Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 3 hours ago
47,307 skills
- vault-usermvschwarz/openrigUse when checking the health of this rig's HashiCorp Vault or writing, reading, listing, deleting or explaining its secrets.WritingNo warnings★ 8.3K↓ —
- comment-writerGentleman-Programming/gentle-aiWrite warm, direct collaboration comments. Trigger: PR feedback, issue replies, reviews, Slack messages, or GitHub comments.WritingNo warnings★ 8.1K↓ —Also in 1 other repo
- systemic-issue-triageGentleman-Programming/gentle-aiTrigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.OtherNo warnings★ 8.1K↓ —Also in 1 other repo
- go-testingGentleman-Programming/gentle-aiTrigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.TestingNo warnings★ 8.1K↓ —
- hive.quality-monitoraden-hive/hivePeriodically self-assess output quality to catch degradation before the judge does.OtherNo warnings★ 11.1K↓ —
- offensive-supply-chainSnailSploit/Claude-RedComprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) anDevOpsNo warnings★ 9.7K↓ —
- offensive-edr-evasionSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- judgment-dayGentleman-Programming/gentle-aiTrigger: judgment day, dual review, adversarial review, juzgar. Run explicit blind dual review with at most two scoped fix/re-judgment rounds.EngineeringNo warnings★ 8.1K↓ —
- software-for-agentsmvschwarz/openrigUse when older OpenRig instructions name software-for-agents or describe agent-in-the-middle or studio software under the former skill name.OtherNo warnings★ 8.3K↓ —
- gentle-ai-chained-prGentleman-Programming/gentle-aiTrigger: PRs over 400 lines, stacked PRs, review slices. Split oversized changes into chained PRs that protect review focus.EngineeringNo warnings★ 8.1K↓ —
- pm-specnexu-io/html-anything问题 + 成功指标 + 范围 + user stories + 设计 + 发布 + 待解决PlanningNo warnings★ 9.3K↓ —Also in 1 other repo
- delegating-workmvschwarz/openrigUse when you have a task and must decide WHO does it — yourself, a spawned subagent, or another agent in the topology that already holds the context — or how to brief the agent you hand it to, which depends on the model it runs. The rule: how much would a blank slate have to read in to do this correctly? A lot → route to a context-holding agent; a little → subagent; unsure → a real agent or yourself. NOT the mechanics of fanning out (that's dispatching-parallel-agents / subagent-driven-development) — this is the who/whether decision, and the failure mode that makes teams abandon subagents. Also use it to decide how far to trust a delegated result.ProductivityNo warnings★ 8.3K↓ —
- offensive-bug-identificationSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- gentle-ai-benchGentleman-Programming/gentle-aiTrigger: bench, journey, journeys, driven mode, gentle-ai-bench, journey corpus, j-numbers, bench axis. Author and verify gentle-ai bench journeys; go test ./bench never proves driven execution.TestingNo warnings★ 8.1K↓ —Also in 1 other repo
- learntigerless-labs/autoharnessUse when users /learn, save, remember, or distill lessons.OtherNo warnings★ 10.4K↓ —
- competitive-teardownnexu-io/html-anything定位图 + 功能矩阵 + 价格对比 + 机会窗口, 把竞品资料转成产品决策报告OtherNo warnings★ 9.3K↓ —
- verification-before-completionmvschwarz/openrigUse when about to claim work is complete, fixed, or passing, or before committing or creating PRsOtherNo warnings★ 8.3K↓ —Also in 1 other repo
- deck-guizang-editorialnexu-io/html-anything电子杂志 × 电子墨水; 10 个版面 + 5 套调色板 (墨水/靛蓝瓷/森林墨/牛皮纸/沙丘)DocumentsNo warnings★ 9.3K↓ —
- configuring-dbt-mcp-serverdbt-labs/dbt-agent-skillsGenerates MCP server configuration JSON, resolves authentication setup, and validates server connectivity for dbt. Use when setting up, configuring, or troubleshooting the dbt MCP server for AI tools like Claude Desktop, Claude Code, Cursor, or VS Code.OfficialDataNo warnings★ 747↓ —
- rdd-defect-workflowGentleman-Programming/gentle-aiTrigger: RDD, receipt-driven development, review authority, receipt/lineage, correction/recovery, delivery gate/kill switch, bounded review defects. Guide work.ProductivityNo warnings★ 8.1K↓ —Also in 1 other repo
- offensive-lorawan-sub-ghzSnailSploit/Claude-RedLoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment).DevOpsNo warnings★ 9.7K↓ —
- deck-presenter-modenexu-io/html-anythingtokyo-night 默认主题, T 切换 5 主题, S 打开提词器 popupDocumentsNo warnings★ 9.3K↓ —
- javascript-proJeffallan/claude-skillsWrites, debugs, and refactors JavaScript code using modern ES2023+ features, async/await patterns, ESM module systems, and Node.js APIs. Use when building vanilla JavaScript applications, implementing Promise-based async flows, optimising browser or Node.js performance, working with Web Workers or Fetch API, or reviewing .js/.mjs/.cjs files for correctness and best practices.BrowserNo warnings★ 12.1K↓ —
- fastapi-expertJeffallan/claude-skillsUse when building high-performance async Python APIs with FastAPI and Pydantic V2. Invoke to create REST endpoints, define Pydantic models, implement authentication flows, set up async SQLAlchemy database operations, add JWT authentication, build WebSocket endpoints, or generate OpenAPI documentation. Trigger terms: FastAPI, Pydantic, async Python, Python API, REST API Python, SQLAlchemy async, JWT authentication, OpenAPI, Swagger Python.DataNo warnings★ 12.1K↓ —
frame-data-chart-nyt
nexu-io/html-anything
OtherUpdated Oct 13, 2026
From the author
NYT-newsroom 排版 + 错峰揭示动画 + 编辑级图表 (折线/柱/范围带)
Install
npx skills add nexu-io/html-anything --skill frame-data-chart-nyt -a claude-code
Installs to .claude/skills/frame-data-chart-nyt/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance88
Maintenance100
Licence100
Adoption62
Files (3)
- SKILL.md
- example.html
- example.md