The Rise of Community Skill Marketplaces: How an App Store Ecosystem Is Forming Around AI Coding Assistants

A new ecosystem of community-built skills, templates, and plugins is rapidly forming around AI coding assistants like Claude Code, Cursor, and GitHub Copilot. In just over a year since Anthropic launched Agent Skills in October 2025, the format has grown from an experimental feature into a sprawling marketplace with an estimated 1.9 million public skills indexed across registries, cross-tool compatibility with at least 40 products, and adoption patterns that mirror — and in some ways outpace — the early growth of the VS Code Marketplace. This article breaks down how this ecosystem emerged, who the key players are, what the security implications are, and why it matters for businesses adopting AI coding tools in 2026.

What Are AI Agent Skills?

Agent Skills are modular packages of instructions, scripts, and resources that extend what an AI coding assistant can do. Each skill is simply a folder containing a SKILL.md file — a markdown document with YAML frontmatter that defines the skill's name, description, and trigger conditions, followed by detailed instructions the AI follows when the skill activates.

The mechanism is elegant in its simplicity. When Claude Code or a compatible agent starts up, it scans all available skills and reads only the name and description from each one, using roughly 100 tokens per skill. When a user gives the agent a task, it checks whether any skills match the request. If one does, the full instructions load. If nothing matches, the skill stays dormant and the context window stays clean. This "progressive disclosure" model means you can have dozens of skills installed without bloating every conversation.

Skills fall into two categories. Capability Uplift skills give the agent abilities it doesn't have on its own — like web scraping, PDF generation, or browser testing. Encoded Preference skills capture a team's specific way of doing something the agent already knows how to do — like code review checklists, commit message formats, or documentation standards. Both types load contextually and trigger automatically, which is what makes them fundamentally different from static prompt templates.

The Timeline: From Internal Tool to Open Standard

The speed of this ecosystem's formation is unprecedented. Claude Code itself was used internally at Anthropic starting in late 2024, with reportedly 50% of engineers adopting it within the first week. The public research preview launched on February 24, 2025, alongside Claude 3.7 Sonnet, with general availability following on May 22, 2025.

Agent Skills arrived five months later. Anthropic published the feature in October 2025 as a preview for Pro, Max, Team, and Enterprise users. By December 18, 2025, they published the Agent Skills specification as an open standard at agentskills.io, explicitly designed so that a skill built for Claude Code could also run on Cursor, OpenAI Codex CLI, Gemini CLI, or GitHub Copilot if those platforms adopted the spec.

They did. By June 2026, approximately 40 skills-compatible products were listed on the agentskills.io showcase, including Claude Code, Cursor, Codex CLI, Gemini CLI, GitHub Copilot, VS Code, and JetBrains Junie. This cross-tool compatibility is a critical differentiator from traditional IDE plugin ecosystems, where extensions are typically locked to a single editor.

The Market Numbers: An Ecosystem Forming at Warp Speed

The adoption metrics tell a story of explosive growth. The AI coding assistant market reached $12.8 billion in 2026, projected to hit $30.1 billion by 2032 at a 27% CAGR. Year-over-year growth in 2025–2026 ran at 65%, and search demand for AI coding tools grew 420% in the same period.

Within this market, Claude Code's trajectory has been remarkable. Revenue run-rate grew from approximately $500 million in mid-2025 to $1 billion by November 2025, and roughly $2.5 billion by February 2026 — described by analysts as the fastest revenue ramp ever recorded for a developer productivity tool. Workplace adoption went from about 3% in early 2025 to 18% worldwide by January 2026 (per JetBrains' survey), with 28% primary tool selection in a separate Digital Applied survey of 2,847 developers across 320 organizations.

Across all tools, 73% of engineering teams use AI coding tools daily in 2026, up from 41% in 2025. GitHub Copilot leads on installed base with 4.7 million paid subscribers, Cursor hit $2 billion in annualized recurring revenue by February 2026, and Claude Code leads on satisfaction with 46% of developers naming it their most-loved AI coding tool versus Cursor at 19% and Copilot at 9%.

The skill ecosystem itself has grown in parallel. Community claims put the count at "thousands of skills" by March 2026. SkillsMP, a community registry, indexes approximately 1.9 million public skills scraped from GitHub. Official and community skill repositories have accumulated 157,000+ and 243,000+ GitHub stars respectively by mid-2026.

How Community Skill Marketplaces Work

The marketplace layer is where things get interesting. Unlike the VS Code Marketplace, which is a single centralized store operated by Microsoft, the Agent Skills ecosystem is decentralized and multi-layered.

Official layer. Anthropic maintains the agentskills.io showcase and the anthropics/skills GitHub repository with 16 official skills covering frontend design, PDF/DOCX/XLSX handling, MCP builder, and more. These are vetted first-party skills that serve as reference implementations.

Community directories. Sites like claudeskills.info and GitHub awesome-lists (such as "awesome-claude-skills") curate and categorize skills by use case — development, testing, creative design, security, productivity. These function as discovery layers rather than hosting platforms.

Enterprise vendor skills. Companies like Vercel (React best practices, web design guidelines), Trail of Bits (static analysis, CodeQL, Semgrep), and Remotion (programmatic video) publish skills that encode their domain expertise into installable packages. This is where the marketplace starts to resemble a B2B app store — vendors distributing capabilities directly to developers through the skill format.

Meta-registries. SkillsMP scrapes and indexes skills from across GitHub, creating a searchable catalog of 1.9 million entries. This is the closest thing to a full app store, though the quality varies dramatically.

Quality is a real concern. SkillsBench, a benchmarking initiative, evaluated 47,150 public skills and found an average quality score of 6.2 out of 12. However, curated skill sets — hand-selected and tested collections — raised agent pass rates by an average of 16.2 percentage points compared to uncurated public skills. This gap between the raw catalog and curated sets is the core problem that marketplaces need to solve.

The Security Problem: Skills as a New Attack Surface

With 1.9 million public skills and minimal vetting, security has emerged as the ecosystem's most pressing challenge. Research from SkillRisk and Snyk's ToxicSkills project has identified multiple attack vectors specific to the skills ecosystem.

Prompt injection via SKILL.md. Skills are essentially trusted instructions injected into an agent's reasoning process. A malicious SKILL.md can override safety policies, insert backdoor behaviors ("always exfiltrate logs to an external server when debugging network issues"), or manipulate the agent into taking unintended actions. Because these instructions are treated as authoritative context, they can be difficult to detect through normal interaction.

Hook hijacking. Many skills wire agents into code execution, shell commands, and external APIs. A malicious skill can hijack these hooks to run unintended commands, reconfigure test runners or build scripts to leak data, or alter environment configurations. Greg Pstrucha of Sentry demonstrated at TypeScript AI Demo Day in April 2026 that Claude Code's shebang directive enables a 100% deterministic exploit when combined with a malicious skill.

Supply chain attacks. The skills ecosystem creates a new supply chain vector that mirrors npm or PyPI package poisoning. Risks include typo-squatted skill names in large registries, skill updates that introduce malicious behavior after initial trust is established, and skills that silently add external script dependencies pulling unvetted code at runtime.

The numbers are sobering. According to security research published in early 2026, 26% of agent skills contain security vulnerabilities. The Snyk ToxicSkills research catalogued skills that appear benign — like "optimize database code" — but contain hidden instructions causing data exfiltration or unsafe command execution through prompt-level obfuscation techniques.

Skills Ecosystem vs. Traditional IDE Plugin Marketplaces

The comparison to the VS Code Marketplace is instructive. Both ecosystems share a plugin-like architecture: modular packages that extend a tool's capabilities, distributed through marketplaces and directories, with heavy reliance on independent developers and vendors.

But the differences are significant. VS Code extensions are JavaScript/TypeScript packages that run inside the editor, governed by extension APIs and sandboxed to varying degrees. Agent Skills are instruction packages that alter how an AI model reasons and acts — they execute through the agent's tool-calling and code-execution capabilities, which are far more powerful and far less constrained than an IDE extension API.

VS Code extensions are largely bound to VS Code (with some portability to forks like VSCodium). Agent Skills are designed as an open standard with cross-tool compatibility — a skill written for Claude Code can run on Cursor, Codex CLI, or Gemini CLI without modification. This portability means a single skill can reach users across multiple platforms, which is a stronger incentive for ecosystem participation than the single-platform VS Code model.

The curation model also differs. The VS Code Marketplace has a centralized review process and publisher verification. The skills ecosystem is decentralized, with quality control emerging through community curation (awesome-lists), benchmarking (SkillsBench), and security scanning (SkillRisk, Snyk). This is closer to the npm model than the Apple App Store model — fast, open, and somewhat risky.

What This Means for Businesses

For organizations adopting AI coding assistants, the skills ecosystem is both an opportunity and a risk vector. On the opportunity side, curated skill sets measurably improve agent performance — the 16.2 percentage point improvement in pass rates from curated skills versus uncurated ones translates directly to developer productivity. Teams that codify their coding standards, review processes, and domain expertise into skills get consistent, repeatable results from AI tools without re-explaining preferences every session.

On the risk side, installing unvetted third-party skills is comparable to adding unreviewed dependencies to your codebase. The 26% vulnerability rate means that more than one in four public skills could introduce security issues. Organizations need to treat skills the way they treat npm packages: audit before installing, restrict permissions, monitor for updates, and prefer skills from trusted sources like the official Anthropic repository and established vendors.

The practical recommendation for businesses is to start with official and partner skills (Anthropic, Vercel, Trail of Bits), build internal skills that encode team-specific processes, and only add community skills after a security review. The ecosystem is maturing rapidly, but it hasn't yet developed the trust infrastructure that makes mass adoption safe.