Agent Skill Library

What is it

An Agent Skill Library is a curated, versioned collection of reusable "skill" modules that an AI coding agent can load on demand — think npm for AI agents, but instead of code dependencies, you're shipping capabilities. A skill file typically bundles a natural-language instruction set, tool/function schemas, example invocations, and guardrails. When an agent like Claude Code, Cursor, or an OpenMontage-style orchestrator hits a task ("review this PR," "write an Alembic migration," "scaffold a Stripe webhook"), it pulls the matching skill instead of improvising from a blank context window.

The business significance is bigger than the technical definition. Skills are becoming utility infrastructure for AI coding — the same way Docker images standardized deployment and npm standardized JS packages. Whoever owns the registry, the quality bar, and the distribution channel for skills owns a toll booth on every agent workflow. That's a marketplace-plus-infrastructure play, not a content play. The "10 hot Skills in 2028 programming" framing from the source data tells you where this is heading: skill packs will be branded, ranked, and sold like courses or plugins. Right now the category is nascent — 3 mentions, 2 sources — which means the land grab is open and the incumbent is nobody.

Why now

Three forces collide in late 2026 to make this the moment. First, agent runtimes matured: Claude Code, Cursor, Windsurf, and open-source orchestrators like OpenMontage all support some form of skill/command loading, but the formats are incompatible and undocumented. OpenMontage alone ships 700+ skill files — that's a de facto standard emerging from the bottom up, not from a vendor. Second, context economics changed. Teams learned that stuffing a 200K-token system prompt is worse than loading a 2K-token targeted skill, both in cost and reliability. Skill selection is now a measurable quality lever, which creates willingness to pay for vetted packs. Third, the labor market signal is loud: the tag data shows 面试 (interview) and 算法 (algorithm) attached to this term — developers are already treating skill familiarity as a hiring criterion, which is exactly the pattern that preceded the Kubernetes certification boom.

Why not last year? Because in 2025 agents were demos. Why not next year? Because by 2027 the major IDE vendors will ship first-party registries and the window for an independent marketplace closes. The 100% growth rate on a tiny base is the classic early-signal shape: not proof, but a cheap option on a large outcome.

Market Evidence

The hard numbers are thin and you should treat them as a smoke signal, not a market study: 2 independent sources (juejin and GitHub), 3 total mentions, 100% growth rate, stage flagged as nascent, first seen 2026-11-09. Trend score 61/100 is the most interesting figure — it's above the midpoint despite almost no volume, which means the scoring model is picking up structural importance rather than raw chatter. That's consistent with infrastructure categories, which always look quiet right before they look obvious.

The GitHub signal matters more than the juejin signal. A repo with 700+ skill files is a supply-side artifact — someone did unpaid labor to build a skill corpus, which is the strongest possible evidence that practitioners feel the pain. The juejin signal ("10 hot Skills in 2028 programming") is demand-side framing, a listicle predicting a labor-market shift. Two sources of different types agreeing is more meaningful than ten blog posts of the same type.

Is it hype? No — hype categories have high mention counts and low artifact counts. This is the inverse: low mentions, high artifacts. The risk isn't that the demand is fake; it's that the demand is currently unmonetized because everyone assumes skills should be free and open source, like dotfiles. Your job is to find the slice where that assumption breaks — enterprise governance, security review, and team-standardized skill packs.

Who's Behind It

No single whale owns this yet, which is the whole opportunity. The de facto leaders are: OpenMontage (the 700+ skill file corpus driving the GitHub signal), Anthropic with Claude Code's skill/command system, and the Cursor/Windsurf cohort that ships agent modes with implicit skill behavior. Anthropic is the most dangerous entrant because it controls both the model and a popular agent runtime — if it ships a first-party skill registry with curation, it owns the default distribution channel overnight.

On the community side, the juejin ecosystem (Chinese developer content platform) is producing the listicle-and-tutorial layer, which is where early standardization discourse always starts. Individual maintainers publishing "awesome-agent-skills" style repos are the real grassroots force.

Competitive dynamics to watch: format fragmentation. If OpenMontage's skill format and Claude Code's format diverge, a neutral cross-runtime registry becomes valuable — that's the "Docker before Docker" position. If they converge, the registry becomes a commodity and the value moves to curation and security. Bet on fragmentation persisting through 2027; vendor incentives favor lock-in.

TAM & Market Size

Be honest about the scores: Opportunity 0/100, Market 0/100, Demand 0/100. These zeros mean the scoring model has insufficient data, not that the market is zero. Treat them as "unmeasured," and do your own sizing.

Bottom-up: GitHub has roughly 100M+ developer accounts; the addressable slice is professional developers using AI coding agents daily — conservatively 8-12M worldwide by end of 2026, growing 60%+ annually. Of those, the ones who will pay for skills are the ones on teams: maybe 15-20%, so 1.2-2.4M seats. At $8-15/seat/month for a team skill library with governance, that's a $115M-$430M annual SaaS ceiling — real but not venture-scale on its own. The bigger prize is the marketplace take rate on third-party skill sales and the enterprise compliance layer (skill auditing, SBOM-for-skills), which can push the ceiling past $1B.

Price tolerance: individual devs balk above $10/month (they compare to Copilot at $10). Teams will pay $20-40/seat/month if you solve security review and standardization — that's a rounding error against a $150K engineer's salary. Enterprises will pay $50K-200K/year for a governed internal registry. Sell to teams first; the individual market is a funnel, not a business.

Competitive Landscape

Competition score 0/100 reflects that no one has claimed this category, not that it's uncontested. Real players today: (1) Anthropic's Claude Code skills/commands — free, first-party, shallow curation; (2) Cursor rules and community "awesome-cursorrules" repos — free, chaotic, no versioning; (3) OpenMontage's corpus — open source, no commercial layer; (4) prompt marketplaces like PromptBase — adjacent but wrong abstraction, they sell text not executable capability; (5) LangChain Hub — closest analog, but tied to LangChain and mostly prompts, not agent skills.

Gaps you can exploit: cross-runtime compatibility (one skill, many agents), semantic versioning and dependency resolution, security scanning (skills execute tools — a malicious skill is a supply-chain attack), and quality benchmarks ("this skill passes 94% of SWE-bench-style tasks"). Nobody does any of these well.

Big Tech entry timeline: Anthropic or GitHub could ship a registry in 6-9 months if they prioritize it. Your defensible window is the fragmentation period — build the neutral, cross-vendor layer and become the Switzerland of skills. If you wait for the standard to settle, you're building a feature, not a company. Move in the next two quarters or don't move.

Business Model

Recommended: freemium SaaS with a marketplace take rate, team-tier first. Free tier: 20 public skills, personal use, community registry access. Team tier at $12/seat/month (annual) or $15 monthly: private registry, versioning, access control, usage analytics, security scan on publish. Enterprise at $30K+/year: SSO, audit logs, air-gapped sync, custom skill approval workflows. Marketplace: 20% take rate on paid skill packs, with creators keeping 80% — this is the long-term moat because it turns supply into a growth loop.

Why this fits: skills are consumed continuously, not bought once — subscription aligns with usage. The marketplace solves your cold-start problem on content without you authoring 700 skills yourself.

12-month forecast (assuming launch in month 2): conservative — 150 paying seats, ~$22K ARR; base — 600 seats plus 3 enterprise deals, ~$130K ARR; optimistic — 2,000 seats, 8 enterprise, marketplace traction, ~$450K ARR. These are indie-realistic, not VC-deck numbers.

CAC: developer tools via content/SEO run $40-120 per paying seat; enterprise deals cost $5K-15K in sales time. Payback: 3-6 months on team seats at $12/month with $60 CAC — acceptable. Don't spend on paid ads; devs ignore them. Spend on skill quality benchmarks and open-source the format.

MVP Blueprint

Ship in 5 days. Core features only:

Day 1-2: Registry backend — Postgres + a simple REST API (Node/Fastify or Python/FastAPI). Schema: skill (name, version, runtime targets, manifest, tarball URL), publisher, install count. Use semantic versioning from day one; it's cheap now and impossible to retrofit.

Day 3: CLI — skills install <name>, skills publish, skills search. Write it in Go or Node for single-binary distribution. This is the product; the web UI is secondary.

Day 4: Web catalog — search, skill detail page with install command, README render, download counts. Next.js or Astro, deploy on Vercel/Cloudflare.

Day 5: Auth + Stripe — GitHub OAuth for identity, Stripe Checkout for the team tier. Gate private skills behind org membership.

Cut: security scanning (do manual review of first 50 skills), analytics dashboard, marketplace payments, multi-runtime adapters beyond Claude Code + one other. Ship the CLI and catalog; let users tell you what's missing.

Tech stack: FastAPI or Fastify, Postgres (Neon), S3/R2 for tarballs, GitHub OAuth, Stripe, Cloudflare. Total infra cost under $30/month. This is a 5-day build for one competent dev, not 5 weeks — resist scope creep.

Commercial Opportunities

1. Team Skill Registry (SaaS). Target: 10-100 person engineering orgs already using Cursor/Claude Code. They have the "everyone's rules file is different and undocumented" problem. Sell a private registry with approval workflows at $12/seat/month. Expected $3K-15K MRR within 6 months. Beats alternatives because internal wikis don't version and GitHub repos don't enforce.

2. Skill Security Audit (service → product). Target: enterprises adopting agents who realize a skill can exfiltrate code. Offer a $2K-5K one-time audit of a company's skill corpus, then convert to a $500/month monitoring subscription. Expected $5K-20K/month once you have 5-10 enterprise logos. Beats generic AppSec because nobody else understands skill manifests.

3. Certified Skill Packs (content product). Target: individual devs and small teams. Sell curated, benchmarked packs — "Python backend interview prep," "Stripe integration," "Kubernetes debugging" — at $29-79 one-time or bundled at $15/month. Expected $1K-8K/month. Beats free GitHub lists because you publish pass rates and maintain them.

Direction 1 is the wedge; 2 and 3 are margin expanders. Do 1 first — it produces the team relationships that make 2 sellable.

Product Ideas

🥇 Skillforge — "npm for AI agent skills, with security and versioning built in." Target: engineering teams using multiple agent runtimes. Why now: format fragmentation means a neutral registry has unique value, and no incumbent offers cross-runtime install. Ship the CLI + catalog MVP above. Monetize at $12/seat/month.

🥈 SkillLint — "CI for your agent skills." A GitHub Action that validates skill manifests, checks for prompt-injection patterns, flags tool permissions that are too broad, and scores task reliability. Target: platform/DevOps teams at 50+ person companies. Why now: skills execute tools, so they're a supply-chain surface, and security teams haven't caught up. Price at $99-499/month per repo. This is the highest-margin idea because it's pure software with no content cost — but it depends on Skillforge or a standard existing first, so sequence it second.

🥉 SkillRank — "Benchmarks and leaderboards for agent skills." Publish reproducible pass rates for popular skills across runtimes; sell sponsored placement and a $49/month API for teams that want to gate installs on quality scores. Target: skill publishers and procurement-minded teams. Why now: the "10 hot Skills" listicle format proves demand for ranking, but nobody ranks with data. This is a media-plus-data play — slower to monetize, but it builds the authority that feeds Skillforge's marketplace.

Priority is deliberate: Skillforge is the revenue engine, SkillLint is the moat, SkillRank is the brand. Don't build all three; build Skillforge and let SkillRank grow as a content side-effect.

SEO Opportunity

SEO difficulty reads 0/100 — effectively greenfield, which is rare and temporary. Search interest is nascent but the trend line is up; expect "agent skills" queries to compound as the runtime vendors ship features.

Long-tail targets to claim now: "claude code skills library," "cursor rules vs skills," "how to publish an agent skill," "agent skill security risks," "openmontage skill format," "awesome agent skills github."

Competition is nearly zero on the specific long-tails — you can rank with 10-15 well-structured posts. Strategy: publish one canonical "what is an agent skill" explainer, then a comparison page per runtime, then a security deep-dive. Each page should include an installable example. Rank fast, own the vocabulary before the vendors do.

Risk Assessment

Risk 1 — Vendor absorption (highest). Anthropic, GitHub, or Cursor ships a first-party registry and makes third-party ones redundant. Mitigation: be cross-runtime from day one; a vendor registry will only serve its own runtime, and multi-agent shops are the majority by 2027. If Anthropic announces a registry with an open API, pivot to being the security/quality layer on top of it.

Risk 2 — Free-forever culture. Developers assume skills are open source like dotfiles, and the "everything is free on GitHub" norm kills the paid tier. Mitigation: sell to teams and enterprises where governance beats price; never build a business on individual subscriptions.

Risk 3 — Execution: format churn. Skill formats change monthly and your registry rots. Mitigation: normalize on a minimal manifest spec you control, with adapters per runtime; treat runtime-specific fields as plugins.

Cheap validation before building: publish a "state of agent skills" survey on X and r/ClaudeAI, ask 50 developers how they manage skills today and whether their team would pay for a private registry. If fewer than 10 say yes to paying, the team thesis is weak — test the security angle instead. Walk away if, after 90 days of content and a waitlist, you can't get 100 signups; the demand is real but not yet purchasable.

Action Plan

Today: Write the one-page spec for the skill manifest you'll standardize on (name, version, runtime targets, tools required, permissions). Publish it as a public gist and ask for feedback in the Claude Code and Cursor communities. This costs two hours and tells you if anyone cares.

Week 1: Ship the CLI prototype — install, search, publish against a local registry. Post a demo video. Collect a waitlist. Target: 50 waitlist signups from 2-3 community posts. Simultaneously run the 50-developer survey from the risk section.

Month 1: Launch the hosted registry with 30 hand-curated skills (port the best of OpenMontage's corpus with attribution) and Stripe billing. Goal: first 10 paying seats, 300 free users. If you can't hit 10 paying seats, the pricing or positioning is wrong — fix before adding features.

Month 3: 100+ paying seats, 2 enterprise pilots, security scanning shipped. Decide the fork: if team adoption is strong, double down on governance; if individual adoption dominates, pivot to certified skill packs. Kill criteria: under 30 paying seats at month 3 with no enterprise pipeline means walk away — the market is real but you're early by 12 months, and you can re-enter when the vendors validate it.

Related Terms

MCP (Model Context Protocol) — the tool-connection standard that skills increasingly wrap; a skill is often a thin policy layer over MCP servers, so MCP adoption directly expands the skill market.

Agent Orchestration — multi-agent frameworks (OpenMontage-style) that consume skills as building blocks; orchestration growth is the demand driver for a skill registry.

Prompt Injection / AI Supply Chain Security — the risk category that makes skill auditing a sellable product; expect this term to spike as enterprises adopt agents, pulling SkillLint-style tools into budget.