Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 5 hours ago
47,307 skills
- frame-liquid-bg-heronexu-io/html-anythingWebGL 风流体置换背景 + 顶部叠加金句, 适合视频片头 / landing hero / 海报OtherNo warnings★ 9.3K↓ —
- requesting-code-reviewjnMetaCode/superpowers-zh完成任务、实现重要功能或合并前使用，用于验证工作成果是否符合要求EngineeringNo warnings★ 8.4K↓ —
- hf-cloud-aws-context-discoveryhuggingface/skillsDiscover the user's local AWS context (active profile, region, account ID, caller identity) at the start of any AWS task. Use this skill before any other AWS work — deploying to SageMaker, creating resources, calling AWS APIs, or anything that touches an AWS account. Use it especially when the user has not specified a region or profile explicitly, when they say things like "use my AWS account", "deploy to AWS", "use my profile", or when about to make any AWS CLI or SDK call. Never guess the region or account ID — always use this skill to read it from the local configuration first.OfficialDevOpsNo warnings★ 11.2K↓ —
- test-driven-developmentjnMetaCode/superpowers-zh在实现任何功能或修复 bug 时使用，在编写实现代码之前TestingNo warnings★ 8.4K↓ —
- offensive-graphqlSnailSploit/Claude-RedOffensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification,SecurityNo warnings★ 9.7K↓ —
- offensive-api-abuseSnailSploit/Claude-RedAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authoEngineeringNo warnings★ 9.7K↓ —
- chinese-documentationjnMetaCode/superpowers-zh中文文档排版参考——中英文空格、全半角标点、术语保留、链接格式、中文文案排版指北约定。仅在用户显式 /chinese-documentation 时调用，不要根据上下文自动触发。OtherNo warnings★ 8.4K↓ —
- offensive-mobileSnailSploit/Claude-RedMobile (Android + iOS) application penetration testing methodology. Covers static analysis (apktool/jadx for Android, class-dump/Hopper/IDA for iOS), dynamic instrumentation with Frida and Objection, SSL pinning bypass strategies, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported component attacks (Android activities, services, providers, receivers; iOS XPC, URL schemes, universal links), insecure data storage (SharedPrefs, KeyStore misuse, NSUserDefaults, Keychain ACL bypass), IPC / Intent redirection, WebView vulnerabilities (JavaScriptInterface, file:// access), Firebase/AWS/Azure misconfiguration leakage, mobile API testing, biometric/Face ID/Touch ID bypass, app-cloning and runtime patching, and mobile malware/RAT analysis primitives. Use for mobile pentest, bug bounty mobile triage, or app-store reconnaissance.SecurityNo warnings★ 9.7K↓ —
- social-media-dashboardnexu-io/html-anything平台切换 + 粉丝/互动 KPI + 增长曲线 + Top post + 热门话题MarketingNo warnings★ 9.3K↓ —
- receiving-code-reviewjnMetaCode/superpowers-zh收到代码审查反馈后、实施建议之前使用，尤其当反馈不明确或技术上有疑问时——需要技术严谨性和验证，而非敷衍附和或盲目执行EngineeringNo warnings★ 8.4K↓ —
- diagnosing-superpowersjnMetaCode/superpowers-zh当一次 superpowers 会话出了问题、你的人类伙伴想知道原因时使用——重复劳动、无视计划、磕磕绊绊、结果质量差、某个技能没触发、"太慢了"、"为什么这么贵"、"它到底在干什么"——或者想给 superpowers 维护者整理一份 bug 报告；适用于当前会话，或按 id / 路径指定的过往会话，任何工具均可OtherNo warnings★ 8.4K↓ —
- agent-startersmvschwarz/openrigUse when creating, refreshing, packaging, inspecting, promoting, or deprecating a named per-seat starting point — Agent Starter manifest authoring, the 6-state lifecycle (captured → named → inspectable → used → promoted → deprecated), provenance honesty, and refusal rules. NOT a VM image; a managed starting point composed from agent role + startup context + optional native session source + provenance.MediaNo warnings★ 8.3K↓ —Also in 1 other repo
- chinese-commit-conventionsjnMetaCode/superpowers-zh中文 commit 与 changelog 配置参考——Conventional Commits 中文适配、commitlint/husky/commitizen 中文模板、conventional-changelog 中文配置。仅在用户显式 /chinese-commit-conventions 时调用，不要根据上下文自动触发。EngineeringNo warnings★ 8.4K↓ —
- queen-colony-debugaden-hive/hiveMulti-Agent Harness for Production AIEngineeringNo warnings★ 11.1K↓ —
- web-proto-brutalistnexu-io/html-anythingSwiss industrial-print 风: 单字 grotesque、巨数字、ASCII 装饰OtherNo warnings★ 9.3K↓ —
- web-proto-editorialnexu-io/html-anythingEditorial-minimalist: 暖色单色 canvas + serif display + grotesque bodyWritingNo warnings★ 9.3K↓ —
- offensive-idorSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- offensive-sqliSnailSploit/Claude-RedSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.SecurityNo warnings★ 9.7K↓ —
- offensive-ssrfSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- competitive-teardownnexu-io/html-anything定位图 + 功能矩阵 + 价格对比 + 机会窗口, 把竞品资料转成产品决策报告OtherNo warnings★ 9.3K↓ —
- social-spotify-cardnexu-io/html-anythingSpotify Now Playing 风格卡: 专辑封面 + 进度条 + 播放控制, 适配视频叠加 / 个人主页OtherNo warnings★ 9.3K↓ —
- deck-obsidian-claudenexu-io/html-anythingGitHub-dark + 紫蓝环境光 + 三色渐变标题 + GitHub 风代码DocumentsNo warnings★ 9.3K↓ —
- offensive-xssSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- offensive-oauthSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
hive.quality-monitor
aden-hive/hive
OtherUpdated 3 days ago
From the author
Periodically self-assess output quality to catch degradation before the judge does.
Install
npx skills add aden-hive/hive --skill hive.quality-monitor -a claude-code
Installs to .claude/skills/hive.quality-monitor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance89
Maintenance100
Licence100
Adoption63
Files (1)
- SKILL.md