Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 2 hours ago
47,307 skills
- forming-an-openrig-mental-modelmvschwarz/openrigUse when the system around you does not make sense yet: you just booted into a seat and do not know how the pieces fit; someone said rig, pod, seat, fleet, topology, or slice and you are not certain what they mean here; you are unsure what kind of rig you are in or what it is for; you do not know how skills reach you or where context comes from; or you are about to act on a guess about how OpenRig works. Gives the runtime mental model fast, so you stop guessing.ProductivityNo warnings★ 8.3K↓ —
- finishing-a-development-branchjnMetaCode/superpowers-zh当实现完成、所有测试通过、需要决定如何集成这份工作时使用OtherNo warnings★ 8.4K↓ —
- live-dashboardnexu-io/html-anythingNotion 风团队仪表板, KPI + 7 日 sparkline + activity feed + 任务表ProductivityNo warnings★ 9.3K↓ —
- finance-reportnexu-io/html-anythingMasthead + KPI + 收入/烧钱图 + P&L 表 + 重点 + 展望FinanceNo warnings★ 9.3K↓ —
- ads-metaAgriciDaniel/claude-adsAudit Meta Ads measurement, Pixel and Events Manager, attribution, Facebook and Instagram creative, audiences, placements, automation, budgets, account structure, and policy. Use for Meta Ads, Facebook Ads, Instagram Ads, Advantage+, Pixel, Events Manager, or Meta account structure. Read-only; use ads-server-side-tracking for server-side events and ads-optimize to change campaigns.MarketingNo warnings★ 10.5K↓ —
- social-media-matrixnexu-io/html-anything电影感多平台社媒分析: 互动图、悬浮洞察、区间对比、明暗主题MarketingNo warnings★ 9.3K↓ —
- offensive-sqliSnailSploit/Claude-RedSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.SecurityNo warnings★ 9.7K↓ —
- cross-host-rig-commandsmvschwarz/openrigUse when addressing a registered remote OpenRig host, choosing its transport, or interpreting a cross-host result.OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- cloud-architectJeffallan/claude-skillsDesigns cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost optimization, disaster recovery, landing zones, security architecture, serverless design.PlanningNo warnings★ 12.1K↓ —
- answering-natural-language-questions-with-dbtdbt-labs/dbt-agent-skillsWrites and executes SQL queries against the data warehouse using dbt's Semantic Layer or ad-hoc SQL to answer business questions. Use when a user asks about analytics, metrics, KPIs, or data (e.g., "What were total sales last quarter?", "Show me top customers by revenue"). NOT for validating, testing, or building dbt models during development.OfficialDataNo warnings★ 747↓ —
- openrig-skillsmvschwarz/openrigUse when an agent running inside OpenRig needs the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also when the agent doesn't know what applies or nothing is projected on cold boot. Installing, starting or updating OpenRig, getting back to a team or bringing a stopped one back from a person's own session is the rigs skill.PlanningNo warnings★ 8.3K↓ —Also in 2 other repos
- offensive-oauthSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- deck-xhs-whitenexu-io/html-anything纯白 + 顶部彩虹 bar + 渐变文字 + 马卡龙软卡片 + 黑底 pillDocumentsNo warnings★ 9.3K↓ —
- hive.x-automationaden-hive/hiveRead before automating X / Twitter with browser_* tools. Verified flows for post, reply, delete, search-and-engage, plus the Draft.js compose quirks that silently disable the send button. Includes the daily-reply and job-market-reply playbooks. Requires hive.browser-automation for the underlying screenshot + coordinate workflow. Verified 2026-04-11.BrowserNo warnings★ 11.1K↓ —
- receiving-code-reviewjnMetaCode/superpowers-zh收到代码审查反馈后、实施建议之前使用，尤其当反馈不明确或技术上有疑问时——需要技术严谨性和验证，而非敷衍附和或盲目执行EngineeringNo warnings★ 8.4K↓ —
- ads-mathAgriciDaniel/claude-adsCalculate and model paid-media CPA, CPL, CPC, CPM, ROAS, MER, break-even targets, contribution margin, LTV:CAC, impression-share opportunity, budgets, forecasts, and experiment economics. Use for PPC math, ad calculator, break-even analysis, ROAS calculator, CPA calculator, budget forecast, LTV CAC, or MER.MarketingNo warnings★ 10.5K↓ —Also in 2 other repos
- ads-xAgriciDaniel/claude-adsAudit X Ads measurement, X Pixel and Conversions API, campaign objectives, keyword and conversation targeting, creative, budgets, brand safety, app measurement, and reporting. Use for X Ads, Twitter Ads, promoted posts, X Pixel, X Conversions API, conversation targeting, or paid campaigns on X.MarketingNo warnings★ 10.5K↓ —
- offensive-graphqlSnailSploit/Claude-RedOffensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification,SecurityNo warnings★ 9.7K↓ —
- ads-linkedinAgriciDaniel/claude-adsAudit LinkedIn Ads measurement, Insight Tag and conversions, professional audiences, lead generation, ABM, creative, bidding, budgets, pacing, automation, and policy. Use for LinkedIn Ads, Campaign Manager, Insight Tag, Lead Gen Forms, Thought Leader Ads, ABM campaigns, or B2B paid media.MarketingNo warnings★ 10.5K↓ —
- vue-expert-jsJeffallan/claude-skillsCreates Vue 3 components, builds vanilla JS composables, configures Vite projects, and sets up routing and state management using JavaScript only — no TypeScript. Generates JSDoc-typed code with @typedef, @param, and @returns annotations for full type coverage without a TS compiler. Use when building Vue 3 applications with JavaScript only (no TypeScript), when projects require JSDoc-based type hints, when migrating from Vue 2 Options API to Composition API in JS, or when teams prefer vanilla JavaScript, .mjs modules, or need quick prototypes without TypeScript setup.EngineeringNo warnings★ 12.1K↓ —
- offensive-osintSnailSploit/Claude-RedComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.SecurityNo warnings★ 9.7K↓ —
- workflow-runnerjnMetaCode/superpowers-zh在 Claude Code / OpenClaw / Cursor 中直接运行 agency-orchestrator YAML 工作流——无需 API key，使用当前会话的 LLM 作为执行引擎。当用户提供 .yaml 工作流文件或要求多角色协作完成任务时触发。ProductivityNo warnings★ 8.4K↓ —
- hive.telegram-notifications-setupaden-hive/hiveSet up a Telegram notification channel (Sentinel) for a colony by driving the browser — create a bot via @BotFather in Telegram Web, store its token, detect the chat to notify, and turn Sentinel on so the colony can ping the user on Telegram and accept replies. Use when the user asks to "set up Telegram notifications", "get pinged on Telegram", "connect Telegram for alerts", "set up Sentinel on Telegram", or clicks the in-app "Set this up with the agent" button on the Telegram step. Requires hive.browser-automation.BrowserNo warnings★ 11.1K↓ —
- offensive-mobileSnailSploit/Claude-RedMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.SecurityNo warnings★ 9.7K↓ —
kibana-agent-builder
elastic/agent-skills
OfficialTestingUpdated yesterday
From the author
Create and manage Kibana Agent Builder agents and custom tools. Use when asked to create, update, delete, test, or inspect agents or tools in Agent Builder, or when the user wants to understand what agents or tools already exist.
Install
npx skills add elastic/agent-skills --skill kibana-agent-builder -a claude-code
Installs to .claude/skills/kibana-agent-builder/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance100
Maintenance100
Licence100
Adoption46
Files (3)
- SKILL.md
- references/architecture-guide.md
- references/use-cases.md