OPENAI_API_KEY is named in 107 agent skills from 39 publishers. RUNCOMFY_TOKEN in 132 from 5.

There are two ways to ask whether an agent skill will cost you money, and they point at different skills. The label says 24.8% of the 4,902 skills carrying a pricing label on October 16, 2026 need your own API key. The file contents say 1,421 skills name a credential-style variable. Those sets barely overlap, and the overlap is the interesting part. Both numbers come from the Agent Skill Pricing Census, a frozen snapshot of our catalog taken on October 16, 2026. Disclosure: we run Skillselion, an independent directory of agent skills for Claude Code, Codex, Cursor and other coding agents. We are not affiliated with Anthropic, OpenAI, Cursor or any publisher named below. Two things to keep straight before any of the percentages mean anything. The catalog held 63,336 skills on October 16, 2026, and only 4,902 of them carry a pricing label, so every share below is a share of those 4,902, not of the catalog. And the labels are almost all model-assigned, not hand-audited. Treat them as a signal with a known error rate, not a ledger. Of the 4,902 priced skills, 3,450 (70.4%) are free to run, 1,215 (24.8%) are bring your own API key, 181 (3.7%) are freemium and 56 (1.1%) are paid. Put the three cost labels together and 1,452 skills cost something, of which 83.7% are the bring-your-own-key kind. So when an agent skill costs money, the money almost never goes to the skill. It goes to a model API, a scraping service, or a SaaS account you already have or are about to open. Those 1,215 bring-your-own-key skills come from 202 publishing accounts, and the largest single account publishes 89 of them. The other signal is what a skill's own documentation asks for. 15,455 skills in the snapshot have a stored documentation excerpt, usually the opening of the SKILL.md. 1,421 of them (9.2%) name a credential-style variable, across 742 distinct variable names. Here is the leaderboard from the census, skills first and publishing accounts in brackets: Variable Skills Accounts RUNCOMFY_TOKEN 132 5 OPENAI_API_KEY 107 39 API_KEY (generic placeholder) 74 40 ANTHROPIC_API_KEY 62 30 GITHUB_TOKEN 35 28 GEMINI_API_KEY 29 21 Read both columns or the ranking lies to you. RUNCOMFY_TOKEN tops the skill count, but those 132 skills come from only 5 accounts, and 56 of them are one publisher's bundle. Among variables that name an actual service, OPENAI_API_KEY reaches the most publishers at 39, and the only name that reaches more accounts is the bare placeholder API_KEY, at 40. That is the shape of the ecosystem in one table: a few publishers shipping suites against their own platform, and a long tail of independent authors who all expect an OpenAI key in your environment. The most installed skill in the snapshot that names OPENAI_API_KEY sits in both rows at once: the RunComfy codex-pet skill, 396,302 installs, names OPENAI_API_KEY and RUNCOMFY_TOKEN together, and its source is prime-skills/runcomfy-agent-skills. Its sibling in the same repo, the RunComfy video edit skill at 434,474 installs, names only the platform token. Across the independents, the same variable shows up in the LangSmith evaluator skill from langchain-ai/langsmith-skills, in the openclaw summarize skill from openclaw/openclaw, in the assistant-ui observability skill from assistant-ui/skills, and in the ECC security-review skill from affaan-m/ECC. This is the number we went looking for after the census published, and it recomputes from the public CSV in about four lines. Of the 107 skills that name OPENAI_API_KEY, 97 carry no pricing label at all. 6 are labelled bring your own API key. 4 are labelled free. The RunComfy row looks the same: 122 of the 132 are unlabelled, 10 are labelled bring your own key, none is labelled paid. So the two signals are not two measurements of one thing. The 24.8% is a statement about the labelled minority. The key names mostly sit outside it, in the 58,434 skills the census makes no pricing claim about. The census says the same thing from the other direction in its methodology: of the 763 free-labelled skills that have a stored excerpt, 50 still name a credential variable, and of the 173 bring-your-own-key skills with an excerpt, only 69 name one in the stored part of the file. Which means a missing label promises you nothing, and a free label promises slightly less than it sounds like, so read the file. The share of priced skills that need your own key depends on what the skill does. Business is highest at 43.4% of 514 priced skills, then AI at 39.4% of 834. The bottom is productivity at 11.3% of 506, and 86.8% of priced productivity skills are free to run. That ordering matches what the skills do rather than who wrote them. A business skill reaches a payment processor, a market data feed or a billing API, so a key is the job. The Microsoft Foundry skill and the Firecrawl knowledge base skill sit in the AI column for the same reason, and their sources are microsoft/azure-skills and firecrawl/firecrawl-workflows. Productivity skills mostly rearrange text and files in a repo you already have open, so there is nothing to authenticate against. Browse the two ends on the AI and agents category page and the best agent skills for AI work shortlist. Count installs instead of skills and the free share grows. The 4,902 priced skills hold 84,668,769 installs, and free skills take 89.7% of them. Bring your own key takes 7.7%, freemium 2.1%, and all 56 paid skills together take 0.5%, which is 454,127 installs. So 29.6% of priced skills carry a cost and they hold 10.3% of the installs. Installs here are cumulative registry install events, not active users and not paying customers, and a bundle install counts each bundled skill separately, which flatters suite publishers in every install share above. One number that surprised us: the median free skill has 40 installs and the median skill with any cost has 43. The cost labels do not separate popular skills from unpopular ones. They separate a long tail of free utilities from a long tail of service wrappers, and both tails look the same from the middle. The label is a starting point. The file is the answer. Three commands, in the order we run them: # 1. What credential-style names does the skill's own text ask for? grep -rnE '[A-Z0-9_]+_(API_KEY|APIKEY|API_TOKEN|ACCESS_TOKEN|SECRET_KEY|TOKEN|SECRET|KEY)' \ ~/.claude/skills/<skill>/ # 2. Which of those are already funded in your shell? env | grep -E '_(API_KEY|TOKEN|SECRET)=' # 3. What does the skill actually call? Look at the scripts, not the prose. grep -rnE 'https?://[a-z0-9.-]+' ~/.claude/skills/<skill>/ Step 2 is the one people skip. A skill does not get a wallet of its own. It reads the environment of the session that loaded it, so one funded key in your shell profile is reachable by every skill in that session, including the 97 unlabelled ones above. If you want the limits of our matching stated plainly: the pattern counts upper-case names ending in _API_KEY, _APIKEY, _API_TOKEN, _ACCESS_TOKEN, _SECRET_KEY, _TOKEN, _SECRET or _KEY. A name inside an example block counts the same as a stated requirement, and the pattern also catches publishable keys and CSRF tokens, which are not secrets. The stored excerpt keeps only the opening of each file, so a key named further down is missed. Read 1,421 as a pattern count, not a count of required keys. Every figure here recomputes from the census CSV, which is 63,336 rows and 1.0 MB gzipped, one row per skill, under CC BY 4.0. The columns are the skill id, publishing account, cumulative installs, vertical category, pricing label, excerpt length and the matched variable names, which are semicolon separated. The 97 unlabelled of 107 figure above is a groupby on two of those columns. The full report with charts and the journalist FAQ: the full Agent Skill Pricing Census report What a skill may do once it has your key: the Agent Skill Security Census and the security skills shortlist How we build these snapshots and what we will not claim from them: the Skillselion Research methodology page Live totals rather than a frozen edition: the live State of AI Agent Skills tracker and the AI agent statistics page Skillselion is a live catalog, refreshed daily from skills.sh, GitHub and MCP registries, ranked by real installs. Cite the dataset as "Skillselion Agent Skill Pricing Census, October 2026". If you maintain a skill that calls a paid service, the cheapest thing you can do for the people installing it is name the variable in the first 10 lines of your SKILL.md. 742 names across 1,421 skills is what happens when everyone picks their own, and the fix costs one line.