The Claude skills marketplace, mapped out.

The landscape, honestly

Search "Claude skills marketplace" and you will not land on one definitive storefront the way you would for a browser extension gallery or an app store. What exists instead is a handful of legitimate channels of very different character: Anthropic's own curated surfaces, an open-source examples repository, community catalogs of wildly varying quality, and a small number of paid, opinionated packs. Knowing which channel you are looking at matters more than knowing the exact URL, because each one implies a different trust level and a different kind of skill.

That matters practically because the channels are not interchangeable. A skill from Anthropic's own examples repo, a skill that survived a community marketplace's review pipeline, and a skill you found in a random gist carry three different levels of implicit vetting before you have read a single line, even though all three might use the identical SKILL.md format. Treat the channel as your first signal, and your own read of the file as the second, never the only one.

Where to actually look

• Anthropic's pre-built document skills. PowerPoint, Excel, Word and PDF skills ship directly on claude.ai and the API. General-purpose, not customizable, and the safest starting point because Anthropic wrote and maintains them.
• The official examples repository. github.com/anthropics/skills is Anthropic's own public repo of example skills, several of them Apache 2.0 licensed and genuinely useful as-is or as a template. It is the right first stop if you want to see what a good skill looks like before writing or buying one.
• The official plugin marketplace. claude-plugins-official, a curated set Anthropic selects at its own discretion. It registers automatically the first time you start Claude Code interactively.
• The community plugin marketplace. claude-community, where third-party submissions land after an automated safety screen and a review pipeline. Add it with /plugin marketplace add anthropics/claude-plugins-community. Review lowers risk but does not eliminate it, the same way an app store review does not make every app trustworthy.
• Unmoderated community catalogs. GitHub topic pages, personal repos, blog posts with a zip attached. No review at all. Treat everything here as unverified until you have read it yourself.
• Curated paid packs. A smaller, opinionated category (SkillCrate included) that trades breadth for depth: fewer skills, but each one built as part of an end-to-end workflow, with the glue and guardrails between steps included rather than left as an exercise.

Installing from a marketplace

If a skill is distributed as a Claude Code plugin, installing it is a few commands, not a manual file copy. Point Claude Code at the marketplace, then install the plugin by name:

/plugin marketplace add anthropics/claude-plugins-community
/plugin install <plugin-name>@claude-community

The official marketplace, claude-plugins-official, registers itself automatically the first time you start Claude Code interactively, so you usually only need the explicit marketplace add step for a third-party marketplace like the community one, or a private one your team runs. After installing, run /reload-plugins to pick up the new skill without restarting.

A skill that is not packaged as a plugin has no install command at all. It is just a folder: download or clone it, then copy that folder into ~/.claude/skills/ for yourself or .claude/skills/ inside a repository for a project. Both routes end at the same place, a folder with a SKILL.md file Claude can read; a marketplace only adds discovery, versioning and a namespace on top.

What separates a pack from a prompt dump

Not everything wearing a SKILL.md file is worth installing. The format is so simple that a five-minute rewrite of a decent prompt will technically satisfy it: two frontmatter fields and some markdown. The gap between that and something worth trusting with a real workflow shows up in a handful of concrete places.

• The description names a trigger, not a topic. A weak description says roughly what the skill is about. A strong one states what the skill does and exactly when Claude should reach for it, because that field is the entire discovery mechanism.
• Inputs and outputs are explicit. A prompt dump says "write a good email." A real skill states what information it needs before it can run and what shape the result comes back in, so the output can feed the next step in a pipeline without a human reformatting it.
• Edge cases are written down, not discovered live. What happens with a long thread, a duplicate record, or an angry reply should be answered in the instructions, not improvised the first time it comes up.
• Guardrails are built in, not left to memory. If a workflow has a compliance step, a verification step, or a hard-stop condition, a real skill enforces it inside the procedure. A prompt dump assumes the user will remember to check.
• It reads like it has actually been run. Specific numbers, named failure modes, and a defined quality bar are hard to fake convincingly. Vague confidence ("handles all cases gracefully") with no specifics underneath it is the opposite signal.

A short evaluation checklist

Before you install any skill you did not write, open SKILL.md and check:

1. Does the description say both what it does and exactly when to use it?
2. Are the required inputs stated up front, not assumed?
3. Is there a named output format the next step could actually consume?
4. Are at least two or three real edge cases called out by name, not just the happy path?
5. If the workflow touches anything regulated, billing, outreach, user data, is there an explicit hard-stop rule, not just a suggestion to "be careful"?
6. Does every bundled script or reference file do something you can explain after reading it, with nothing you had to just trust?

A skill that clears all six is worth installing. A skill that fails two or more is a draft, not a pack, whatever price it is listed at.

Security cautions for third-party skills

A skill is not a passive document. It gives Claude instructions and, in environments like Claude Code, the same filesystem and network access as anything else you run. Anthropic's own guidance is blunt about this: use skills only from sources you trust, yourself or Anthropic, and if you must use one from an unknown source, audit it thoroughly first.

• Read everything bundled, not just SKILL.md. Scripts, reference files, and any linked assets can all carry instructions or code. Skim SKILL.md and skip the rest is not an audit.
• Be wary of skills that fetch external URLs. Content pulled from the internet at runtime can carry instructions of its own, and a skill that was safe when you reviewed it can become unsafe later if an external dependency it calls changes.
• Watch for a mismatch between stated purpose and actual behavior. A skill described as a spreadsheet formatter that also shells out to curl an unfamiliar domain is a mismatch worth stopping on, not explaining away.
• Treat it like installing software with real permissions, especially before pointing it at anything with production data or real customer information behind it.

None of this is unique to Claude. It is the same discipline you would already apply to a shell script or a browser extension someone emailed you: read it before you run it, and know exactly what it can touch. The two free samples on the SkillCrate storefront are there precisely so you can apply that same read-before-you-trust standard to a paid pack before buying it, not just to free ones.