Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
9,589 skills from 286 repositories · updated 24 minutes ago
292 skills
- trailmark-finding-triagetrailofbits/skillsPerforms graph-assisted triage of a single security finding, SARIF result, weAudit annotation, suspicious function, or report excerpt using Trailmark reachability, entrypoint paths, taint, privilege-boundary, blast-radius, caller/callee, and neighborhood evidence. Use when deciding whether one candidate issue is reachable, prioritizing a finding before PoC work, preparing evidence for exploit validation, or checking whether a static-analysis result is actionable.SecurityNo warnings★ 7.7K↓ —
- mcp-atlassian-cve-2026-27825cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecurityNo warnings★ 2.6K↓ —
- flowise-cve-2025-59528cisco-ai-defense/skill-scannerSecurity Scanner for Agent SkillsSecurityNo warnings★ 2.6K↓ —
- firebase-apk-scannertrailofbits/skillsScans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.SecurityNo warnings★ 7.7K↓ —
- post-patch-validationtrailofbits/skillsValidates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly introduced security failures. Use after a patch exists and before accepting, merging, or reporting it as fixed; also use when an AI-generated patch, remediation commit, pull request, or proposed upstream fix needs adversarial post-patch validation across any language.SecurityNo warnings★ 7.7K↓ —
- burpsuite-project-parsertrailofbits/skillsSearches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.SecurityNo warnings★ 7.7K↓ —
- offensive-anti-forensicsSnailSploit/Claude-RedAnti-forensics and evidence destruction techniques for red team operators conducting authorized engagements. Covers log clearing on Windows (wevtutil, Clear-EventLog, ETW provider patching) and Linux (journal truncation, utmp/wtmp binary editing, syslog manipulation), timestamp manipulation via Timestomp and SetMACE to defeat timeline analysis, filesystem-level anti-forensics including NTFS Alternate Data Streams for payload hiding and secure deletion with sdelete/shred, memory artifact removal to counter live forensics, disk artifact manipulation targeting MFT entries and USN journal records, network forensics evasion through encrypted C2 channels and DNS-over-HTTPS tunneling, and anti-VM/sandbox detection to avoid dynamic analysis environments. Tools: Timestomp, wevtutil, sdelete, shred, MimiPenguin, Invoke-Phant0m. Aligns to MITRE ATT&CK T1070 (Indicator Removal), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion). Each technique includes the forensic artifact it targets, the dSecurityReview first★ 7.7K↓ —
- offensive-api-securitySnailSploit/Claude-RedComprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.SecurityReview first★ 7.7K↓ —
- hunt-xxeelementalsouls/Claude-BugHunterHunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.SecurityReview first★ 5.2K↓ —
- amazon-competitor-analyzerbrowser-act/skillsScrapes Amazon product data from ASINs using browseract.com automation API and performs surgical competitive analysis. Compares specifications, pricing, review quality, and visual strategies to identify competitor moats and vulnerabilities.SecurityNo warnings★ 6.2K↓ —
- hunt-domelementalsouls/Claude-BugHunterHunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin check), Service Worker abuse (intercept requests from same-origin script), CSS Injection/Exfiltration (attribute selectors → token char-by-char via OOB), client-side template injection, dangerouslySetInnerHTML. Grounded in named public research: Gareth Heyes / PortSwigger DOM-clobbering + DOM-Invader, Michał Bentkowski DOMPurify clobbering bypasses, jQuery htmlPrefilter XSS (CVE-2020-11022 / CVE-2020-11023), d0nut CSS-exfil research. Use when hunting DOM-XSS, client-side auth bypass, or token exfiltration without server-side interaction.SecurityReview first★ 5.2K↓ —
- validator-expertjeremylongshore/tons-of-skills-marketplaceValidate production readiness of Vertex AI Agent Engine deployments across security, monitoring, performance, compliance, and best practices. Generates weighted scores (0-100%) with actionable remediation plans. Use when asked to validate a deployment, run a production readiness check, audit security posture, or verify compliance for Vertex AI agents. Trigger with "validate deployment", "production readiness", "security audit", "compliance check", "is this agent ready for prod", "check my ADK agent", "review before deploy", or "production readiness check". Make sure to use this skill whenever validating ADK agents for Agent Engine.SecurityNo warnings★ 2.9K↓ —
- fuzzing-apisjeremylongshore/tons-of-skills-marketplaceConfigure perform API fuzzing to discover edge cases, crashes, and security vulnerabilities. Use when performing specialized testing. Trigger with phrases like "fuzz the API", "run fuzzing tests", or "discover edge cases".SecurityNo warnings★ 2.9K↓ —
- securityparcadei/Continuous-Claude-v3Security audit workflow - vulnerability scan → verificationSecurityNo warnings★ 3.9K↓ —
- hunt-websocketelementalsouls/Claude-BugHunterHunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.SecurityReview first★ 5.2K↓ —
- releaseparcadei/Continuous-Claude-v3Release preparation workflow - security audit → E2E tests → review → changelog → docsSecurityNo warnings★ 3.9K↓ —
- hunt-xsselementalsouls/Claude-BugHunterHunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.SecurityReview first★ 5.2K↓ —
- artifact-validatorjeremylongshore/tons-of-skills-marketplaceDiscover and validate Agent Skills, host plugins and subagents, MCP servers and configurations, hooks, and marketplace catalogs against the correct authority. Use when performing pre-merge review, external submission checks, portability audits, security checks, or validation of mixed agent-system repositories. Trigger with "validate this skill", "audit this plugin", "check this agent", "review this MCP config", or "is this marketplace ready".SecurityNo warnings★ 2.9K↓ —
- simple-formattercisco-ai-defense/skill-scannerFormats text according to specified style guidelines. A clean example skill with no security issues.SecurityNo warnings★ 2.6K↓ —
- production-upgradejeremylongshore/tons-of-skills-marketplaceUpgrade an existing skill, plugin, agent, MCP integration, or agent-system package to a security-first production standard using pain research, architecture decisions, migration planning, deterministic implementation, adversarial tests, independent review, and revision-bound evidence. Use when modernizing a legacy capability or asking for Databricks-level diligence. Trigger with "production upgrade", "modernize this skill", "bring this pack to production quality", or "audit and rebuild this plugin".SecurityNo warnings★ 2.9K↓ —
- offensive-xxeSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityReview first★ 7.7K↓ —
- website-rebuildboyang-hu/website-rebuild-skill1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites). Evidence-driven pipeline - mirror-first forensics, line-number-traceable reverse engineering of minified bundles, verbatim porting, quantitative verification gates. Use when user asks to "复刻网站", "重建网站", "1:1 rebuild", "clone this site", or provides a URL of a creative/award site to reproduce.SecurityNo warnings★ 1.5K↓ —
- mcp-auditrohitg00/pro-workflowAudit connected MCP servers for token overhead, redundancy, and security. Use when sessions feel slow or before adding new MCPs.SecurityNo warnings★ 2.9K↓ —
- j-spaceTiger3807861189/J-Space-Cognition-SuiteOperate a selective workspace for complex reasoning, long tasks, repository engineering, coordinated agents, and authorized security analysis. Use when work requires durable state, evidence, cross-file consistency, or recovery; keep direct answers lightweight.SecurityNo warnings★ 3K↓ —