Last reviewed:
SkillReg vs skills.sh: Public Skills Directory vs Private Team Registry
Facts about third-party tools were checked on October 16, 2026. Each one links to a numbered, dated source at the bottom of the page. Anything we could not check is marked "not verified".
If you ask where to find agent skills, the usual answer is skills.sh and the skills command-line tool. If you ask where a team should host the skills it writes itself, the answer depends on whether you need private hosting, versions and governance. This page explains what each tool does, where they overlap, and how to use them together.
What skills.sh and the skills CLI are
The skills package on npm describes itself as "the CLI for the open agent skills ecosystem". It is published from the vercel-labs/skills repository as a Vercel Labs product, under the MIT license [1]. Its README links to skills.sh as the "Skills Directory" and invites readers to "discover skills at skills.sh" [1].
What the CLI does, according to its README [1]:
- Installs skills from Git sources.
npx skills add owner/repoaccepts GitHub shorthand, full GitHub, GitLab and Azure Repos URLs, any Git URL, a local path, or a direct download of aSKILL.mdfile or archive. - Works with private repositories by reusing the Git authentication already configured on the machine: Git credential helper, GitHub CLI, then SSH.
- Targets many agents. The README lists OpenCode, Claude Code, Codex, Cursor "and 75 more", with a project path and a global path for each agent. Skills are symlinked from a canonical copy by default, or copied.
- Manages the local lifecycle with
use,list,find,remove,updateandinitcommands.skills updateupdates installed skills "to latest versions". - Follows a shared format. Skills are directories with a
SKILL.mdfile whose YAML frontmatter has anameand adescription, following the Agent Skills specification at agentskills.io. - Collects anonymous telemetry. GitHub repository and skill identifiers are sent only for repositories that GitHub confirms are public; other remote source types may include source and skill identifiers.
DISABLE_TELEMETRY=1orDO_NOT_TRACK=1turns it off.
The README also mentions "security-audit requests" for confirmed-public GitHub repositories [1]. What those audits check, how skills.sh ranks skills, and how skills.sh is funded are not verified (as of October 16, 2026): we could not read the skills.sh site itself for this review.
What SkillReg is
SkillReg is a private registry for your organization's SKILL.md skills. Instead of installing straight from a Git repository, your team publishes skills to the registry and installs them from there:
skillreg pushpublishes a version, with--versionor--bump;skillreg pull @org/name@^1.0.0resolves semver ranges, so installs can be pinned (Installing Skills).skillreg pull --agent allinstalls a skill for Claude, Codex and Cursor in one command; the desktop app does the same without a terminal.skillreg import-github owner/repoimports a GitHub path that contains aSKILL.mdinto your registry (CLI Reference).- Security scanning on every publish on all plans, including Free (advanced checks on Enterprise); basic audit logs from Team, full audit logs on Enterprise; SSO and approval workflows on Enterprise (pricing).
Side-by-side comparison
| Question | skills.sh and the skills CLI | SkillReg |
|---|---|---|
| Main purpose | Discover public skills and install them from Git sources [1] | Host, version and govern your organization’s skills |
| Where skills live | In the Git repositories you install from [1] | In the SkillReg registry, per organization |
| Private skills | Yes, from private Git repositories, using your existing Git authentication [1] | Yes, private to your organization |
| Versions | The README documents updates to the latest version; version pinning is not documented there (not verified) [1] | Published versions and semver ranges on install |
| Agents | OpenCode, Claude Code, Codex, Cursor and 75 more listed [1] | Claude, Codex and Cursor from the CLI and desktop app |
| Security review | Security-audit requests for confirmed-public GitHub repositories are mentioned; scope not verified [1] | Scanning on every publish, all plans (advanced on Enterprise) |
| Audit log, SSO, approvals | Not documented in the README (not verified) | Audit logs from Team; SSO and approval workflows on Enterprise |
| Telemetry | Anonymous, opt-out with DISABLE_TELEMETRY or DO_NOT_TRACK [1] | Download analytics per skill and version (unique users, client type) |
| Price | The CLI is open source (MIT) [1]; skills.sh pricing not verified | Free plan; Team $29/month flat per organization; Enterprise on quote |
When to use which
Use skills.sh and the skills CLI to explore what the community has published, to install a well-known public skill quickly, or when a single Git repository of team skills is enough and everyone already has access to it.
Use SkillReg when the skills encode internal knowledge and you need one place that answers: which version is installed, who published it, was it scanned, and who can install it. That matters once several teams or several agents share the same skills.
Using both
The two tools solve different steps, so many teams will use both:
- Discover a skill on skills.sh and try it locally with
npx skills useornpx skills add. - Bring the skills you keep into your registry with
skillreg import-github owner/repo, or adapt them andskillreg pushyour version. - Install the reviewed version across the team with
skillreg pullor the desktop app.
Related comparisons
- SkillReg vs Claude Code Plugin Marketplaces and GitHub Skill Repos
- SkillReg vs Skillkit
- SkillReg and MCP Registries
- SkillReg vs Public Skill Directories
Sources
- skills 1.7.2 on npm, README of the skills CLI (repository vercel-labs/skills). Version published 2026-10-09; checked 2026-10-16.