Six hours after Vercel announced skills.sh last Tuesday, their top skill hit 20,000 installs. By the weekend, X was flooded with demos showing AI agents that suddenly knew how to write production-grade React, deploy to Vercel with one command, and audit websites like seasoned developers.
The concept? Instead of re-explaining React best practices to Claude every single time, run "npx skills add vercel-labs/agent-skills" and your AI coding assistant now has 10+ years of optimization patterns baked in. Think npm, but for teaching AI agents procedural knowledge.
Here's what makes this different: Skills aren't documentation links. Each packages natural language instructions (SKILL.md), helper scripts, and examples into a folder any compatible agent understands. The agent reads the instructions, knows when to use scripts, and follows patterns automatically.
Vercel shipped three flagship skills:
- vercel-react-best-practices: 40+ rules for React/Next.js performance (48.7K installs now)
- web-design-guidelines: 100+ rules for accessibility, UX, performance (37K installs)
- vercel-deploy-claimable: Deploy projects from chat with claimable URLs
But the ecosystem exploded immediately. Remotion dropped a video generation skill that hit 32.7K installs. Expo shipped six React Native skills. Marketing agencies released SEO audits, copywriting, and programmatic SEO skills. The platform now has 565+ community skills with 25,000+ total installs.
Agent compatibility: Works with Claude Code, Cursor, GitHub Copilot, Clawdbot, Cline, Windsurf, and 10+ others. Install once, works everywhere.
Why this matters: AI agents are generalists pretending to be specialists. They can explain React, but don't know how you actually do it — the procedural stuff that separates demo code from production. Skills give agents muscle memory.
The timing is perfect: This launch coincides with Clawdbot hitting mainstream this week — and the combination is explosive.
Clawdbot is basically an open-source AI assistant you run locally on your own hardware (even that dusty 2018 laptop works). Unlike cloud-based ChatGPT, it connects to messaging apps you already use — WhatsApp, Telegram, Discord, Slack, iMessage — and remembers everything while taking real actions on your computer.
The viral demos flooding X over the weekend showed what happens when AI agents get real autonomy:
- Alex Finn's Clawdbot autonomously built a visual interface for itself overnight — now it appears as an animated owl on a second screen, moves while working, and spawns sub-agents visually.
- Creator Peter Steinberger showed it automating email cleanup, handling auto-replies, adjusting smart home devices via voice, and sending proactive fitness reminders.
- Alex Finn's 27-minute deep dive showed Clawdbot controlling a Mac/browser, building a Kanban board via vibe coding, delivering proactive morning briefs (news, weather, overnight tasks), and demonstrating infinite memory with no guardrails.
- Tech Friend AJ deployed Clawdbot on AWS free tier in under 5 minutes, then connected it to Ray-Ban smart glasses for real-time Amazon price checks and shopping via voice/photo,
- Kevin Xu gave his Clawdbot portfolio access, with the prompt "Trade this to $1M. Don't make mistakes." It generated strategies, scanned X sentiment and charts, traded 24/7 autonomously—and lost everything.
- Legendary's bot demanded an RTX 4090; given a $2K trading wallet instead, it autonomously traded crypto/stocks/commodities while scanning X sentiment to "earn" the GPU.
- ashen's security demo: sent the bot a Twitter thread about security issues, watched it open a browser tab, analyze vulnerabilities, propose fixes, and generate a CRON job for ongoing checks.
- And if you're hungry for more, Min Choi's thread compiled more "10 wild examples" with a 30-minute no-code setup guide.
Anyway, this meme low-key sums this all up perfectly:
If you want to learn how to set it up yourself, David Ondrej's 20-minute setup tutorial has grown in popularity as people rushed to get it running, and @midudev shared a trick for running Clawdbot with free/open models via OpenRouter (no expensive hardware needed).
Not to be downplayed, security warnings spread just as fast as the Clawdbot hype; the Clawdbot Discord community is pushing proper authentication and sandboxing configurations to avoid brute-force attacks on exposed servers.
Clawdbot is a security nightmare because hundreds of users exposed their control servers to the internet without any authentication, allowing researcher Jamieson O'Reilly to find them via Shodan in seconds and access complete API keys, OAuth credentials, bot tokens, and months of conversation histories. The architecture stores OAuth credentials in plaintext JSON files without encryption (an automated security audit found 512 vulnerabilities including 8 CRITICAL issues) and major infostealers like RedLine, Lumma, and Vidar are already targeting the ~/.clawdbot/ directory structure to exfiltrate credentials.
Because Clawdbot has full system access (shell commands, file read/write, browser control), prompt injection can extract private keys in 5 minutes, and some exposed instances were running with root privileges allowing unauthenticated remote code execution.
The fundamental problem: agents must store credentials and execute commands to be useful, creating an inherent conflict with security models. Translation? There is no "perfectly secure" setup when you give an AI shell access and connect it to the internet.
For more hype and bluster, check out Matt Berman's video on Clawdbot here.
Here's the connection to Vercel: Clawdbot is one of 16 officially supported agents on skills.sh. The same npx skills add command that teaches Claude about React also works for Clawdbot.
Your locally-running AI assistant can now tap into the same professional knowledge base that powers coding agents. Install Vercel's deployment skill, text "deploy my project" to Clawdbot, and it handles everything.
For the first time, teaching an AI agent your team's coding standards is as simple as pointing it to a GitHub repo. No more copy-pasting style guides. Just install the skill and move on.
P.S: If Clawdbot is interesting to you, you could also check out Factory and their droids, which are a more structured, similarly agentic coding loop agent tool that lives inside your codebase (you can also run Droids completely locally if you have a strong enough computer).
The "npm for AI agents" moment just arrived. Based on the install numbers — top 20 skills all crossed 2,000+ in one week — developers have clearly been waiting for it.
