You opened Claude Code, ran /plugin, and got hit with 200+ options. Which ones are actually worth the context budget? That's the real question, and most "best Claude Code skills 2026" posts answer it with a padded top-50 that nobody could install without turning their agent into mush.
I build coding agents for a living — I ship openseek, a Claude Code-style TUI agent, and I maintain a personal skill collection. So my bias is strong and specific: a skill earns a slot only if it does a job I do repeatedly, encodes real guardrails, and doesn't bloat every prompt. Everything below is grouped by that job-to-be-done, with the exact moment I reach for it. If a name is community-maintained or I'm unsure of a number, I'll say so.
Want the full filterable catalog first? Browse 2,000+ Claude Code skills on OrangeBot and come back.
How I Pick (Steal This Filter)
Three questions before anything gets installed:
- Is it a job or a persona? "Review this PR for SQL-injection" is a job. "Act as a senior staff engineer" is a persona — and personas are the number-one way people waste 3,000 tokens on vibes. Skip them.
- Does it have refusal patterns? Open the
SKILL.md. If there's no "NEVER do X" / "always verify Y", it's documentation cosplaying as a skill. - What does it cost when idle? Skills load on-demand, so 1,999 unused ones cost zero. Plugins that register tools do not — their descriptions sit in context. Budget accordingly.
That third point is the whole game. If you only remember one thing: prefer skills (lazy-loaded) over always-on MCP tool servers for anything you don't call constantly. I unpack that trade-off in Claude Code best practices for 2026, and the MCP side in the best MCP servers for 2026.
Code Review: the one category where a plugin beats a skill
Review is genuinely multi-agent work — you want parallel passes over security, performance, correctness, and style — so this is where Anthropic's first-party code-review plugin (in the official anthropics/claude-plugins-official marketplace) earns its keep. It runs confidence-filtered review agents and prioritizes high-impact findings instead of drowning you in nits. There's also a pr-review-toolkit in the same official marketplace for PR-shaped workflows.
Install when: you're merging into a shared branch and want a second set of eyes before a human's. Layer your team's house rules on top as a small custom review skill — the plugin does the heavy lifting, the skill enforces your specifics.
Security: install this before you think you need it
The first-party security-guidance plugin reviews the agent's own diffs for injection, XSS, SSRF, exposed secrets, IDOR, and auth-bypass patterns. In recent Claude Code builds it ships enabled by default — verify with /plugin, and if it's off, turn it on. This is the single highest-leverage thing in this whole post, because the failure mode it prevents (an agent confidently committing a secret or an SSRF hole) is expensive and silent.
Install when: always. There is no project where you want less of this.
Testing: give the agent a browser, not a guess
Anthropic's webapp-testing skill (from the official anthropics/skills repo) teaches the agent to actually drive and verify a running web app rather than assert that its code "should" work. This closes the loop that pure code-gen leaves open — the agent writes the change, then checks it in a real page.
Install when: you're building anything with a UI and you're tired of "it looks done" being wrong. Pair it with your framework's test-runner conventions encoded as a tiny skill of your own.
Docs & Deliverables: the boring skills that quietly save hours
The office-document family from anthropics/skills — docx, pdf, pptx, xlsx — lets the agent read and write real Word, PDF, PowerPoint, and Excel files instead of dumping markdown and hoping. There's also doc-coauthoring for longer collaborative drafts. Unglamorous, high hit-rate.
Install when: your work escapes the terminal — a client deck, a compliance PDF, a spreadsheet a human will open in Excel. These are must-have Claude Code skills for anyone whose output isn't purely code.
Git: the category where you should write your own
Honest take: I don't install a big third-party git skill, and I'd be suspicious of any that claims to "handle your git workflow" generically. Git discipline is intensely local — your branch naming, your commit-message convention, your "never force-push main" rule. This is the category to author yourself with the skill-creator skill/plugin (first-party) and keep it 30 lines. Encode the refusals: no --amend unless asked, no destructive ops without confirmation, commit only files in the current task's scope.
Install when: you notice you're re-typing the same git corrections to the agent twice a week. That's the signal to freeze it into a skill.
SEO & Content: real skills exist, but vet the source
There's a healthy set of SEO / analytics skills — Search Console analysis, keyword research, content structuring — but most live in community collections, not the official repo, so read the body before trusting it. This is exactly what OrangeBot's index is for: browse the SEO and content skills on /skills, filter by category, and check each SKILL.md before installing. A good SEO skill encodes a checklist (title length, canonical, internal-link targets); a bad one is a vibes essay about "ranking factors."
Install when: you're shipping content or marketing pages and want consistent on-page hygiene without re-explaining it every post.
DevOps: covered separately, because it's a different risk class
Infra skills deserve their own guardrail-heavy treatment — a wrong terraform apply isn't a bad diff, it's a deleted database. I wrote those picks up in full in the best Claude Code skills for DevOps. Short version: match the skill to the tool you actually run, and demand explicit "plan-before-apply, refuse on stateful replacement" refusals.
Build-Your-Own: the two meta-skills everyone should have
skill-creator— scaffolds a new skill with correct frontmatter and triggers. The moment you correct the agent the same way twice, this turns that correction into a reusable skill.mcp-builder— generates MCP server code when you genuinely need a long-running tool integration (a database, an internal API). Reach for it after you've confirmed a skill can't do the job, not before.
How to Install Any of These
Skills and plugins install a little differently — plugins via the /plugin marketplace flow, skills by pointing Claude Code at a repo or dropping a folder in place. Rather than repeat it here, I wrote the full walkthrough (both paths, plus how to audit a SKILL.md before you trust it): how to install Claude Code skills.
The meta-move: don't install 40 skills today. Install security-guidance, one review plugin, webapp-testing, and the doc family. Add the rest only when a repeated pain shows up. Curation beats accumulation — an over-stuffed skill library is just MCP bloat wearing a different hat.
New skills land every week, and the good ones aren't always the loud ones. I sort through the noise so you don't have to — subscribe to OrangeBot Weekly for the short "what to actually install this week" digest.