per Skill execution, (d) log every Skill load to OTEL gen_ai spans with content hash so the audit trail is reconstructable. Skills without these four controls

MARKET SIGNAL -- Skills become enterprise SKUs

Anthropic's 10 Finance Agent templates (May 5) and Claude for Small Business (May 13) are Skills sold as products -- the first model-vendor SKUs where the IP is the behaviour, not the model. Notion's Developer Platform (May 13) lets you publish External Agents into 1M+ customer workspaces -- distribution is now a feature of the workspace. Fiserv agentOS (May 14) ships an agentic OS for banking with co-developed Skills from six financial institutions. Cognizant Secure AI Services (May 7) bundles Snyk Evo + SPIRE-style identity + NIST CAISI audit into a single SI deal -- the first "Skill-aware" SI service. Read together: the Skill is now the unit of agent IP, distribution and compliance. Model vendors who tried to sell raw model access in 2025 are now

DeepSeek-TUI (github.com/Hmbown/DeepSeek-TUI) by Hunter Bown is the unexpected story of the week -- and the cleanest illustration of why Skills + cheap frontier models break the moat of every $20/mo coding agent. Bown isn't a professional developer (B.A. and M.Ed. in music education, currently a JD student at SMU). He wrote a Rust-native terminal coding agent that wraps DeepSeek V4's 1M-token context, reads files, edits code, runs shells, searches the web, spawns parallel sub-agents, and exposes Skills via SKILL.md -- at roughly one-tenth the cost of Claude Code. Why it matters: DeepSeek-TUI is GitHub Weekly Trending #1 with 24K+ stars, gained 2,434 stars in a single day (May 6), and is built entirely on the same SKILL.md spec as Claude Code. Bown went viral after a post on X explicitly inviting Chinese developers to collaborate. The lesson: the moment a behaviour package (Skill) is portable across runtimes, the moat moves from model → distribution fi cost. DeepSeek-TUI is what "frontier model + portable Skills + open Rust harness" looks like when one person with a music degree ships it. Expect 20 more of these by end of Q3 2026.

Agent Marketplaces & the Skill Economy 2.0. If today was about the packaging unit, tomorrow is about the marketplace mechanics: monetisation (free vs paid Skills), discovery (semantic search vs leaderboards), trust scoring, vendor-neutral identity for Skill publishers, and where the next $1B company in this space actually lives. We'll cover the Vercel skills.sh roadmap, Anthropic's enterprise Skill SKU strategy, Microsoft APM as the "package-lock" layer, and what happens when Skills meet x402 payments (an agent buying a Skill from another agent at runtime).