npx skills add: The One Command That Now Installs AI Skills Into 70 Different Agents

A Vercel Labs CLI standardized how agent skills get installed, and the tell that it won is that Google now ships its own Gemini docs through it. Here is what that means, and how to use it without getting burned.

The most-installed new AI tool this week is not a model. It is a command: npx skills add owner/repo. Run it and a folder of Markdown drops into your coding agent, and that agent can suddenly do something it could not do a second earlier. The CLI behind it, vercel-labs/skills, passed 22,000 GitHub stars, and it installs the same skill into Claude Code, Codex, Cursor, Gemini CLI, and 67 other agents without changing a line.

That last part is the story. A year ago every agent had its own plugin format, and a capability you wrote for one was useless in another. Now there is one verb, and it works everywhere.

Why a folder of Markdown beats a model release

A skill is not a model and not an app. It is a directory with a SKILL.md file, some YAML frontmatter naming what the skill does and when to use it, and optional scripts the agent can run. The agent loads it on demand, reads the instructions, and follows them. That is the entire mechanism. It sounds too simple to matter, which is exactly why it is worth paying attention to.

Here is the position I will defend. The interesting unit of AI capability stopped being the model months ago, and this week it became the skill, the thing that gets written, versioned, and installed. The clearest proof is not the trending board full of skill repos. It is that the big labs stopped shipping only SDKs and started shipping skills, through the same community installer everyone else uses.

Google's own coding-agent setup docs recommend skills.sh by name, calling it "the open standard for portable agent behaviors," and hand you the command npx skills add google-gemini/gemini-skills --skill gemini-api-dev --global. Anthropic's Claude for Teachers, launched July 14, is at heart a curated library of teaching skills mapped to academic standards in all fifty states. Strip the education framing and the shape is the same as the open-source board: the model is table stakes, and the skill is the product sitting on top of it.

The staleness problem skills exist to patch

Why would Google ship a skill instead of just documenting its SDK? Its own docs say the quiet part out loud: an agent's training data cuts off at a date, so it misses new API features and suggests generic or deprecated patterns. A skill fixes that by injecting current rules straight into the agent's context. The gemini-api-dev skill, for instance, steers the agent toward current model IDs and away from ones Google has retired, and it pulls live documentation through a companion MCP server when one is connected.

Think of it like a cheat sheet you slip to a very smart contractor who has been off the grid for a year. The contractor is brilliant. They just do not know that the API they are about to call was renamed last spring. The skill is the note that keeps them from writing confident, wrong code.

The portability comes from everyone agreeing on the same SKILL.md layout. The installer knows where each of 70 agents expects skills to live, and many of them now share a single .agents/skills/ directory, so Codex, Cursor, Gemini CLI, and Copilot can read the exact same files. Write a skill once, and it runs in all of them.

The installer also draws a line most people miss on the first run: scope. By default a skill installs into your current project, in a folder you can commit and your team can see. Add the -g flag and it goes to your user directory instead, available across every project on the machine. That difference matters more than it looks. A project-local skill is reviewable and disposable. A global one is a standing instruction your agent carries into every repo you open, including the ones where you never meant it to run. The default is the safe choice, and it is the default for a reason.

That portability is real, and it is not total. The compatibility table in the installer's own README shows the seams: features like Claude Code hooks and its context: fork isolation are Claude-Code-only. A skill will load in every agent, but a skill that leans on one agent's advanced features degrades to plain instructions in the others. Portable is the default. Identical is not the promise.

Put this into practice

The fastest way to understand skills is to install one and watch your agent use it. Start with a vendor skill from a name you already trust, because that removes the security question while you learn the mechanics.

1. Look before you install. Run npx skills add owner/repo --list to see the skills inside a repo without writing anything to disk. Or run npx skills use owner/repo@skill-name to generate the skill's prompt and print it, again without installing.
2. Install a known-good one. Try npx skills add google-gemini/gemini-skills --skill gemini-api-dev or one of Vercel's own skills. Leave off the -g flag so it installs into your current project, not your whole machine.
3. Ask your agent a question the skill should change. With the Gemini skill loaded, ask "how do I use context caching with the Gemini API," and watch whether the agent references current methods and shows it is using the skill. That "using skill" indicator is the whole payoff made visible.
4. Read the SKILL.md before you keep it. Treat it like a shell script someone handed you. Open it, read the instructions and any bundled scripts, and only then decide it lives in your setup.
5. Commit project-local skills so your team reviews the diff. A skill in .agents/skills/ that ships in your repo gets the same code review as anything else you commit. That review is your real safety layer.

The smallest real win is step three. It takes under ten minutes and it makes the abstract idea of "a skill" concrete: you asked a question, the answer got better, and you can see why.

Honest limitations

The one command that makes skills feel like magic is the same one command that makes them dangerous, and the danger is not hypothetical. Snyk's ToxicSkills research scanned 3,984 skills and found that 36.82 percent carried at least one security flaw, 13.4 percent had a critical-level issue, and 1,467 were vulnerable. The team confirmed 76 malicious payloads through human review, and every confirmed malicious skill combined ordinary malware patterns with prompt injection aimed at the natural-language layer, a mix built to slip past both AI safety filters and conventional scanners. The installer even ships a -y flag to skip every confirmation and an --all flag to install everything at once. Reach for those and you are running curl | bash on a stranger's repo.

There is also no single referee. Vercel Labs runs the popular installer, and agentskills.io is the nominal specification, but there is no governance body, no code signing, and no review process between a skill's author and your agent's context. Google's docs list Context7 as an alternative installer alongside skills.sh, so even the "one command" is a dominant convention rather than a monopoly. The standard won on adoption, not on any guarantee of safety.

And the skills themselves rot. A skill that patches an agent's stale training can go stale in turn. Google's coding-agent doc, last updated in late April, still points agents at Gemini 3.1 as the current model even as the product line has moved on. The cheat sheet has an expiration date too, and nobody stamps it on the front.

What to watch

The format war is settled, and skills won it. The question that has not been answered is who reviews the thing you are installing. Right now the honest answer is you, one SKILL.md at a time, with a security record that already includes over a thousand vulnerable skills in the wild. App stores got code signing, review queues, and sandboxes because unsigned install-anything channels always get abused. The skills ecosystem has the install-anything channel and none of the rest of it yet.

So watch for the layer that comes next: a signing scheme, a real review process, a registry that vets before it lists. Whoever ships that credibly will matter as much as whoever ships the next model. Until then, install like the reviewer is you, because it is.

Sources: vercel-labs/skills, Google Gemini coding-agent docs, google-gemini/gemini-skills, Anthropic Claude for Teachers, Snyk ToxicSkills research, agentskills.io.