AIPM
Theme

Original AIPM research

State of AI Agent Skills 2026

This report measures the public packages currently available through the AIPM Registry API. It shows what can be verified from package metadata and clearly separates trust signals from full security testing.

Published 4 September 2026. Data refreshes every hour. The newest package in this snapshot was published October 18, 2026.

Download the JSON datasetBrowse the skills registry

Short answer

The snapshot contains 704 public package versions from 54 publishers. Every counted package has a SHA-256 integrity value, while source links, declared licenses, and verified publishers have separate coverage. These fields help review a package, but they do not prove that its instructions are safe.

704

Public package versions

54

Publisher namespaces

55

Recorded installs

702

Packages imported from public sources

Trust signals in the registry

SignalPackagesCoverageWhat it means
SHA-256 integrity value704100%A hash of the package archive is recorded. The CLI writes it to aipm-lock.json but does not yet check downloads against it.
Public source link703100%A reviewer can open the stated upstream source.
Declared license704100%The package states how its content may be used.
Verified publisher30%AIPM has completed its current publisher verification process.

These are metadata checks, not a malware verdict or a complete instruction-safety review. Read the source and bundled files before installation.

Declared target support

TargetPackage versions
All supported tools702
claude2
cursor2
codex1

A package may declare all supported tools, so these rows should not be added together.

AIPM compatibility checks

WorkflowCommandExpected project output
Install for Claude Codeaipm add @scope/name@version --target claude --ci.claude/skills/<skill>/SKILL.md
Install for Codexaipm add @scope/name@version --target codex --ci.agents/skills/<skill>/SKILL.md
Install with the Cursor targetaipm add @scope/name@version --target cursor --ci.cursor/skills/<skill>/SKILL.md
Restore pinned versionsaipm install --ciReinstalls the exact versions listed in aipm.package.json
Install without project trackingaipm add @scope/name@version --target claude --no-initSkill files only. No aipm.package.json or aipm-lock.json

These paths and commands are checked by the AIPM repository test and web-verification suites. They describe AIPM behavior, not native support claims made by another product.

Method

  1. Request every page from the public /v1/skills endpoint with a page size of 100.
  2. Count one row for each package version returned by that endpoint.
  3. Use only public metadata: package name, version, description, targets, license, source, integrity, date, installs, publisher, and import state.
  4. Refresh the displayed totals and downloadable dataset every hour.

Limits

  • This is an AIPM registry snapshot, not a count of every Agent Skill on the internet.
  • Publisher verification confirms the current AIPM identity check only.
  • An integrity hash detects changed files; it does not decide whether instructions are safe.
  • Target support is declared in package metadata and should be confirmed by testing the installed files.
  • Install counts include only events recorded by the registry.

Sources and reproducibility

The downloadable dataset is available under the Apache License 2.0.