Vercel Skill Packs: The Distribution Layer for Agent Skills Just Landed

On August 7, 2026, Vercel shipped skill packs on skills.sh, its open-source agent skills directory (github.com/vercel-labs/skills). A pack is a bundle of skills with its own URL, installed in one command and updated with another. It is a small change with an outsized signal: after a year of single-skill installs, the skills ecosystem now has a distribution unit bigger than one file, and a way to standardize agent behavior across a team.

Here is what packs do, how they work, and where the trust questions are.

What shipped#

Packs let you combine skills from three sources into one installable bundle:

• public skills already listed on skills.sh
• private skills from your own files, folders, or zip archives
• skills from GitHub repositories you can access, public or private

A folder, archive, or repo does not have to contain exactly one skill: every valid SKILL.md in it is included. Validity is defined mechanically - a SKILL.md needs name and description frontmatter - and the builder skips invalid files, binary files, and anything over 2 MB.

Every pack is unlisted by default with its own URL:

npx skills add https://skills.sh/p/<pack-id>

No authentication is required to install. Updating a pack is a separate command:

npx skills update

Creation runs through skills.sh/packs/create with a Vercel account: give the pack a name and optional description, choose the Vercel team to share it with, add the skills, and copy the install command. The Packs page groups your packs by team, and the creator can delete a pack at any time, which disables its install link.

The package-manager arc completes#

For the last year, the de facto distribution pattern for skills has been npx skills add <owner>/<skill-name>, a direct install from a GitHub repo. That works for one skill per repo, which forced maintainers into a choice: one tiny repo per skill, or a monorepo with a weaker install story. Packs remove the tradeoff. They are the bundling step in the package-manager evolution, the point where a directory of files becomes a shareable, named unit with an install command. We called this arc back in May: agent skills were becoming package managers, and the question was always distribution, not authoring. Anyone can write a SKILL.md; the hard part is moving a set of them to a team intact.

That is exactly the internal scenario packs are built for. Unlisted-by-default is not a compromise, it is the product decision: packs are designed for sharing with a single person or a whole team, not for public publishing. The trust surface is different from the public directory. A team can ship its own standards - deploy runbooks, review checklists, domain procedures - as one URL, and npx skills update keeps every machine on the current version. For teams already treating skills as the way agents learn their job, this is the missing sync mechanism.

The trust questions#

Unlisted is not private. The docs are explicit: packs are not access-controlled, anyone with the URL can view and install the pack, and the instructions warn not to include secrets or credentials. A pack URL is a capability - share it like a token, and treat the pack as revoked only when it is deleted.

The harder question is mutation. npx skills update pulls the latest version of the pack, which means the contents behind a stable URL can change under you. There is no lockfile in the published workflow and no version pinning in the install command. For teams, that is a feature (standards propagate) and a risk at the same time (your agents start following a changed procedure the moment someone edits the pack, with no diff review in between). The 2 MB file cap and binary filter are quiet supply-chain hygiene: packs cannot smuggle executable payloads, only instructions.

That last point matters more than it looks. Skills are the part of an agent's context that persists, and research this month is starting to measure which lines inside a skill actually do work, while other work shows agents follow only a fraction of the steps their skills mandate. Distribution is the layer that decides how many agents see a skill at all, and packs just made that layer fast and team-scoped. The next question - which version of the pack is on which machine - is the same question npm spent a decade answering.

Continue Reading#

• Agent Skills Are Becoming Package Managers - the governance and dependency story behind the trend packs are the distribution step of
• Skills Are How Agents Learn the Job - what a skill actually is and why packaging them changes agent behavior
• MCP vs Agent Skills - where skills sit relative to tools and live data access, and why both standards ship together
• Best Claude Code Skills in 2026 - the install patterns and directory landscape packs build on
• SkillSV: Valuing the Lines Inside a Skill - what research says about which parts of a skill deserve distribution at all

Sources#

• Vercel changelog: Skill packs are now available on skills.sh
• skills.sh Packs
• skills.sh Packs documentation
• skills.sh CLI reference
• vercel-labs/skills on GitHub