Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,399 skills from 2,375 repositories · updated 17 minutes ago
10,617 skills
- performing-dns-tunneling-detection26zl/cybersec-toolkitDetects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality. Uses scapy for packet capture analysis and statistical methods to distinguish legitimate DNS from covert channels. Use when hunting for data exfiltration.OtherNo warnings★ 87↓ —
- multi-module-mavenrrezartprebreza/spring-boot-skillsUse when working in a multi-module Maven project. Covers parent POM conventions, shared dependency management, inter-module rules, and build ordering.OtherReview first★ 338↓ —
- detecting-insider-threat-behaviors26zl/cybersec-toolkitDetect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.OtherNo warnings★ 87↓ —
- configuring-pfsense-firewall-rules26zl/cybersec-toolkitConfigures pfSense firewall rules, NAT policies, VPN tunnels, and traffic shaping to enforce network segmentation, control traffic flow, and protect internal network zones in enterprise and small-to-medium business environments.OtherNo warnings★ 87↓ —
- hitpay-webhookshookdeck/webhook-skillsReceive and verify HitPay event webhooks. Use when setting up HitPay webhook handlers, validating the Hitpay-Signature header (HMAC-SHA256 with the per-webhook salt), dispatching on Hitpay-Event-Object and Hitpay-Event-Type, or handling charge.created, order.created, invoice.created and transfer.paid events.OtherNo warnings★ 97↓ —
- meraki-webhookshookdeck/webhook-skillsReceive and verify Cisco Meraki Dashboard webhook alerts. Use when setting up Meraki webhook handlers, validating the sharedSecret, or handling alert events like motion_alert, settings_changed, sensor_alert, or stopped_reporting.OtherNo warnings★ 97↓ —
- implementing-siem-use-case-tuning26zl/cybersec-toolkitTune SIEM detection rules to reduce false positives by analyzing alert volumes, creating whitelists, adjusting thresholds, and measuring detection efficacy metrics in Splunk and ElasticOtherNo warnings★ 87↓ —
- detecting-pass-the-ticket-attacks26zl/cybersec-toolkitDetect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEMOtherNo warnings★ 87↓ —
- detecting-dll-sideloading-attacks26zl/cybersec-toolkitDetect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.OtherNo warnings★ 87↓ —
- conducting-pass-the-ticket-attack26zl/cybersec-toolkitPass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets froOtherNo warnings★ 87↓ —
- performing-kerberoasting-attack26zl/cybersec-toolkitKerberoasting is a post-exploitation technique that targets service accounts in Active Directory by requesting Kerberos TGS (Ticket Granting Service) tickets for accounts with Service Principal NamesOtherNo warnings★ 87↓ —
- implementing-saml-sso-with-okta26zl/cybersec-toolkitImplement SAML 2.0 Single Sign-On (SSO) using Okta as the Identity Provider (IdP). This skill covers end-to-end configuration of SAML authentication flows, attribute mapping, certificate management, aOtherNo warnings★ 87↓ —
- detecting-pass-the-hash-attacks26zl/cybersec-toolkitDetect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.OtherNo warnings★ 87↓ —
- detecting-kerberoasting-attacks26zl/cybersec-toolkitDetect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.OtherNo warnings★ 87↓ —
- processing-stix-taxii-feeds26zl/cybersec-toolkitProcesses STIX 2.1 threat intelligence bundles delivered via TAXII 2.1 servers, normalizing objects into platform-native schemas and routing them to appropriate consuming systems. Use when onboarding new TAXII collection endpoints, automating bi-directional intelligence sharing with ISACs, or building pipeline validation for malformed STIX bundles. Activates for requests involving OASIS STIX, TAXII server configuration, MISP TAXII, or Cortex XSOAR feed integrations.OtherNo warnings★ 87↓ —
- nemotron-policy-generatorNVIDIA/skillsGenerates BYO custom safety policies for NVIDIA Nemotron content-safety guardrails — Nemotron-Content-Safety-Reasoning-4B (text) and multimodal Nemotron-3-Content-Safety. Produces a Markdown policy, JSON taxonomy, and drop-in inference prompts. Maps rough words or an existing policy to V2 categories, adding custom categories or topic-following rules.OtherReview first★ 3.8K↓ —
- running-decision-processesliqiongyu/lenny_skills_plusRun a decision process end-to-end: RAPID/DACI roles, options matrix, decision log, comms.OtherNo warnings★ 52↓ —
- positioning-messagingliqiongyu/lenny_skills_plusCreate a Positioning & Messaging Pack (positioning statement, messaging hierarchy, value prop, copy set).OtherNo warnings★ 52↓ —
- defining-product-visionliqiongyu/lenny_skills_plusDefine or refresh a product vision: vision statement, narrative, pillars, strategic choices, rollout.OtherNo warnings★ 52↓ —
- running-effective-meetingsliqiongyu/lenny_skills_plusRun effective meetings: brief, agenda, facilitation script, decision log. See also: running-effective-1-1s (1:1s), running-offsites (offsites).OtherNo warnings★ 52↓ —
- post-mortems-retrospectivesliqiongyu/lenny_skills_plusRun blameless post-mortems and retrospectives: timeline, root causes, action tracker.OtherNo warnings★ 52↓ —
- marketplace-liquidityliqiongyu/lenny_skills_plusDiagnose and improve marketplace liquidity: metric tree, fragmentation map, bottleneck diagnosis.OtherNo warnings★ 52↓ —
- sales-qualificationliqiongyu/lenny_skills_plusBuild a Sales Qualification Pack (ICP, scorecard, discovery script, pipeline hygiene rules).OtherNo warnings★ 52↓ —
- energy-managementliqiongyu/lenny_skills_plusBuild an Energy Management System: drivers/drains map, energy-aligned schedule, recovery routines.OtherNo warnings★ 52↓ —
skill-compass
Evol-ai/SkillCompass
OtherUpdated Apr 23, 2026
From the author
Evaluate skill quality, find the weakest dimension, and apply directed improvements. Also tracks usage to spot idle or risky skills. Use when: first session after install, or user asks about skill quality, evaluation, inbox, suggestions, or improvement.
Install
npx skills add Evol-ai/SkillCompass --skill skill-compass -a claude-code
Installs to .claude/skills/skill-compass/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 77
Security100
Provenance68
Maintenance50
Licence100
Adoption39
Files (10)
- .gitignore
- AGENTS.md
- CHANGELOG.md
- CONTRIBUTING.md
- LICENSE
- README.md
- SECURITY.md
- SKILL.md
- package-lock.json
- package.json