)
Last updated: October 28, 2026
What are the best ChatGPT skills? The best ChatGPT skills are narrow, inspectable skills that do one job with the tools you already have: Skill Creator, Plan, PDF, GitHub CI repair and Linear in OpenAI's own examples, plus skills you write for your team's recurring work. Install only skills whose SKILL.md you have read, because a skill acts with your permissions.
TL;DR: Key Takeaways
- A skill is a folder with a
SKILL.mdfile that holds a name, a description and instructions, according to OpenAI's guide to building skills. The format is open and was originally developed by Anthropic, per agentskills.io. - Skills in ChatGPT are an initial beta and are off by default. Workspace owners switch them on and control who can create, share and install them, according to the OpenAI Academy (updated September 17, 2026).
- Skills are a supply chain. Snyk scanned 3,984 public skills and found flaws in 36.82%, critical issues in 13.4% and 76 confirmed malicious payloads, per its ToxicSkills study of February 5, 2026.
- A skill can win selection on its description alone. In University of Maryland research, description-only edits won 77.6% of paired trials across four models.
- Start with narrow skills you can read in five minutes, keep sensitive ones on explicit invocation and give every skill least privilege.
Our Shortlist at a Glance
The table below shortlists the skills worth looking at first, based on primary documentation from OpenAI and Anthropic. The risk column is our own assessment of how much access a skill typically needs, not a rating from either vendor. Read each SKILL.md before you install anything.
| Skill | Best for | Where it runs | Typical risk |
|---|---|---|---|
| Skill Creator | Turning a repeated workflow into a skill | ChatGPT Work (@skill-creator), Codex ($skill-creator) | Low |
| Plan | Structuring multi-step work before you start | Listed as an example skill by OpenAI | Low |
| Working with PDF files | Listed as an example skill by OpenAI | Medium | |
GitHub CI repair (gh-fix-ci) | Fixing failing GitHub checks | Codex | Higher |
| Linear | Working with issues in Linear | Codex, added with $skill-installer | Higher |
| Anthropic document skills (docx, pdf, pptx, xlsx) | Studying complex document skills | Any Agent Skills client | Medium |
| Team workflow skills | Recurring tasks such as contract summaries | ChatGPT | Low to medium |
What Are ChatGPT Skills?
ChatGPT skills are reusable, shareable workflows that tell ChatGPT how to handle a specific task the same way every time. Each one is a folder with a SKILL.md file, and ChatGPT either applies a relevant skill automatically or runs the one you select with @.
OpenAI's guide to building skills says a skill can also include scripts/, references/ and assets/ folders, plus an optional agents/openai.yaml file for interface metadata, invocation policy and tool dependencies. Standalone skills run in the ChatGPT desktop app, Codex CLI and the IDE extension. Skills bundled in plugins also work in Chat and Work on web, desktop and mobile.
Under the open Agent Skills format, agents load skills in three stages. At discovery they read only the name and description. At activation they read the full instructions. At execution they follow the instructions and run any bundled code. The OpenAI Academy adds that skills only direct tools and apps ChatGPT can already use, so existing permissions still apply.
One caveat on availability. The Academy page calls skills an initial beta, off by default, and does not list which plans include them. OpenAI's help center article could not be read when we checked, and secondary sources disagree on plan eligibility, so check the Skills tab in your own account.
)
How to Create, Install and Share Skills
You can create a ChatGPT skill in three ways: record a workflow, ask the built-in creator, or write the folder by hand. Install it from the review modal, then share it with your workspace if your admin allows it. Plugins are OpenAI's recommended way to distribute skills to other people.
The OpenAI Academy describes the chat flow: ask ChatGPT to build a skill, describe the job, inputs, numbered steps, output format and quality checks, review the draft, then click Install. It recommends several small skills you can combine over one large end-to-end skill. For code, OpenAI's guide says Codex loads skills from .agents/skills in the repository, $HOME/.agents/skills for the user, /etc/codex/skills for admins and a bundled system folder.
Skills often need data or actions from outside the chat. That is the job of an MCP server, so read our explainers on what an MCP server is and MCP authentication before connecting a skill to internal systems. If you work in Claude as well, our guide to Claude Code skills covers the same format from the Anthropic side.
How We Picked the Skills
We chose skills using five tests: a primary source documents the skill, you can read the full SKILL.md, the job is narrow, the access it needs is small and the source is dated. Popularity and download counts were not criteria, because registry scores are easy to game.
| Test | What we checked | Why it matters |
|---|---|---|
| Primary source | Documented by OpenAI or Anthropic, not a listicle | Avoids copied or invented claims |
| Inspectable | Plain SKILL.md you can read in minutes | Hidden instructions are the main attack route |
| Narrow scope | One job per skill | Easier to test and to limit |
| Least privilege | Needs few tools, no open network | Limits what a bad skill can do |
| Dated | Source and version are known | Skills change and repositories move |
Two findings shaped the method. OpenAI's own openai/skills repository is now deprecated in favor of the openai/plugins repository, so older install instructions may point to the wrong place. And the same study that found skills hard to vet shows why we skip rankings: in the University of Maryland experiments, rewording a description was enough to win selection in 77.6% of paired trials.
The Best ChatGPT Skills to Install in 2026
Each skill below is documented by OpenAI or Anthropic. Where we describe what it is good at, that is our reading of the vendor's description, so test it on a sample task first. We have not run every skill against production data, and OpenAI does not publish a ranking of its curated skills.
Skill Creator
Skill Creator is the best first skill because it makes the rest. OpenAI's guide names it as the built-in creator, invoked as @skill-creator in ChatGPT Work and $skill-creator in Codex. It wins when you have a task you explain to ChatGPT every week. Its risk is low, but review what it writes before you install the result.
Plan
Plan appears among OpenAI's example skills and suits work with several steps, such as drafting a project outline or a migration checklist. Because it mostly structures thinking rather than touching systems, it needs little access. Check the SKILL.md for any commands before you rely on it.
PDF is another OpenAI example skill, aimed at working with PDF files. It wins for document-heavy roles such as legal, finance and operations. The risk is medium: skills that run scripts on files you upload deserve a read of the script folder, and files from outside your company may carry injected text.
GitHub CI repair
The gh-fix-ci skill is OpenAI's example for repairing failing GitHub checks. It wins for engineers who lose time to red builds. It also needs the most access of any skill here, because it reads logs and changes code. Run it on a branch, keep human review on and avoid giving it write access to protected branches.
Linear
Linear is the example OpenAI uses for adding a curated skill with $skill-installer. It wins when issue tracking is where your team works. It acts on an external system, so the risk comes from the connector: grant the narrowest scope that lets the skill read and create issues.
Anthropic document skills
Anthropic's skills repository includes docx, pdf, pptx and xlsx skills. They are a good reference for how a complex skill is organized, and any tool that supports the open format can read them. Two cautions apply. The README says these document skills are "source-available, not open source," and that they are provided for demonstration and educational purposes only. It also advises testing skills thoroughly in your own environment before relying on them. For Claude's enterprise context, see our notes on Claude Opus 5.5 in the enterprise.
Skills you write for your team
For most companies, the best ChatGPT skills are the ones nobody else can ship. The OpenAI Academy lists patterns by department, such as campaign-brief-builder for marketing, contract-review-summary for legal, incident-postmortem-writer for IT and exec-decision-brief for executives. You own the instructions, so you can review them, version them and limit them. If your team is also assessing newer OpenAI models, our CISO notes on GPT-6 Astra cover the security side.
Security and Governance: Poisoned Skills, Supply Chain and Least Privilege
The main security risks of ChatGPT skills are malicious or typosquatted skills, tampered updates, hidden instructions inside SKILL.md and permissions wider than the task needs. A skill is text that an agent obeys with your credentials, so treat every skill as third-party code and review it before it runs.
The evidence is recent. Snyk's ToxicSkills audit of ClawHub and skills.sh found hardcoded secrets in 10.9% of ClawHub skills and 32% of the confirmed malicious ones. The Cloud Security Alliance's May 6, 2026 research note describes SKILL.md as a context-poisoning surface, including invisible Unicode tag characters that human reviewers miss, and recommends restricted sources, hash verification and signing. The Maryland team found that a governance pipeline labeled only 68.2% of 94 malicious variants as malicious, and that context-window overflow slipped past it 87.1% of the time. Scanners help but are not a gate.
OpenAI's guidance points the same way. Its Skills in the API cookbook of February 10, 2026 says skill instructions have the same priority as other user-provided instructions, hosted shell network access is off by default, and combining skills with open network access is high-risk.
| Risk | What it looks like | OWASP mapping | Control |
|---|---|---|---|
| Malicious or typosquatted skill | A useful-looking skill that steals credentials or runs commands | LLM04 Supply Chain, ASI04 | Approved sources, hash and signature checks, internal registry |
| Injection inside SKILL.md | Overriding or hidden instructions, including invisible Unicode | LLM01 Prompt Injection | Read the whole file, strip hidden characters, test on benign tasks |
| Selection manipulation | A description tuned to beat a safer skill | LLM04 Supply Chain, ASI04 | Explicit invocation for sensitive jobs, allow_implicit_invocation: false |
| Excess permissions | A skill directs tools with more access than the task needs | LLM03 Excessive Agency, ASI02 | Least privilege, per-tool access, approvals for risky actions |
| Open network | A skill plus open egress lets data leave | LLM03 Excessive Agency | Network off by default, strict allowlists |
The mapping uses the numbering of the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications, which we explain in our guide to the agentic list. In that list ASI04 is Agentic Supply Chain Vulnerabilities and ASI02 is Tool Misuse and Exploitation.
How NeuralTrust helps
ChatGPT skills run inside OpenAI's products, so a gateway cannot read or sign the SKILL.md file itself. It can govern the model, tool and MCP traffic a skill triggers when that traffic goes through it. Agent Gateway (TrustGate) works as an MCP gateway with per-user access, per-agent and per-tool role-based access control, forwarding of end-user identity, a record of every call with cryptographic audit trails, and spend caps. Its registry lets you approve which models and MCP servers agents can reach. Agent Runtime Security (TrustGuard) inspects traffic inline for prompt injection, poisoned tool results, rogue agent calls, jailbreaks, PII and unsafe actions, and can allow, block, transform or alert. Our AI agent security guide covers the full picture.
| Layer | What it covers | What stays with you |
|---|---|---|
| Gateway | Who can reach which tools and MCP servers, limits, call records | Deciding which skills your people may install |
| Runtime inspection | Injected instructions and unsafe actions in live traffic | Reading and testing each SKILL.md |
| Your engineering | Not covered by either | Signing, sandboxing, pinning versions, removing unused skills |
Where to Start: A Decision Table
Start with the job and the access it requires, not with the longest list. A solo user trying one skill and a company rolling skills out to hundreds of employees need different first steps, so match your situation below and work down the table in order.
| Your situation | Start with | Watch out for |
|---|---|---|
| Trying skills for the first time | Skill Creator and one narrow skill of your own | Installing skills you have not read |
| Document-heavy team | PDF and a reviewed summary skill | Files that carry injected text |
| Engineering team | gh-fix-ci on a branch, with review | Write access to protected branches |
| Team tools such as issue trackers | Linear with a narrow scope | Over-broad connector permissions |
| Company-wide rollout | Admin controls, an approved list, internal skills only | Unvetted public registries |
Conclusion
The best ChatGPT skills are the ones you can read, narrow enough to test and limited to the access the job needs. Start with Skill Creator and one workflow your team repeats, then add curated skills slowly. Because skills are beta, plan eligibility and behavior can change, so recheck OpenAI's documentation. Treat every skill as third-party code, review it first and keep sensitive skills on explicit invocation.
Run AI Agents and Skills Safely with NeuralTrust
When skills start calling tools and MCP servers, the traffic needs access control, inspection and a record. Try the AI Gateway for free to put per-tool access and spend caps in front of your agents, and add runtime inspection as your skill library grows.
)
Related Reading
- Claude Code Skills
- What Is an MCP Server?
- MCP Authentication: OAuth 2.1 Done Right for AI Agents
- OWASP Top 10 for Agentic Applications 2026
- AI Agent Security: 2026 Enterprise Guide
FAQs about chatgpt skills
1. What are ChatGPT skills?
ChatGPT skills are reusable workflows packaged as a folder with a SKILL.md file that holds a name, description and instructions. ChatGPT applies a relevant skill automatically or runs the one you select with @. They can include scripts, references and assets, and they only direct tools ChatGPT can already use.
2. Which ChatGPT plans include skills?
OpenAI's Academy page calls skills an initial beta, off by default, switched on by workspace owners, and does not list plans. Secondary sources disagree, and OpenAI's help center article could not be read when we checked. Look for the Skills tab in your account and confirm eligibility with OpenAI before planning a rollout.
3. How do I install a skill in ChatGPT?
Start a chat, ask ChatGPT to build a skill, and describe the job, inputs, numbered steps, output format and quality checks. Review the draft in the modal and click Install. Then select it with @ or let ChatGPT apply it. Sharing with your workspace depends on what your admin allows.
4. Are ChatGPT skills safe to use?
Skills you write and review yourself are low risk. Public skills carry supply chain risk: Snyk found flaws in 36.82% of 3,984 scanned skills and 76 confirmed malicious payloads. Read every SKILL.md, prefer narrow skills, avoid open network access and keep sensitive skills on explicit invocation.
5. Can I use the same skill in ChatGPT and Codex?
Mostly yes. The OpenAI Academy says skills can be exported to other tools that support the Agent Skills format, including Codex. Codex loads skills from repository, user and admin folders, and $skill-installer adds curated ones. Features such as @ selection differ by product, so test the skill in each place.
6. What is the difference between a skill, a plugin and an MCP server?
A skill holds instructions for a workflow. A plugin is a distribution package that can bundle skills, MCP server connections and presentation assets. An MCP server provides data and actions through a standard protocol. A typical setup uses a skill for the steps and an MCP server for the system access.
7. How do I limit what a skill can do?
Use several layers. Set allow_implicit_invocation: false so a skill runs only when you call it, restrict who can create, share and install skills through workspace roles, keep network access off, give connectors the narrowest scope and route tool traffic through a gateway that enforces per-tool access and records every call.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- OpenAI, Build skills, accessed October 28, 2026.
- OpenAI Academy, Skills in ChatGPT, published February 25, 2026, updated September 17, 2026.
- OpenAI Cookbook, Skills in OpenAI API, February 10, 2026.
- Agent Skills, Overview, accessed October 28, 2026.
- GitHub, openai/skills README, accessed October 28, 2026.
- GitHub, anthropics/skills README, accessed October 28, 2026.
- Snyk, ToxicSkills: Malicious AI agent skills on ClawHub, February 5, 2026.
- Cloud Security Alliance, Agent Context Poisoning: SKILL.md and the New AI Supply Chain Attack Surface, May 6, 2026.
- Saha, Faghih and Feizi, University of Maryland, Under the Hood of SKILL.md: Semantic Supply-chain Attacks on AI Agent Skill Registry, arXiv 2605.11418, May 2026.
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.
)
)
)
)