Why humans are disappearing from the software workflow?

NVIDIA keeps 387 skills in a single repository, Anthropic 250 in its knowledge-work plugins, Microsoft 201, Adobe 170 and AWS 144.

74 companies publish official skills in our directory.

Our read is that the skill is becoming the onboarding for the next customer, and that customer is a model working for a developer.

If most of your new databases are created by AI tools, the instructions those tools read are part of your product.

The first job ads for this work exist: Vapi is hiring for "Agentic Developer Experience" and writes that its engineers "are already building agent skills, workflows, and tools."

Curated skills help but generated ones hurt

In SkillsBench 1.1, 87 tasks across 18 model and agent setups, curated skills raised the pass rate from 33.9% to 50.5%.

Skills the models wrote for themselves made results worse, by 8 to 11.5 points on Claude Code, Codex and Gemini CLI. In Vercel's evals, the agent didn't invoke the skill at all in 56% of cases.

Most skills go unused.

In Vercel's analysis, nearly half of the million skills on skills.sh have exactly one install, and the top 1.2% take 94% of installs.

The scarce input is expertise.

A short skill written by someone who has done the job, and measured against a run without it, is worth having.

Most of the rest costs context: the median skill we list adds about 2,000 tokens when it loads.

The supply chain problem arrived in year one

We ran automated checks on 6,549 skills before listing any.

98 failed and stayed out. 56 piped a download from an outside host into a shell, 24 told the agent to hide what it did or turn off its permission checks, and 21 hid content with encoded payloads or invisible Unicode.

Elsewhere it was worse.

• Koi Security found 341 malicious skills out of 2,857 on ClawHub in February, and 824 out of more than 10,700 two weeks later.
• Trail of Bits bypassed every skill scanner it tested, most in under an hour.
• Palo Alto Networks agreed to buy Koi for $300 million.

Skills are going through npm's decade of supply-chain lessons in about a year.

In job ads, the work moved to deployment

Forward deployed engineering is now the largest role family on the board: 631 roles, 22% of everything open, at 102 companies. It's also the lowest paid of the large families. Median posted US pay, leaving out OpenAI and Anthropic:

The skills in demand read like infrastructure. Kubernetes appears in 26% of ads and PyTorch in 12%. vLLM is named in 138 ads, more than LangChain's 99, leaving out the companies behind each tool.

Evaluation comes up in 40%.

We see that agent frameworks are turning into a commodity layer, and serving, deployment and evaluation are where companies still can't find enough people.

There are two pay markets

OpenAI and Anthropic have 426 open roles between them and post a median of $364k. Everyone else posts $240k.

That gap distorts most pay comparisons.

Ads that name Rust post $300k against $250k, but take out the two labs and it's $238k against $240k.

Where we think this goes

Shipping official skills becomes as normal as shipping an SDK, and "agent experience" becomes a job title on developer-tool teams.

Companies install skills from pinned, allowlisted registries. When three scanners agree on fewer than 1% of skill versions, stars stop counting as trust.

Forward deployed pay catches up. It's the largest family, and engineer-titled roles still post about $50k less than agent engineers. We'd be wrong if that gap is still there in a year.

Browse the skills, or see the 2,881 open roles behind these numbers.