Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 15 minutes ago
47,307 skills
- serving-llms-vllmOrchestra-Research/AI-Research-SKILLsServes LLMs with high throughput using vLLM's PagedAttention and continuous batching. Use when deploying production LLM APIs, optimizing inference latency/throughput, or serving models with limited GPU memory. Supports OpenAI-compatible endpoints, quantization (GPTQ/AWQ/FP8), and tensor parallelism.DevOpsNo warnings★ 14K↓ —
- obsidian-markdownAgriciDaniel/claude-obsidianExplain, draft, or validate Obsidian Flavored Markdown syntax: properties, wikilinks, embeds, callouts, tags, comments, highlights, block references, math, and Mermaid. Use when the user explicitly requests Obsidian note formatting or syntax help, not for general Markdown or broad vault operations.ProductivityNo warnings★ 15.9K↓ —
- azure-mgmt-botservice-pymicrosoft/skillsAzure Bot Service Management SDK for Python. Use for creating, managing, and configuring Azure Bot Service resources. Triggers: "azure-mgmt-botservice", "AzureBotService", "bot management", "conversational AI", "bot channels".OfficialDevOpsNo warnings★ 3.2K↓ —
- hupu-uploadNewdreammis/social-auto-upload使用 social-auto-upload 的 `sau hupu` 登录虎扑并发布视频，可指定封面。Use when 用户要向虎扑发布视频或检查虎扑账号状态。OtherNo warnings★ 15.9K↓ —
- weibo-uploadNewdreammis/social-auto-upload使用 social-auto-upload 的 `sau weibo` 登录微博并发布视频，可指定封面。Use when 用户要向微博发布视频或检查微博账号状态。OtherNo warnings★ 15.9K↓ —
- azure-communication-sms-javamicrosoft/skillsSend SMS messages with Azure Communication Services SMS Java SDK. Use when implementing SMS notifications, alerts, OTP delivery, bulk messaging, or delivery reports.OfficialDevOpsNo warnings★ 3.2K↓ —
- azure-ai-anomalydetector-javamicrosoft/skillsBuild anomaly detection applications with Azure AI Anomaly Detector SDK for Java. Use when implementing univariate/multivariate anomaly detection, time-series analysis, or AI-powered monitoring.OfficialDevOpsNo warnings★ 3.2K↓ —
- azure-keyvault-secrets-rustmicrosoft/skillsAzure Key Vault Secrets library for Rust. Store and retrieve secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust", "list secrets rust".OfficialDevOpsNo warnings★ 3.2K↓ —
- paper-poster-htmlwanshuiyin/Auto-claude-code-research-in-sleepDEFAULT poster pipeline — build an academic conference poster (ICML/NeurIPS/ICLR/CVPR/...) as a single HTML/CSS file with measurement-driven hard gates, real paper figures, a two-hue design-token system, and print-ready PDF via headless Chromium. Use when the user says "做海报", "poster", "conference poster", "paper poster", or asks to design/redo a research poster.ScienceNo warnings★ 18.2K↓ —
- podmansickn33/agentic-awesome-skillsManage containers using Podman, the daemonless container engine.OtherNo warnings★ 48.7K↓ —
- feishu-notifywanshuiyin/Auto-claude-code-research-in-sleepSend notifications to Feishu/Lark. Internal utility used by other skills, or manually via /feishu-notify. Use when user says "发飞书", "notify feishu", or other skills need to send status updates.OtherNo warnings★ 18.2K↓ —
- azure-compliancemicrosoft/skillsRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.OfficialDevOpsNo warnings★ 3.2K↓ —Also in 2 other repos
- seo-vs-adsRyze-AI-Adgent/open-seo-mcp-skillsFind money leaking between search ads and SEO — queries you pay for while already ranking organically, and paid queries with no organic coverage. Use when asked "am I paying for clicks I'd get free", "brand bidding waste", "SEO vs ads overlap", or "cut wasted ad spend with SEO".MarketingNo warnings★ 7.7K↓ —
- cognitive-doc-designGentleman-Programming/gentle-aiDesign docs that reduce cognitive load. Trigger: writing guides, READMEs, RFCs, onboarding, architecture, or review-facing docs.DesignNo warnings★ 8.1K↓ —Also in 1 other repo
- kibana-alerting-ruleselastic/agent-skillsCreate and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.OfficialOtherNo warnings★ 602↓ —Also in 1 other repo
- observability-k8s-investigationelastic/agent-skillsInvestigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT). Use when diagnosing pod failures (CrashLoopBackOff, OOMKilled, Error), node pressure, resource exhaustion, image pull failures, admission rejections, autoscaling anomalies, or correlating K8s state with application signals. OTel ingest path only — the legacy ECS Kubernetes integration shape is out of scope.OfficialDevOpsNo warnings★ 602↓ —Also in 1 other repo
- using-git-worktreesjnMetaCode/superpowers-zh当需要开始与当前工作区隔离的功能开发，或在执行实现计划之前使用——通过原生工具或 git worktree 回退机制确保隔离工作区存在EngineeringNo warnings★ 8.4K↓ —
- hive.quality-monitoraden-hive/hivePeriodically self-assess output quality to catch degradation before the judge does.OtherNo warnings★ 11.1K↓ —
- django-storages-s3Jeffallan/claude-skillsUse when configuring Django to store static and media files on AWS S3 with django-storages. Invoke when working with the STORAGES setting, S3 buckets, presigned URLs, CloudFront, or boto3-backed file storage in settings.py. Configures the Django 4.2+ STORAGES dict, public/private custom backends, presigned GET/POST URLs, IAM policies, and S3 mocking for tests. Trigger terms: django-storages, S3, boto3, S3Boto3Storage, STORAGES, presigned URL, CloudFront, media files, collectstatic, AWS_STORAGE_BUCKET_NAME.TestingNo warnings★ 12.1K↓ —
- ads-testAgriciDaniel/claude-adsDesign and evaluate paid-ad experiments with hypotheses, randomization units, sample-size and duration assumptions, guardrails, platform experiment tools, analysis, and decision rules. Use for A/B test, split test, experiment design, hypothesis, statistical significance, sample size, test duration, or experiment readout.TestingNo warnings★ 10.5K↓ —Also in 2 other repos
- elasticsearch-ingestUpdatedelastic/agent-skillsLoad CSV, JSON, and NDJSON files into Elasticsearch indices using the bulk API and explicit mappings when field types matter. Use when batch-importing local files, converting CSV rows or JSON arrays to NDJSON bulk format, confirming cluster connectivity with elastic es info before ingest, or verifying document counts and mappings after ingest — not for Logstash pipelines, Beats, custom scripts, or index-to-index reindex.OfficialDataNo warnings★ 602↓ —Also in 1 other repo
- work-unit-commitsGentleman-Programming/gentle-aiPlan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.TestingNo warnings★ 8.1K↓ —
- pricing-pagenexu-io/html-anything三档定价 + 特性对比表 + FAQOtherNo warnings★ 9.3K↓ —
- cloud-onboardingelastic/agent-skillsOnboard an Elastic Cloud organization: configure the `elastic` CLI's Cloud context and API key, establish a default region, then invite users, assign predefined or custom Serverless project roles, and create or revoke Cloud API keys. Use when setting up Cloud authentication or when granting, modifying, or auditing user access to an organization and its projects.OfficialEngineeringNo warnings★ 602↓ —Also in 1 other repo
offensive-business-logic
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-business-logic -a claude-code
Installs to .claude/skills/offensive-business-logic/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md