The question of where to publish a Claude skill used to have one answer: push it to GitHub, tell three friends, hope. That answer is broken. As of May 2026 there are at least seven places competing to host the same folder, and the rules about who finds you and who scans your code for malware differ wildly between them. This piece is about where to publish a Claude skill if you only have time to publish in two places, and which two those should be.
Short version, then the reasoning. Push your skill to a GitHub repo you control. That is your source of truth. Mirror it to skills.sh for reach. Submit a PR to anthropics/skills when the skill is good enough to survive Anthropic review, because the merge itself is the credential. Everything else (the aggregators scraping GitHub, the Codex plugin directories, the "claudemarketplaces.com top 10 list") follows from those three moves.
The three tiers nobody draws clearly
Read any 2026 "where do I publish my skill" thread and you will see the same confusion: people compare anthropics/skills to skills.sh as if they are competing for the same job. They are not. There are three tiers, and most skills belong in all of them eventually.
Tier one is the official vendor catalog. anthropics/skills (139k stars, Anthropic-maintained) and openai/skills (19.7k stars, "Skills Catalog for Codex") sit here. A merged PR into either is a credential. It tells installers that a human at the vendor read your skill and decided it was safe to ship next to first-party document skills. Few PRs make it, and the ones that do carry an enormous amount of trust.
Tier two is the community aggregator. skills.sh launched January 20, 2026 as a Vercel project, a directory and leaderboard for skill packages installable via npx skills add <package>. SkillsMP claims 1.46 million scraped skills with semantic search. claudemarketplaces.com lists 6,700+ skills, 840+ MCP servers, 2,500+ plugin marketplaces, and pulls 170k monthly visits. ClawHub (the OpenClaw registry, 3,286 skills after a security purge) functions like npm for agents with a clawhub publish command. These compete on reach, not credibility.
Tier three is your own repo. A plain GitHub repo with a SKILL.md at the root, a clear README, and a tag. This is the only tier you fully control. Every aggregator above will eventually scrape it, mirror it, or link to it. Some will get the name wrong.
The mistake is choosing one tier and stopping. Tier one alone gets you trust but no discovery; tier two alone gets you discovery but no signal that anyone vetted the work; and skipping tier three leaves you renting someone else's URL for your own code.
What anthropics/skills actually gets you
A merged PR into anthropics/skills is the single most valuable artifact in skill publishing right now. The repo does not have the most traffic; what it has is a Good Housekeeping seal that recruiters and enterprise buyers actively look for. The 618 open PRs at the time of writing tell you the queue is real and not everyone gets through.
What the merge actually requires, based on the public template directory: a SKILL.md that follows the format spec at agentskills.io/specification, instructions that are tight (no padding, no AI-tells), scripts that run on a clean machine, and a description that is honest about scope. The merge does not get you discovery inside Claude Code. Skills in anthropics/skills are bundled with Claude.ai for document workflows (PDF, DOCX, PPTX, XLSX) and a handful of curated categories, but Claude Code users do not browse the repo when they install. They use a marketplace or a skills add command.
So submit to anthropics/skills for the trust signal. Submit knowing it might sit in the queue for weeks. Do not wait on the PR before publishing elsewhere.
What skills.sh actually gets you
skills.sh is the closest thing to a front door right now. It supports 17 agent platforms at launch (Claude Code, Cursor, GitHub Copilot, and the rest of the agentskills.io client list), browses by category and popularity, and installs via a single npx skills add command that works across the agents it supports. The leaderboard matters because a user who does not know your name will land on it first.
If you want one mental model: skills.sh is to skills what npm is to JavaScript packages, and the vendor catalog (anthropics/skills) is the equivalent of the Node.js standard library. One has 19 things, the other has 89,000, and you ship to both.
The Vercel team has been deliberate about keeping the format open and the install command vendor-neutral. That neutrality is the whole reason to make skills.sh your default discovery surface. Publishing there does not lock you out of Anthropic, OpenAI, or anybody else.
The Codex side is messier
openai/skills takes contributions through PR, with three category folders: .system (auto-installed with Codex), .curated, and .experimental. A skill in .system ships with the binary. A skill in .curated installs via the $skill-installer command. A skill in .experimental is a community contribution that has not been vetted.
Separately, OpenAI launched the Codex Plugin Marketplace on March 27, 2026. Plugins bundle skills with apps and MCP servers. Distribution runs through three channels: an OpenAI-curated Plugin Directory (launched with 20+ partners including Slack, Figma, Notion, Sentry), repo-scoped marketplaces tied to a project, and personal marketplaces for individual use. As of May 2026, though, self-serve publishing to the official Plugin Directory is still "coming soon." So if you want to publish a Codex skill today and have it discoverable inside the Codex app, you either get into openai/skills, build a repo-scoped marketplace your users install manually, or wait.
That is the honest 2026 state. Claude-side discovery is finished; Codex-side is still half-built.
Discovery mechanics, registry by registry
Most "publish your skill" posts skip the question of how an actual user finds your skill once it is live. Here is what that funnel looks like in practice.
In Claude Code, users install skills with npx skills add <package> (skills.sh) or claude /skills to browse the bundled set from anthropics/skills. The first command hits skills.sh's index. The second hits a curated subset Anthropic ships with the CLI.
In Codex, users install via $skill-installer <skill> (pulls from openai/skills curated and experimental folders), or by adding a plugin from the Plugin Directory inside the desktop app. The Codex CLI does not browse skills.sh natively yet.
In Cursor, Amp, Goose, and the rest of the 17 platforms agentskills.io tracks, each agent has its own command and discovery flow, but they all read the same SKILL.md format. A skill published to skills.sh is installable in any of them via the npx command.
claudemarketplaces.com and SkillsMP are different beasts. They host the link, not the install path. A user finds your skill through Google, lands on claudemarketplaces.com, reads the description, clicks through to your GitHub repo, and copies the install command from your README. Treat those sites as SEO surfaces, not install endpoints.
Naming collisions are now a real problem
Because anyone can scrape, anyone can mirror. A skill called "pdf-extractor" can exist in five places with five slightly different versions, three of which are stale. SkillsMP does not check for collisions when it scrapes. claudemarketplaces.com sometimes lists two entries for the same skill because two different repos forked it.
The fix is simple and unromantic: pick a namespace early and use it everywhere. @your-handle/skill-name on skills.sh, your-handle-skill-name as the GitHub repo, identical metadata in the SKILL.md. When an aggregator scrapes you wrong, file a takedown for the wrong version. Do this once, then never think about it again.
One source of truth, then mirror
The workflow that actually works in May 2026:
- Build the skill in a single GitHub repo. That repo is the source of truth.
- Tag a release. Aggregators key off tags.
- Submit a PR to anthropics/skills (or openai/skills if Codex-shaped). Expect a wait.
- Publish to skills.sh via the Vercel submission flow.
- Let SkillsMP, claudemarketplaces.com, and ClawHub scrape on their own schedule. Do not chase them.
Knack publishes to multiple targets in one click, so the GitHub push and the skills.sh listing happen in the same action. That is the use case it was built for: one skill, many registries, one update path. If you authored elsewhere, the steps above are manual but not hard.
Money
As of May 2026, none of the major registries pay creators. Not skills.sh, not anthropics/skills, not openai/skills, not SkillsMP, not claudemarketplaces.com, not ClawHub. Some sites have hinted at revenue sharing for premium skills (claudemarketplaces.com floated install-count tipping in April). None have shipped it. If somebody promises you payment for publishing, read the terms carefully. Most of the "marketplace" language is npm-style: free hosting, free discovery, no revenue.
A handful of platforms have built private paid-skill tiers that sit outside the public registries above. Those are separate channels and the economics are still being figured out.
Before you list anywhere, scan the skill
Snyk's ToxicSkills research scanned 3,984 skills from ClawHub and skills.sh in early February 2026 and found malware distribution, prompt injection, and exposed secrets at rates high enough that ClawHub did a security purge from 13,729 listed skills down to 3,286. OpenClaw responded by integrating VirusTotal Code Insight scanning on every submission. anthropics/skills review catches most of this at PR time. skills.sh runs its own scans. The smaller aggregators do not.
If you are publishing a skill that runs code, removes files, or hits an API with a secret, do your own pre-flight: no hardcoded keys, no rm -rf without a confirmation prompt, no curl-to-bash in the script directory. The reputational cost of being the person whose skill exfiltrated a token from someone's .env will outlive the skill.
What to do tomorrow
Open your skill. Confirm the SKILL.md follows the agentskills.io spec. Push to your own GitHub repo with a v0.1.0 tag. Open a PR against anthropics/skills. Submit the same repo to skills.sh. Wait. The scrapers will find you.
If you want the whole pipeline collapsed into one button, Knack does that. If not, the manual version above takes about an hour, and the hour buys you reach on skills.sh, credibility from the anthropics/skills queue, and a canonical URL you control on GitHub. Three tiers, two registries you actively push to, one repo that is yours.