Agent Skills Wants to Be npm for AI Coding Agents. The 13.4% Problem Is Real.

Tech Leads Club has published agent-skills, a curated registry of skills for AI coding agents that the maintainers describe as “the secure, validated skill registry for professional AI coding agents.” The pitch is narrow and pointed: in an ecosystem where, by the project’s own framing, “over 13% of marketplace skills contain critical vulnerabilities,” this registry claims to be hardened. Every skill is scanned with Snyk Agent Scan (formerly mcp-scan) before publishing, the repository ships no binaries, and the CLI leans on lockfiles, content hashing, path isolation, and symlink guards to keep an installed skill from wandering outside its sandbox.

That 13.4% figure is the whole argument. It is not a number the maintainers generated; it is a number they are citing about the wider marketplace to justify why a curated alternative needs to exist at all. Whether or not the exact percentage survives scrutiny, the directional claim is the interesting one. Skills are just Markdown and templates, which means they look harmless. They are not harmless. A SKILL.md file is a set of instructions an agent will follow with whatever tool access it has, and an agent with shell access, filesystem access, and network access executing attacker-authored prose is a supply-chain problem wearing a documentation costume.

What the registry actually ships

The structure is deliberately boring. Skills live under packages/skills-catalog/skills/, each in a category folder with a SKILL.md, a templates/ directory, and a references/ directory for on-demand docs. The CLI fetches a catalog of roughly 45KB from a CDN, lets you browse and select, then downloads and caches selected skills to ~/.cache/agent-skills/ for offline use. Installation supports copy or symlink, global or local scope, and the audit log records operations so you can see what touched your machine.

Supported agents are split into three tiers. Tier 1 is Claude Code, Cline, Cursor, GitHub Copilot, Windsurf, OpenAI Codex, and Roo Code. Tier 2 includes Aider, Antigravity, Gemini CLI, Kilo Code, Kiro, and TRAE. Tier 3 is the enterprise list: Amazon Q, Augment, Droid from Factory.ai, OpenCode, Sourcegraph Cody, and Tabnine. That is a broad surface, and it is the clearest signal of what this project is actually competing for. It is not trying to be the best skill for one agent. It is trying to be the neutral layer that sits under all of them.

There is also an MCP server, @tech-leads-club/agent-skills-mcp, which exposes the catalog to agents through progressive disclosure. The tools are list_skills, search_skills, read_skill, and fetch_skill_files. The design note is telling: list_skills should only be called when the user explicitly asks to browse. That is a small piece of prompt hygiene that most MCP servers get wrong, and it suggests the maintainers have actually watched an agent burn context on a catalog dump.

The take: curation is the product, and curation does not scale

Here is the tension the project has not resolved. The value proposition is human-curated prompts plus static analysis in CI/CD. Both of those are expensive. A registry that grows by hand-review cannot grow as fast as an open marketplace, and the moment it stops hand-reviewing, the 13.4% problem walks in through the front door. The featured skills listed today, tlc-spec-driven, aws-advisor, playwright-skill, figma, and security-best-practices, are a reasonable seed set. They are also a set small enough that one team can read all of them.

The licensing structure quietly acknowledges this. The CLI and engine are MIT. Skill files authored by the maintainers are CC-BY-4.0. Third-party skills retain their original licenses, and the repo asks anyone who wants content removed to open an issue. That is the posture of a project that knows it is aggregating other people’s work and wants to stay on the right side of it. Attribution is mandatory regardless of use, which is a stricter term than most developer tooling carries.

The more interesting question is whether “secure registry” is even the right frame. Snyk Agent Scan catches known-bad patterns. It does not catch a skill that is merely manipulative, or one that quietly biases an agent toward a vendor, or one that exfiltrates context through a legitimate-looking tool call. Static analysis on prompts is a young discipline, and the threat model document is doing more work here than the scanner is. The defense-in-depth claims about the CLI, sanitization, path isolation, symlink guards, atomic lockfiles, are about the installer, not about the skills themselves. Those are two different trust boundaries and the README blends them.

What this means for builders

If you are shipping an agent product, the lesson is that skill distribution is becoming a real surface with real stakes, and the first mover to own trust wins a lot of default installs. npm did not win because it had the best packages. It won because npm install was one command and everyone else was worse. Agent Skills is making the same bet with a security story bolted on top.

The thing to watch is the catalog size six months from now. If it is still small and hand-reviewed, the trust claim holds and adoption will be slow but sticky. If it balloons, the 13.4% number stops being a competitor’s problem and becomes this project’s. The maintainers have not said which one they are optimizing for, and that is the open question the README does not answer.