Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 2 hours ago
47,307 skills
- social-x-post-cardnexu-io/html-anything拟真 X 推文卡片 + 互动数据 (likes/reposts/views), 适配视频叠加或图卡分享OtherNo warnings★ 9.3K↓ —
- offensive-api-abuseSnailSploit/Claude-RedAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authoEngineeringNo warnings★ 9.7K↓ —
- workflow-runnerjnMetaCode/superpowers-zh在 Claude Code / OpenClaw / Cursor 中直接运行 agency-orchestrator YAML 工作流——无需 API key，使用当前会话的 LLM 作为执行引擎。当用户提供 .yaml 工作流文件或要求多角色协作完成任务时触发。ProductivityNo warnings★ 8.4K↓ —
- offensive-mobileSnailSploit/Claude-RedMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.SecurityNo warnings★ 9.7K↓ —
- experiment-readoutnexu-io/html-anything假设 + 指标 + 结果 + 解释 + 决策, 把 A/B 或产品实验转成行动建议OtherNo warnings★ 9.3K↓ —
- baoyu-xhs-imagesJimLiu/baoyu-skillsGenerates infographic image card series with 12 visual styles, 8 layouts, and 3 color palettes. Breaks content into 1-10 cartoon-style image cards optimized for social media engagement. Use when user mentions "小红书图片", "小红书种草", "小绿书", "微信图文", "微信贴图", "image cards", "图片卡片", baoyu-xhs-images, or wants social media infographic series.MediaNo warnings★ 27K↓ —
- doc-kami-parchmentnexu-io/html-anything暖羊皮纸底 (#f5f4ed) + 墨蓝单色 accent (#1B365D) + 单一衬线字体, 编辑级排印OtherNo warnings★ 9.3K↓ —
- deck-graphify-darknexu-io/html-anything深夜渐变 + 漂浮 orbs + SVG 力导向图谱 + JetBrains MonoDocumentsNo warnings★ 9.3K↓ —
- offensive-waf-bypassSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- deck-course-modulenexu-io/html-anything暖纸背景 + Playfair, 左侧学习目标常驻, 含 MCQ 自测页DocumentsNo warnings★ 9.3K↓ —
- mobile-onboardingnexu-io/html-anything三个手机框并排: splash / value-prop / sign-inOtherNo warnings★ 9.3K↓ —
- video-hyperframesnexu-io/html-anythingHyperframes / Remotion 兼容的连续帧动画, 可自动播放MediaNo warnings★ 9.3K↓ —
- deck-tech-sharingnexu-io/html-anythingGitHub-dark + JetBrains Mono + 终端代码块, 含 agenda + Q&ADocumentsNo warnings★ 9.3K↓ —
- deck-safety-alertnexu-io/html-anything红琥珀警示色 + hazard 条纹 + L1/L2/L3 tier 卡片 + 删除线标题DocumentsNo warnings★ 9.3K↓ —
- offensive-graphqlSnailSploit/Claude-RedOffensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification,SecurityNo warnings★ 9.7K↓ —
- deck-magazine-webnexu-io/html-anything电子杂志 × 电子墨水风, WebGL 流体背景 + 衬线 displayDocumentsNo warnings★ 9.3K↓ —
- deck-hermes-cybernexu-io/html-anything黑底 + CRT 网格扫描线 + $ 命令行标题 + 薄荷绿大字 + 三档 tagDocumentsNo warnings★ 9.3K↓ —
- hive.linkedin-automationaden-hive/hiveRead before automating LinkedIn with browser_* tools. LinkedIn combines shadow DOM (#interop-outlet), strict Trusted Types CSP that silently drops innerHTML, Lexical composer, native beforeunload dialogs that hang the bridge, and aggressive spam filters — each has bitten us at least once. Verified flows for profile messaging, connection-request acceptance, feed composition, and search. Requires hive.browser-automation. Verified against logged-in production 2026-04-11.MarketingNo warnings★ 11.1K↓ —
- wireframe-sketchnexu-io/html-anything网格背景 + marker 笔触 + 多 tab + sticky note + scribble 图表ProductivityNo warnings★ 9.3K↓ —
- sprite-animationnexu-io/html-anything像素美术 + kinetic 字体的解说帧, 纯 CSS 循环, 可录视频MediaNo warnings★ 9.3K↓ —
- mockup-device-3dnexu-io/html-anythingiPhone + MacBook 仿 GLTF 静态展架, 屏幕内嵌真实 HTML 内容, 玻璃镜头折射, 360° 转盘构图OtherNo warnings★ 9.3K↓ —
- offensive-ssrfSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- deck-dir-key-navnexu-io/html-anything8 页单色背景, 160px display + 4px accent + Mono 箭头列表DocumentsNo warnings★ 9.3K↓ —
- offensive-oauthSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
offensive-xss
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
The frontmatter could not be read (no frontmatter); the folder name is shown instead.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-xss -a claude-code
Installs to .claude/skills/offensive-xss/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md