AIPM
Theme

Original AIPM research

State of AI Agent Skills 2026

This report measures the public packages currently available through the AIPM Registry API. It shows what can be verified from package metadata and clearly separates trust signals from full security testing.

Published 4 September 2026. Data refreshes every hour. The newest package in this snapshot was published August 31, 2026.

Download the JSON datasetBrowse the skills registry

Short answer

The snapshot contains 33 public package versions from 6 publishers. Every counted package has a SHA-256 integrity value, while source links, declared licenses, and verified publishers have separate coverage. These fields help review a package, but they do not prove that its instructions are safe.

33

Public package versions

6

Publisher namespaces

9

Recorded installs

31

Packages imported from public sources

Trust signals in the registry

SignalPackagesCoverageWhat it means
SHA-256 integrity value33100%The downloaded files can be checked against a recorded hash.
Public source link3194%A reviewer can open the stated upstream source.
Declared license33100%The package states how its content may be used.
Verified publisher13%AIPM has completed its current publisher verification process.

These are metadata checks, not a malware verdict or a complete instruction-safety review. Read the source and bundled files before installation.

Declared target support

TargetPackage versions
All supported tools31
cursor2
claude1

A package may declare all supported tools, so these rows should not be added together.

AIPM compatibility checks

WorkflowCommandExpected project output
Install for Cursoraipm add @scope/name@version --target cursor --ci.cursor/aipm/skills/<skill>.md
Install for Claude Codeaipm add @scope/name@version --target claude --ci.claude/aipm/skills/<skill>/SKILL.md
Verify downloaded filesaipm install --frozenThe package integrity must match the lock data.

These paths and commands are checked by the AIPM repository test and web-verification suites. They describe AIPM behavior, not native support claims made by another product.

Method

  1. Request every page from the public /v1/packages endpoint with a page size of 100.
  2. Count one row for each package version returned by that endpoint.
  3. Use only public metadata: package name, version, description, targets, license, source, integrity, date, installs, publisher, and import state.
  4. Refresh the displayed totals and downloadable dataset every hour.

Limits

  • This is an AIPM registry snapshot, not a count of every Agent Skill on the internet.
  • Publisher verification confirms the current AIPM identity check only.
  • An integrity hash detects changed files; it does not decide whether instructions are safe.
  • Target support is declared in package metadata and should be confirmed by testing the installed files.
  • Install counts include only events recorded by the registry.

Sources and reproducibility

The downloadable dataset is available under the Apache License 2.0.