Research snapshot · 5 November 2026
We reviewed five public discovery and installation experiences. The goal is to learn from useful patterns while keeping OpenShrimp Skills independent, curated, and clear about what has—and has not—been verified.
Discovery and install
A searchable leaderboard connects discovery to a short npx skills add install command. Activity and install totals make popularity visible; its documentation explains that counts come from anonymous install telemetry and that a listing is not a security guarantee.
Useful lesson: make the next step obvious, but show popularity only when it is real, explain how it is measured, and never present it as a safety or quality verdict.
Taxonomy and source context
Offers keyword search and browsing by category, domain, creator, and occupation. Listings link to repositories; category counts, GitHub stars, and source recency help users narrow a very large index. Its own guidance says these are signals, not endorsements, and encourages source inspection.
Useful lesson: use understandable categories and show provenance. OpenShrimp starts with a small curated list instead of importing an unreviewed index.
Packages and releases
Separates skills from code and bundle plugins, surfaces creators and update activity, and documents versioned releases, changelogs, downloads, and install/update commands. Security documentation describes scan summaries and moderation without treating automation as a guarantee.
Useful lesson: keep package kinds distinct and make version, publisher, contents, and installation part of the detail page. Report security evidence narrowly.
Product detail and trust
Pairs category/search discovery with detailed product pages, explicit compatibility, version, pricing, installation IDs, and a manual download path. Its install and trust pages explain CLI behavior, file placement, scripts, permissions, and what the installer does not do. The site also offers English, German, French, and Spanish versions.
Useful lesson: show the package file tree and practical install path before the user commits; document what code does, not just what it promises.
MCP server discovery
Its current discovery surface focuses on MCP servers and technical connection details such as transport, authentication, and whether a server runs locally or remotely. These are operational requirements, not the same thing as installing a SKILL.md instruction package.
Useful lesson: describe MCP endpoints, transport, credentials, and data access explicitly. Per the project brief, Smithery’s former connection services are discontinued; OpenShrimp Skills does not depend on them.
Agent skills (SKILL.md instructions), executable scripts/tools, and MCP servers have different requirements and risks. The catalogue identifies them separately; a future listing must document its own setup and permissions. Popularity counts, reviews, and security badges stay absent until there is reliable evidence to show.
This is a qualitative review of public pages and documentation accessed on 5 November 2026, not an audit of those services or their products. Features and policies can change. OpenShrimp Skills makes no claim that other vendors' security checks or compatibility guarantees apply to its catalogue.