Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 6 hours ago
9,541 skills
- no-confirmation-agentcisco-ai-defense/skill-scannerDirect the agent to act while bypassing user confirmationOtherNo warnings★ 2.7K↓ —
- sensitive-file-readercisco-ai-defense/skill-scannerRead a sensitive operating-system credential file for diagnosticsOtherNo warnings★ 2.7K↓ —
- hylo-setupskoowoo/hyloWalks the user through setting up Hylo itself in chat, one step at a time, and picks up where they left off. Use only when told to run hylo-setup (the first chat after onboarding is), or when the user explicitly asks to set up, continue or redo the setup of Hylo, e.g. 'continue Hylo setup', 'run Hylo setup again', '继续 Hylo 设置', '重新运行 Hylo 设置'. Do not use for setting up anything else (a tool, project, bot or app), for one-off changes like adding a bot or trigger, or for questions about how Hylo works.OtherNo warnings★ 101↓ —
- holdings-comparisoncxcscmu/SkillLearnBenchCompare fund holdings between two quarters (Q2 vs Q3) to identify increased/decreased positions by dollar value or share count.OtherNo warnings★ 91↓ —
- openhraAAaqwq/AGI-Super-TeamBoss直聘全流程AI自动化招聘智能体。自动登录、筛选候选人、个性化打招呼、智能聊天跟进、简历解析、飞书同步。触发词：启动招聘、自动打招呼、boss greet、openhr、简历解析、上传飞书。OtherNo warnings★ 112↓ —
- data-matchingcxcscmu/SkillLearnBenchMatching observation data to simulation output with exact datetime and depth binningOtherNo warnings★ 91↓ —
- glm-simulationcxcscmu/SkillLearnBenchRunning the General Lake Model (GLM) with configuration files and parameter calibrationOtherNo warnings★ 91↓ —
- search-engine-expertroedyrustam/vibes-plugFull-text search engines: Typesense, Meilisearch, and Elasticsearch / Mesin pencarian full-text: Typesense, Meilisearch, Elasticsearch.OtherNo warnings★ 115↓ —
- to-clarifyGulajavaMinistudio/awesome-copilot-idRecurring Checkpoint of the Pólya Heuristic Coder: Condition Sanity Check, 5-Axis Assumptions Interrogation, Epistemic Doubt, Grill-Me Protocol with concrete A/B options, and Readiness Scoring (0-100) (docs/audit/{slug}-{phase}-clarification.md).OtherNo warnings★ 91↓ —
- encoded-tag-markercisco-ai-defense/skill-scannerContain an encoded Unicode Tag Block marker used for hidden instructionsOtherNo warnings★ 2.7K↓ —
- ardot-usebalabalabalading/huuuuuuho-skills**强制性前置条件** — 每次调用 `batch_edit` 工具之前，必须先调用此技能。 未经加载此技能，绝不能直接调用 `batch_edit`。 当用户想要在 Ardot 设计文件中创建、更新、移动或删除节点时触发 — 例如插入框架、文本、形状、组件；将变量绑定到填充/描边； 构建屏幕、组件或设计库。当涉及 batch_edit DSL 操作时也加载 （I/U/M/D/C/G 操作符）。OtherNo warnings★ 118↓ —
- data-exfiltratorcisco-ai-defense/skill-scannerAnalyzes data filesOtherNo warnings★ 2.7K↓ —
- sec-13f-analysiscxcscmu/SkillLearnBenchParse and analyze SEC 13-F filing TSV datasets to extract AUM, holdings count, and fund details by accession number.OtherNo warnings★ 91↓ —
- zero-to-prod-orchestratorroedyrustam/vibes-plugMaster orchestrator to build apps from zero to production readiness / Master orkestrator membangun aplikasi dari nol hingga siap produksi.OtherNo warnings★ 115↓ —
- alterlab-umapAlterLab-IEU/AlterLab-Academic-SkillsNonlinear dimensionality reduction with UMAP — fast manifold learning for 2D/3D visualization, clustering preprocessing (e.g., HDBSCAN), and supervised or parametric UMAP. Use when projecting high-dimensional data to low dimensions for visualization, embedding generation, or as a preprocessing step before clustering. Part of the AlterLab Academic Skills suite.OtherNo warnings★ 78↓ —
- zhangyi-relayaph199686/zhangyi-studio张翼接力：跨会话的项目连续性管理。新会话开局生成交接提示词（开场白九模块）、核验上一会话遗留状态、每批工作收尾时沉淀交接段（遗留待办/新红线/新环境坑）。Use when the user starts a new session to continue existing work, asks to sync project status, wants a handoff/continuation prompt, or finishes a batch of work. 用户开新会话继续旧项目、需要交接提示词、同步项目进度、或一批工作收尾时使用。不限于游戏项目。OtherNo warnings★ 119↓ —
- ctf-web26zl/cybersec-toolkitUse when solving a CTF web challenge — SQLi, XSS, SSRF, SSTI, IDOR, auth bypass, file upload, deserialization, prototype pollution, race conditions, JWT attacks. Provides a decision tree and tool stack from this installer's web module. Triggers on "ctf web", "web challenge", "sqli", "xss", "ssti", "ssrf", "jwt".OtherNo warnings★ 85↓ —
- skeptical-triageavelikiy/great_ctoReusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of ~4 extra LLM turns.OtherNo warnings★ 108↓ —
- hunt-sqliEncod3d-Sec/TORCHSQLi and NoSQLi hunting - error-based, boolean-blind, time-based, UNION, NoSQL operator injection. sqlmap automation after manual confirmation. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- app-cliprshankras/claude-code-apple-skillsGenerates App Clip targets with invocation URL handling, lightweight experiences, and full app upgrade prompts. Use when user wants NFC/QR/Safari banner invocation, instant app experiences, or App Clip Card setup.OtherNo warnings★ 840↓ —
- press-mediarshankras/claude-code-apple-skillsGet press coverage and media attention for your indie app. Covers press kit preparation, finding journalists/bloggers/YouTubers, pitch timing, embargo strategy, and story angles that get coverage. Use when user wants press coverage, is preparing for a launch, or wants to build a media kit.OtherNo warnings★ 840↓ —
- wiki-arsenalEncod3d-Sec/TORCHFast PARALLEL wiki lookup engine over wiki/techniques + wiki/payloads + wiki/tools + wiki/cheatsheets for a surface/service/vuln-class. Two modes - quick (one qmd search, cheap, fire constantly) and deep (4 parallel subagents, one per area, merged ready-to-use arsenal card, cached). This is the fast path arsenal that `arsenal` delegates to; the hunt-* skills each inline their own qmd_query and can hand off here for a parallel lookup. Use for "what do I use against <surface>", "arsenal for <X>", "deep/full arsenal", "tool + payload + technique + cheatsheet for <X>", "fast wiki lookup", "parallel wiki search", any "how do I attack/exploit <service|vuln-class>" where you want the documented tooling + payloads before hand-rolling.OtherNo warnings★ 336↓ —
- simple-mathcisco-ai-defense/skill-scannerPerform basic arithmetic using a direct operator implementationOtherNo warnings★ 2.7K↓ —
- wikiEncod3d-Sec/TORCHSearch, query, and maintain the qmd-indexed wiki - semantic search, keyword search, re-index after adding pages, check index status.OtherNo warnings★ 336↓ —
hunt-auth
Encod3d-Sec/TORCH
OtherUpdated Sep 1, 2026
From the author
Auth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output.
Install
npx skills add Encod3d-Sec/TORCH --skill hunt-auth -a claude-code
Installs to .claude/skills/hunt-auth/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 83
Security100
Provenance70
Maintenance85
Licence100
Adoption42
Files (1)
- SKILL.md