Let Claude Find the Skills You Need, Then Check They're Safe

WatchInstagram

You don't need to scroll GitHub for Claude Code skills. Install one skill, find-skills, tell Claude what you're working on, and it searches the skills.sh directory and gives you a short list, with an install line for each. Then, before you say yes, open the skill's page on skills.sh and check its security audit.

find-skills is Vercel's, and with 4.1 million installs it's the most installed skill on skills.sh. It works in Claude Code, Codex, Cursor and 75 other coding agents.

Popular doesn't mean safe, though. Below is how to set it up, three prompts to try first, and the check to run before you install anything.

What do the two tools do?

find-skills: Claude searches for the skills you need

find-skills teaches your agent to look for an existing skill whenever you ask "is there a skill for X?" or "how do I do X?". It checks the skills.sh leaderboard first, then searches the directory with the skills command-line tool.

Before it recommends anything, its instructions tell it to check the install count (it prefers 1,000 or more), whether the source is a known name like Vercel or Anthropic, and the stars on the GitHub repo. For each match you get what it does, its install count, the install command and a link to its skills.sh page.

skills.sh security audits: check a skill before you install it

skills.sh shows security results from three auditors, Gen Agent Trust Hub, Socket and Snyk, in a Security Audits box on each skill's page. The audits page lists them side by side for the whole leaderboard. A skill that's still waiting on a result shows as Pending.

How do you set up find-skills?

Run this in your project. The installer asks which of your coding agents to add it to and installs it for the current project. Add -g to make it available in every project.

npx skills add https://github.com/vercel-labs/skills --skill find-skills

Then ask Claude for a skill in plain words. Three prompts to try first:

Is there a skill for turning my long videos into reels?

Find me a skill for building a landing page.

Is there a skill that automates my weekly report?

One thing to know: when you say yes, find-skills installs with the -y flag, which skips the installer's own confirmation prompt. So add this line to your request:

Show me the security audit and wait for my yes before you install anything.

How do you check a skill is safe before you install it?

Three steps, every time:

1. Open the skills.sh link Claude gives you, or search for the skill on skills.sh.
2. Find the Security Audits box on its page, with a result from Gen Agent Trust Hub, Socket and Snyk.
3. Skip anything marked Fail, High Risk or Pending. On anything marked Warn or Med Risk, click through and read why before you decide.

Popular skills fail too. A skill with 1 million installs on skills.sh failed Snyk's check on 7 October 2026, rated high risk, because it tells your agent to ask you to paste your API key back into the chat as a fallback. That puts your secret key straight into the conversation.

Even find-skills gets a Warn from Snyk. It reads skills that anyone can publish, and a skill written by a stranger could carry hidden instructions for your agent. That's not a reason to skip it. It's the reason to run the check on whatever it finds.

For more free tools that check what your AI agent installs and writes, see our GitHub repos for AI coding agents. To find the jobs costing your team the most time, take the free AI bottleneck test, or read our insights on AI implementation.