Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
9,589 skills from 286 repositories · updated 15 minutes ago
292 skills
- web-securitya5c-ai/babysitterOWASP Top 10, security headers, CSP, XSS prevention, and vulnerability prevention.SecurityNo warnings★ 1.9K↓ —
- constitution-creationa5c-ai/babysitterEstablish project governing principles including dev guidelines, code quality standards, testing policies, UX requirements, performance benchmarks, and security constraints.SecurityNo warnings★ 1.9K↓ —
- expressa5c-ai/babysitterExpress.js middleware patterns, routing, error handling, security, and production best practices.SecurityNo warnings★ 1.9K↓ —
- security-hardeninga5c-ai/babysitterAIDefence security layer with prompt injection blocking, input validation, sandboxed execution, output sanitization, and STRIDE threat modeling.SecurityNo warnings★ 1.9K↓ —
- security-reviewa5c-ai/babysitterSecurity vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.SecurityNo warnings★ 1.9K↓ —
- cspa5c-ai/babysitterContent Security Policy configuration, nonces, and reporting.SecurityNo warnings★ 1.9K↓ —
- thinking-red-teamtjboudreaux/cc-thinking-skillsFor authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.SecurityNo warnings★ 1.7K↓ —
- jwta5c-ai/babysitterJWT implementation, token management, refresh patterns, and security.SecurityNo warnings★ 1.9K↓ —
- Burp Suite/Web Security Skilla5c-ai/babysitterWeb application security testing with Burp Suite integrationSecurityNo warnings★ 1.9K↓ —
- repo-auditzebbern/claude-code-guideDeep analysis of Git history: identify frequently changed hotspot files, analyze code ownership by contributor, and scan for leaked secrets. Triggered when users ask about Git analysis, code hotspots, who owns what code, secret scanning, security audits of commit history, or optimizing code review assignments.SecurityNo warnings★ 4.7K↓ —
- audit-flowzebbern/claude-code-guideInteractive system flow tracing across CODE, API, AUTH, DATA, NETWORK layers with SQLite persistence and Mermaid export. Use for security audits, compliance documentation, flow tracing, feature ideation, brainstorming, debugging, architecture reviews, or incident post-mortems. Triggers on audit, trace flow, document flow, security review, debug flow, brainstorm, architecture review, post-mortem, incident review.SecurityNo warnings★ 4.7K↓ —
- memory-forensicswshobson/agentsMaster memory forensics techniques including memory acquisition, process analysis, and artifact extraction using Volatility and related tools. Use when analyzing memory dumps, investigating incidents, or performing malware analysis from RAM captures.SecurityReview first★ 41.4K↓ —
- cs-skillsbrycewang-stanford/Auto-Empirical-Research-Skills10 computer science skills. Trigger: algorithms, systems research, software engineering, security papers. Design: theory, complexity analysis, code-centric research, and security methods.SecurityNo warnings★ 4.7K↓ —
- mcpwn-cve-2026-33032cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecurityNo warnings★ 2.6K↓ —
- verification-gatesrohitg00/skillkitCreates explicit validation checkpoints (verification gates) between project phases to catch errors early and ensure quality before proceeding. Use when the user asks about quality gates, milestone checks, phase transitions, approval steps, go/no-go decision points, or preventing cascading errors across a multi-step workflow. Produces acceptance criteria checklists, automated CI gate configurations, manual sign-off requirements, and conditional review rules for scenarios such as security changes, API changes, or database migrations.SecurityNo warnings★ 1.6K↓ —
- find-skillsrohitg00/skillkitDiscovers, searches, and installs skills from multiple AI agent skill marketplaces (400K+ skills) using the SkillKit CLI. Supports browsing official partner collections (Anthropic, Vercel, Supabase, Stripe, and more) and community repositories, searching by domain or technology, and installing specific skills from GitHub. Use when the user wants to find, browse, or install new agent skills, plugins, extensions, or add-ons; asks 'is there a skill for X' or 'find a skill for X'; wants to explore a skill store or marketplace; needs to extend agent capabilities in areas like React, testing, DevOps, security, or APIs; or says 'browse skills', 'search skill marketplace', 'install a skill', or 'what skills are available'.SecurityNo warnings★ 1.6K↓ —
- ctf-pwnljagiello/ctf-skillsProvides binary exploitation techniques for CTF challenges. Use when you already have a vulnerable native target or service and need to turn memory corruption or low-level primitives into code execution or privilege escalation, such as buffer overflows, format strings, heap bugs, ROP, ret2libc, shellcode, kernel exploitation, seccomp bypass, sandbox escape, or Windows/Linux exploit chains. Do not use it when the main blocker is understanding what the binary does; use reverse engineering first. Do not use it for pure web bugs, disk or packet forensics, or standalone crypto/math challenges.SecurityNo warnings★ 3.5K↓ —
- ctf-webljagiello/ctf-skillsProvides web exploitation techniques for CTF challenges. Use when the target is primarily an HTTP application, API, browser client, template engine, identity flow, or smart-contract frontend/backend surface, including XSS, SQLi, SSTI, SSRF, XXE, JWT, auth bypass, file upload, request smuggling, OAuth/OIDC, SAML, prototype pollution, and similar web bugs. Do not use it for native binary memory corruption, reverse engineering of standalone executables, disk or memory forensics, or pure cryptanalysis unless the web flaw is still the main path to the flag.SecurityNo warnings★ 3.5K↓ —
- mermaid-to-proveriftrailofbits/skillsTranslates Mermaid sequenceDiagrams describing cryptographic protocols into ProVerif formal verification models (.pv files). Use when generating a ProVerif model, formally verifying a protocol, converting a Mermaid diagram to ProVerif, verifying protocol security properties (secrecy, authentication, forward secrecy), checking for replay attacks, or producing a .pv file from a sequence diagram.SecurityNo warnings★ 7.7K↓ —
- graph-evolutiontrailofbits/skillsCompares Trailmark code graphs at two source code snapshots (git commits, tags, or directories) to surface security-relevant structural changes. Detects new attack paths, complexity shifts, blast radius growth, taint propagation changes, and privilege boundary modifications that text diffs miss. Use when comparing code between commits or tags, analyzing structural evolution, detecting attack surface growth, reviewing what changed between audit snapshots, or finding security-relevant changes that text diffs miss.SecurityNo warnings★ 7.7K↓ —
- codeqltrailofbits/skillsScans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "find vulnerabilities in this repo". Covers Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, and Swift. Supports "run all" (security-and-quality + security-experimental) and "important only" (high-precision) scan modes, and creates data extension models for project-specific sources and sinks. For fast single-file pattern matching, or when no build is available for a compiled language, use the semgrep skill; to parse SARIF that already exists rather than produce it, use the sarif-parsing skill.SecurityNo warnings★ 7.7K↓ —
- semgreptrailofbits/skillsRuns a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.SecurityNo warnings★ 7.7K↓ —
- atr-benign-controlcisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecurityNo warnings★ 2.6K↓ —
- yara-rule-authoringtrailofbits/skillsGuides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules. Covers naming conventions, string selection, performance optimization, migration from legacy YARA, and false positive reduction. Triggers on: YARA, YARA-X, malware detection, threat hunting, IOC, signature, crx module, dex module.SecurityNo warnings★ 7.7K↓ —