Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,283 skills from 2,272 repositories · updated 28 minutes ago
10,066 skills
- 示例分章JimLiu/baocut测试用的 craft：分章节。OtherNo warnings★ 1.6K↓ —
- press-mediarshankras/claude-code-apple-skillsGet press coverage and media attention for your indie app. Covers press kit preparation, finding journalists/bloggers/YouTubers, pitch timing, embargo strategy, and story angles that get coverage. Use when user wants press coverage, is preparing for a launch, or wants to build a media kit.OtherNo warnings★ 837↓ —
- wiki-arsenalEncod3d-Sec/TORCHFast PARALLEL wiki lookup engine over wiki/techniques + wiki/payloads + wiki/tools + wiki/cheatsheets for a surface/service/vuln-class. Two modes - quick (one qmd search, cheap, fire constantly) and deep (4 parallel subagents, one per area, merged ready-to-use arsenal card, cached). This is the fast path arsenal that `arsenal` delegates to; the hunt-* skills each inline their own qmd_query and can hand off here for a parallel lookup. Use for "what do I use against <surface>", "arsenal for <X>", "deep/full arsenal", "tool + payload + technique + cheatsheet for <X>", "fast wiki lookup", "parallel wiki search", any "how do I attack/exploit <service|vuln-class>" where you want the documented tooling + payloads before hand-rolling.OtherNo warnings★ 336↓ —
- rechenblattThomasMoreAI/legal-skills-openFür JVEG-Rechenblatt: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 95↓ —
- hunt-sqliEncod3d-Sec/TORCHSQLi and NoSQLi hunting - error-based, boolean-blind, time-based, UNION, NoSQL operator injection. sqlmap automation after manual confirmation. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- app-cliprshankras/claude-code-apple-skillsGenerates App Clip targets with invocation URL handling, lightweight experiences, and full app upgrade prompts. Use when user wants NFC/QR/Safari banner invocation, instant app experiences, or App Clip Card setup.OtherNo warnings★ 837↓ —
- wikiEncod3d-Sec/TORCHSearch, query, and maintain the qmd-indexed wiki - semantic search, keyword search, re-index after adding pages, check index status.OtherNo warnings★ 336↓ —
- ai-inference-service-meshBagelHole/DevOps-Security-Agent-SkillsUse service mesh patterns for AI inference traffic management, mTLS, canary releases, policy enforcement, and cross-cluster resilience.OtherNo warnings★ 1.2K↓ —
- hunt-authEncod3d-Sec/TORCHAuth bypass and ATO hunting - legacy protocol matrix (XMLRPC, SharePoint /_vti_bin/, EWS, Citrix, etc.), JWT manipulation, password reset poisoning, SAML auth bypass, session fixation. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- unconstrained-file-readercisco-ai-defense/skill-scannerRead a caller-selected path without confining it to a safe rootOtherNo warnings★ 2.7K↓ —
- hunt-mcpEncod3d-Sec/TORCHMCP server attack hunting - tool poisoning, indirect prompt injection via tool output, rug-pull updates, cross-tool shadowing, over-permissioned/excessive-agency tools, lethal trifecta. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- claude-md-improverEncod3d-Sec/TORCHOFFLINE FALLBACK for the claude-md-management plugin - prefer that plugin when it is installed. Audit and improve CLAUDE.md files - scan for CLAUDE.md files, evaluate quality against templates, output a report, then make targeted updates. Invoke explicitly (/claude-md-improver) when the plugin is unavailable.OtherNo warnings★ 336↓ —
- evidenceEncod3d-Sec/TORCHEvidence hygiene before any FIND moves to Completed or enters a report. Cookie redaction, PII black-bar, HAR sanitization, screenshot metadata strip. Run after /triage passes and before final report assembly.OtherNo warnings★ 336↓ —
- hunt-smugglingEncod3d-Sec/TORCHHTTP request smuggling / desync hunting - CL.TE, TE.CL, TE.TE, CL.0, and HTTP/2 downgrade. Timing-based detection, differential confirmation, no-blind-claims. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- firebase-app-platformBagelHole/DevOps-Security-Agent-SkillsBuild and operate apps on Firebase using Auth, Firestore, Cloud Functions, and Hosting. Use when building mobile/web backends with managed services, real-time data sync, or serverless APIs.OtherNo warnings★ 1.2K↓ —
- hunt-uploadEncod3d-Sec/TORCHFile upload attack hunting - extension/content-type/magic-byte bypass to web-shell RCE, path traversal in filename, SVG/XML XSS, zip slip, and pixel-flood DoS. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- redteamleadEncod3d-Sec/TORCHOn-demand senior red-team lead advisor. Call at a decision point or obstacle to get wiki-grounded direction instead of hammering blindly. Dispatches a fresh RTL subagent that reads the engagement state + evidence + wiki and returns ranked directions with an explicit STOP. Use for "redteamlead", "RTL", "I'm stuck", "where do I go", "what next", "which vector", "should I keep hammering this".OtherNo warnings★ 336↓ —
- next-moveEncod3d-Sec/TORCHRanked next offensive moves from engagement state. Reads state/loot/Killchain, runs the deterministic analyzer, elaborates the top move. Use when asked "what next", "where to focus", "prioritize", or at the start of an engagement session.OtherNo warnings★ 336↓ —
- verjaehrung-fristenThomasMoreAI/legal-skills-openFür Verjährung, Dringlichkeit und Fristen: prüft Frist, Form, Zuständigkeit und Eilbedarf; Ergebnis: Fristen- und Risikoampel.OtherNo warnings★ 95↓ —
- cp-skill-validatezby/commonplaceRun deterministic validation on KB artifacts, collections, collection landings, and the published redirect map, including schemas, links, required sections, and batch signals.OtherNo warnings★ 92↓ —
- hunt-cacheEncod3d-Sec/TORCHWeb cache poisoning + cache deception hunting - unkeyed input poisoning, cache-key analysis, path-confusion deception, header/parameter cloaking. Wiki-first, FIND schema output.OtherNo warnings★ 336↓ —
- alignfirstpaleo/alignfirstCollaborative problem-solving protocols. Read when the user names AlignFirst or a protocol alias: alspec, alplan, AAD, alcatchup, alcatchupaad, alcatchupspec, almerge, alreview, or aldescription.OtherNo warnings★ 87↓ —
- lernplanThomasMoreAI/legal-skills-openFür Staatsexamen-Lernplan: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 95↓ —
- incident-managementBagelHole/DevOps-Security-Agent-SkillsImplement incident management processes and escalation procedures. Configure on-call schedules and post-incident reviews. Use when managing production incidents.OtherNo warnings★ 1.2K↓ —
incident-management
BagelHole/DevOps-Security-Agent-Skills
OtherUpdated May 22, 2026
From the author
Implement incident management processes and escalation procedures. Configure on-call schedules and post-incident reviews. Use when managing production incidents.
Install
npx skills add BagelHole/DevOps-Security-Agent-Skills --skill incident-management -a claude-code
Installs to .claude/skills/incident-management/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 83
Security100
Provenance77
Maintenance70
Licence100
Adoption50
Files (1)
- SKILL.md