Official Vendor Skills: Who Publishes What (September 2026)
Official vendor skills are SKILL.md collections that a platform’s own team publishes to teach coding agents its current API, such as stripe/ai, cloudflare/skills, firebase/agent-skills and anthropics/skills. Many ship inside a plugin that also wires the vendor’s MCP server. Several well-known collections are renamed, deprecated or community-made, so install only from the canonical repository.
This page is for developers and tech leads who want the agent to stop writing last year’s SDK calls. The situation: the agent integrates Stripe with an API version two releases old, sets up Sentry with a deprecated init call, and a teammate installed flutter/skills from a blog post that predates the rename. A vendor skill replaces the model’s memory with the vendor’s instructions, but only if you install the right repository, only for the platforms you run, and keep it current.
What you’ll walk away with from official vendor skills
Section titled “What you’ll walk away with from official vendor skills”- A catalogue of the vendors that publish skills, with the canonical repository and install route for each, checked on 2026-09-26
- A list of popular collections that are not official, so you know what you are trusting
- A worked example: Stripe’s skills installed from its docs URL in Claude Code, Codex and Cursor, with a prompt and the expected result
- A stack-matched install and a monthly update chore that ends in evidence, not in re-reading every
SKILL.md - The traps that install the wrong thing, and how to recover
Which vendors publish official skills?
Section titled “Which vendors publish official skills?”The table lists the collections that the vendor itself publishes, grouped by what they cover. A plugin entry means the vendor ships a Claude Code plugin that bundles the skills, usually with its MCP server; the plugin lines were run on Claude Code 2.1.283 during the research, and every npx skills line was checked with --list. For a plugin outside claude-plugins-official, add the vendor’s marketplace first, for example claude plugin marketplace add cloudflare/skills before claude plugin install cloudflare@cloudflare.
| Area | Vendor (canonical repository) | What it teaches | Install | Stars, 2026-09-26 |
|---|---|---|---|---|
| Documents | Anthropic (anthropics/skills) | docx, pdf, pptx, xlsx, plus frontend-design, skill-creator, mcp-builder | claude plugin install document-skills@anthropic-agent-skills | 178,384 |
| Web | Vercel (vercel-labs/agent-skills) | React/Next.js performance, web design review, deploy | npx skills add vercel-labs/agent-skills --skill vercel-react-best-practices | 31,550 |
| Web | Next.js (vercel/next.js) | Cache Components, partial prefetching, dev loop | npx skills add vercel/next.js | whole project |
| Web | shadcn/ui (shadcn-ui/ui) | Driving the shadcn CLI, Radix to Base UI migration | npx skills add shadcn/ui | whole project |
| Browser | Vercel Labs (vercel-labs/agent-browser) | Browser automation CLI, skill matched to the CLI version | npx skills add vercel-labs/agent-browser | 43,200 |
| Browser | Microsoft (microsoft/playwright-cli) | Token-cheap browser testing through a CLI | npm install -g @playwright/cli@latest, then playwright-cli install --skills | 13,578 |
| Browser | Browserbase (browserbase/skills) | Cloud browsers, traces, traffic to OpenAPI | plugin browse@browserbase | 3,733 |
| Mobile | Expo (expo/skills) | Expo Router, native UI, EAS | plugin expo@claude-plugins-official | 2,612 |
| Mobile | Flutter team (flutter/agent-plugins) | Layout fixes, routing, architecture, Dart MCP | plugin dart-flutter@dart-flutter | 2,996 |
| Data | Supabase (supabase/agent-skills) | Supabase APIs, Postgres performance and RLS | plugin supabase@supabase-agent-skills | 2,655 |
| Data | Neon (neondatabase/agent-skills) | Serverless Postgres, branches, egress | plugin neon-postgres@neon | 91 |
| Data | Prisma (prisma/skills) | Prisma CLI, Client API, v7 upgrade | npx skills add prisma/skills | 60 |
| Data | Firebase (firebase/agent-skills) | Firestore, Auth, Hosting, security rules | plugin firebase@firebase | 454 |
| Data | Convex (get-convex/agent-skills) | convex-auth, convex-migrate, convex-optimize | plugin convex@claude-plugins-official | 62 |
| Auth | Clerk (clerk/skills) | Setup per framework, orgs, webhooks, testing | plugin core@clerk-skills | 79 |
| Auth | Better Auth (better-auth/skills) | Best practices, security, 2FA, organizations | plugin auth-skills@better-auth-agent-skills | 221 |
| Payments | Stripe (stripe/ai) | API selection, API version upgrades, Stripe docs | plugin stripe@claude-plugins-official | 1,833 |
| Cloud | Cloudflare (cloudflare/skills) | Workers, Wrangler, Durable Objects, Agents SDK | plugin cloudflare@cloudflare | 2,913 |
| Cloud | Google Cloud (google/skills) | GKE, Cloud Run, auth recipes, Genkit | npx skills add google/skills | 20,398 |
| Cloud | AWS (aws/agent-toolkit-for-aws) | Service selection, IaC, serverless over the AWS MCP Server | plugin aws-core@claude-plugins-official | 2,726 |
| Cloud | Microsoft (microsoft/azure-skills, microsoft/skills) | Azure deploy and diagnostics; SDK skills | plugin azure@claude-plugins-official | 1,500 / 3,052 |
| Infra | HashiCorp (hashicorp/agent-skills) | Terraform style, tests, modules; Packer | plugin terraform@hashicorp | 875 |
| AI APIs | Google (google-gemini/gemini-skills) | Gemini API, Live API, deprecated-model guardrails | plugin gemini-skills@gemini-skills | 4,212 |
| AI APIs | Hugging Face (huggingface/skills) | The hf CLI, datasets, training | plugin hf-cli@huggingface-skills | 11,102 |
| AI APIs | LangChain (langchain-ai/langchain-skills) | LangChain, LangGraph, Deep Agents, LangSmith evals | plugin langchain-skills@langchain-skills | 1,249 |
| Design | Figma (figma/mcp-server-guide) | figma-design-to-code, figma-use, remote MCP (Beta) | plugin figma@claude-plugins-official | 2,022 |
| Design | Google Labs (google-labs-code/stitch-skills) | Stitch designs, DESIGN.md | npx plugins add google-labs-code/stitch-skills --scope project --target claude-code | 8,371 |
| Observability | Sentry (getsentry/sentry-for-ai) | SDK setup, issue debugging, alerts | plugin sentry@claude-plugins-official | 267 |
| Product | PostHog (PostHog/ai-plugin) | Flags, experiments, HogQL, MCP | plugin posthog@posthog | 87 |
| Product | Notion (makenotion/skills) | The ntn CLI, Notion Apps | plugin notion@claude-plugins-official | 168 |
Resend (resend/resend-skills) | Resend API, React Email, inbox agents | plugin resend@resend-skills | 185 | |
| CMS | WordPress (WordPress/agent-skills) | Plugins, block themes, REST API, Playground | npx skills add WordPress/agent-skills --skill wp-plugin-development | 2,169 |
| PHP | Laravel (laravel/agent-skills) | Starter-kit upgrades, Laravel Cloud, Nightwatch | plugin laravel@laravel | 719 |
| Scraping | Apify (apify/agent-skills) | Actors, the ultimate scraper, output schemas | plugin apify-ultimate-scraper@apify-agent-skills | 2,399 |
| Video | Remotion (remotion-dev/skills) | Programmatic video in React | npx skills add remotion-dev/skills | 4,710 |
| Security | Trail of Bits (trailofbits/skills) | CodeQL, Semgrep, differential review, fuzzing | plugin static-analysis@trailofbits | 7,251 |
How popular are they? The stars column was read from GitHub on 2026-09-26 and measures attention on a repository, not use of a skill; for vercel/next.js and shadcn-ui/ui it counts the whole product, so it is omitted. Anthropic’s plugin directory publishes first-party install counts: on 2026-09-26 the figma plugin had 167,556 installs, the directory’s supabase plugin (from supabase-community/supabase-plugin, not the supabase/agent-skills marketplace in the table) 118,617, stripe 61,066, sentry 38,810 and huggingface-skills 34,575. skills.sh install counts could not be read directly for this page and are left out; re-read them on skills.sh before you quote one.
Trail of Bits is a security firm publishing its own methods, not a platform vendor, and it is listed because its collection is maintained by the authors of the practices it teaches. For how each stack uses these skills in depth, see the best frontend skills, the best backend and platform skills and document and writing skills.
Which popular skill collections are not official?
Section titled “Which popular skill collections are not official?”These are useful, but they are not the vendor’s own instructions. Decide on purpose whether to trust them.
| Collection | What it actually is | Official alternative |
|---|---|---|
googleworkspace/cli | In the googleworkspace org, but its README says: “This is not an officially supported Google product.” | google/skills, google-gemini/gemini-skills, firebase/agent-skills, google-labs-code/stitch-skills |
callstackincubator/agent-skills | Community React Native skills from Callstack, a consultancy, not Meta | expo/skills for Expo apps |
getsentry/skills | Sentry’s internal engineering skills (code-review, find-bugs), which encode Sentry’s own conventions | getsentry/sentry-for-ai for Sentry users |
kepano/obsidian-skills | The personal repository of Obsidian’s CEO, not the obsidianmd org | none; label it “from Obsidian’s CEO” |
coreyhaines31/marketingskills, mvanhorn/last30days-skill | Community practice skills; the marketing repo carries paid-partner placements | see business skills |
How do you install an official skill in Claude Code, Codex and Cursor?
Section titled “How do you install an official skill in Claude Code, Codex and Cursor?”There are two routes. The skills CLI installs SKILL.md folders into .agents/skills and symlinks them into agents that need their own directory, such as .claude/skills (pass --copy for real copies); it works in every agent. A plugin bundles the skills with the vendor’s MCP server and updates as one unit. Stripe shows both, plus a third source the skills CLI supports: a vendor docs URL. Stripe syncs its skills from docs.stripe.com/.well-known/skills, so the docs site is the source.
# Plugin: skills + Stripe MCP server, from Anthropic's official directoryclaude plugin install stripe@claude-plugins-officialclaude plugin details stripe@claude-plugins-official # inventory and projected token cost
# Or skills only, straight from Stripe's docs sitenpx skills add https://docs.stripe.com -a claude-codeIf …@claude-plugins-official reports that the plugin is not found, run claude plugin marketplace add anthropics/claude-plugins-official first; a fresh headless Claude Code 2.1.283 had no marketplaces configured.
# Skills only, from Stripe's docs site (writes to .agents/skills)npx skills add https://docs.stripe.com -a codex
# Plugin from OpenAI's curated marketplacecodex plugin add stripe@openai-curatedThe @openai-curated line is unverified end to end: the name is in openai/plugins’ manifest, but a signed-out, headless codex-cli 0.157.1 could not resolve that marketplace. In a signed-in Codex, browse it with /plugins.
# Skills only, from Stripe's docs site (writes to .agents/skills)npx skills add https://docs.stripe.com -a cursorStripe’s README also documents /add-plugin stripe in Cursor’s agent chat, which adds the MCP server as well. That line was not tested.
The plugin also connects Stripe’s MCP server, which can create real charges and refunds: authenticate it only against test mode or a restricted key.
The docs-URL install was not run for this page, because the writing environment could not reach docs.stripe.com; it is the route Stripe documents. What you should see: the CLI discovers skills from the well-known endpoint and offers them, including stripe-best-practices (API selection, Connect, billing, tax, security) and upgrade-stripe (API version, webhook and SDK upgrades). Run npx skills add https://docs.stripe.com --list first to see the list without installing. With the plugin, Claude Code’s claude plugin details projected 12 skills and about 2,240 always-on tokens for stripe@claude-plugins-official, as measured for the backend skills page.
The result to expect: a recommendation that cites the skill’s own “Checkout Sessions vs PaymentIntents” guidance, a table of call sites with API versions, and an upgrade plan. If the answer quotes no rule from the skill, the skill did not load; see the failure modes below.
Install only your vendors, then update monthly
Section titled “Install only your vendors, then update monthly”Vendor skills stay useful only when you treat them as dependencies: install the skills for the platforms in your lockfiles, check them in, and refresh them on a schedule with a gate. The full pinning and drift-check mechanics live in installing and managing skills; this is the vendor-specific loop.
-
Derive the vendor list from the repository, not from a leaderboard. Ask the agent to read your manifests and map each platform to its canonical repository in the catalogue above (prompt below). A vendor you do not deploy to is context you pay for in every session.
-
List before you install. For each repository, check the frontmatter names; the CLI matches
--skillagainst thenamefield, not the folder name:Terminal window npx skills add firebase/agent-skills --listnpx skills add firebase/agent-skills --skill firebase-basics firebase-security-rules-auditor -a claude-code -a codex -a cursor -
Pick one route per vendor. Install the plugin when you want the vendor’s MCP server as well; otherwise use the skills CLI. Installing both makes each skill appear twice.
-
Vet and commit. Read each new
SKILL.mdand any bundled scripts in the pull request, or scan them as described in skill supply-chain security. Commitskills-lock.json,.agents/skills/and.claude/skills/together. -
Run the monthly update chore on a branch.
Terminal window npx skills update -y # skills CLI installs, incl. docs-URL sourcesclaude plugin marketplace update # refresh marketplace snapshotsclaude plugin update stripe@claude-plugins-officialcodex plugin marketplace upgrade # Codex: refresh Git marketplacesgit diff --stat -- skills-lock.json .agents/skills .claude/skillsA docs-URL install such as Stripe’s does not update on its own;
npx skills update -yis the refresh Stripe recommends. Plugin updates need a Claude Code restart to apply. -
Gate the update, then merge. Run the tests, type check and lint, plus one fixed golden task per vendor (below). The tech lead signs off on the diff the same way as on a dependency bump.
How do you know a vendor skill improved the output?
Section titled “How do you know a vendor skill improved the output?”Do not judge a vendor skill by re-reading what it wrote. Check it with evidence a reviewer can read in a minute:
- A golden task per vendor. Keep one small fixed task per skill that matters, for example “add a Stripe webhook handler for
invoice.paidwith signature verification and a test”. Run it headless after each monthly update, and let the existing test, type and lint gates decide. For plugins,claude plugin evalruns a plugin’s own eval cases against a no-plugin baseline. Designing these checks is covered in evals for coding agents. - Attribution in the answer. Ask the agent to name the skill rule it applied, as the Stripe prompt does. An answer that cites no rule tells you the skill did not fire.
- Version checks the machine can run. A vendor skill’s job is to move the code to the vendor’s current API. Grep for the deprecated call or old API version string before and after, and fail the build if it reappears.
- Context cost. Compare
/contextin Claude Code, orclaude plugin details <plugin>, before and after an install. Dr. Skill shows which skills ever fired across sessions, which tells you what to remove.
Which vendor skill names are stale in September 2026?
Section titled “Which vendor skill names are stale in September 2026?”When official vendor skills mislead the agent
Section titled “When official vendor skills mislead the agent”The skill lags the release you run. A vendor ships a new SDK major before updating its skill, and the agent follows the older pattern. Recovery: check the repository’s last commit date against the SDK’s release notes, run the monthly update early, and state the winning version in your project’s own rules until the vendor catches up.
The skill is ahead of your code. After an update, the skill recommends an API version your codebase has not adopted, and the agent mixes both. Recovery: pin the skill to a tag with owner/repo#ref (see installing and managing skills) until you migrate, then move the pin in the same pull request as the migration.
The context fills before the work starts. Whole catalogues such as microsoft/skills or every cloud plugin at once crowd out the task. Recovery: remove vendors you do not deploy to (npx skills remove <name>, claude plugin disable <plugin>) and install cloud plugins per repository, not globally.
A skill changes behaviour without a new commit. Convex’s convex-add step fetches a remote catalogue at runtime, so its output can change without a skill update. Recovery: treat skills with network calls as dependencies with a live upstream, and note them in the review from the monthly chore.
The command from a README does not work. READMEs lag their own repositories: Convex’s still names convex-setup-auth, which no longer exists. Recovery: run npx skills add <repo> --list and trust the frontmatter names it prints.