Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 7 hours ago
47,307 skills
- review-teammvschwarz/openrigUse when assigned a review or when an authored review boundary is reached.EngineeringNo warnings★ 8.3K↓ —Also in 1 other repo
- elasticsearch-onboardingUpdatedelastic/agent-skillsHelp developers new to Elasticsearch get from zero to a working search experience. Guide them through understanding their intent, mapping their data, and building a search experience with best practices baked in. Use this when the user shows intent to build search-related functionality, asks about Elasticsearch-related concepts for their use case, or expresses the need for help getting started with Elasticsearch.OfficialOtherNo warnings★ 602↓ —Also in 1 other repo
- backlog-capturemvschwarz/openrigQuickly capture product ideas, feature requests, or insights from meetings and conversations. Rapid documentation with smart categorization and deduplication.OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- offensive-xssSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- observability-csp-investigationNewelastic/agent-skillsInvestigate cloud-provider (CSP) service issues — AWS today (the reasoning applies to any AWS service; schema and failure signatures are deepest for RDS, Lambda, SQS, ALB, EC2), and in future GCP and Azure — using OTel-schema cloud metrics in Elastic. Use when diagnosing cloud-resource problems, whether alert-triggered or ad hoc: database connection/CPU/memory pressure, function error rates and throttling, queue backlog and consumer lag, load-balancer 5xx, instance saturation. Correlates the resource under investigation against its own baseline, classifies the failure mode, and rules out co-occurring but unrelated conditions.OfficialDevOpsNo warnings★ 602↓ —Also in 1 other repo
- elasticsearch-search-relevanceelastic/agent-skillsImprove Elasticsearch search relevance for content and catalog indices: pin or promote results with query rules (correct rule type, criteria, and rule-query wiring) and tune organic ranking with multi_match, field boosts, and analysis grounded in the index mapping. Use when search results rank poorly, a specific document must appear first for a query, or the user asks to tune full-text matching — not for ES|QL analytics, index ingest, or cluster health.OfficialDataNo warnings★ 602↓ —Also in 1 other repo
- offensive-vuln-classesSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- offensive-reportingSnailSploit/Claude-RedPenetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.SecurityNo warnings★ 9.7K↓ —
- elasticsearch-anomaly-detectionelastic/agent-skillsCreate and manage Elastic ML anomaly detection jobs via the API. Use when setting up jobs on an index or data stream, configuring jobs and datafeeds, or opening, starting, or stopping them.OfficialEngineeringNo warnings★ 602↓ —Also in 1 other repo
- observability-k8s-investigationelastic/agent-skillsInvestigate Kubernetes workload, node, and control-plane issues using OTel telemetry (EDOT). Use when diagnosing pod failures (CrashLoopBackOff, OOMKilled, Error), node pressure, resource exhaustion, image pull failures, admission rejections, autoscaling anomalies, or correlating K8s state with application signals. OTel ingest path only — the legacy ECS Kubernetes integration shape is out of scope.OfficialDevOpsNo warnings★ 602↓ —Also in 1 other repo
- kibana-agent-builderelastic/agent-skillsCreate and manage Kibana Agent Builder agents and custom tools. Use when asked to create, update, delete, test, or inspect agents or tools in Agent Builder, or when the user wants to understand what agents or tools already exist.OfficialTestingNo warnings★ 602↓ —Also in 1 other repo
- kibana-alerting-ruleselastic/agent-skillsCreate and manage Kibana alerting rules. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze), choosing metric threshold rule types and params, or read-only find/list with tag filters.OfficialOtherNo warnings★ 602↓ —Also in 1 other repo
- kibana-anomaly-detectionelastic/agent-skillsElastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA, "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard_limit, or configuring ML anomaly detection jobs. Reads results from `.ml-anomalies-*` and job state from ML REST APIs.OfficialFinanceNo warnings★ 602↓ —Also in 1 other repo
- kibana-dashboardsUpdatedelastic/agent-skillsCreate and manage Kibana Dashboards and Lens visualizations. Use when you need to define dashboards and visualizations declaratively, version control them, automate their deployment, or improve layout, sections, controls, or chart design.OfficialDevOpsNo warnings★ 602↓ —Also in 1 other repo
- card-xiaohongshunexu-io/html-anything小红书风格知识卡片, 多张联排可滑动浏览OtherNo warnings★ 9.3K↓ —
- find-bugsgetsentry/skillsFind bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.OfficialSecurityNo warnings★ 1.1K↓ —Also in 1 other repo
- article-sketchnote-editorialnexu-io/html-anything把一个概念铸成杂志专题档案——真问题→失败→转折→顿悟→命名, 6 个 layout 模具 + 4 字族对比 + 探案档案细节WritingNo warnings★ 9.3K↓ —
- subagent-driven-developmentjnMetaCode/superpowers-zh当在当前会话中执行包含独立任务的实现计划时使用OtherNo warnings★ 8.4K↓ —
- frame-macos-notificationnexu-io/html-anything拟真 macOS 通知 banner + app icon + 标题正文, 适合 video overlay / 产品发布预告MediaNo warnings★ 9.3K↓ —
- mobile-appnexu-io/html-anything像素级 iPhone 15 Pro 边框, 一屏 app 截图OtherNo warnings★ 9.3K↓ —
- deck-swiss-internationalnexu-io/html-anything16 列网格 + 单一饱和 accent + 22 个锁死版面 (Klein Blue / Lemon / Mint / Safety Orange)DocumentsNo warnings★ 9.3K↓ —
- ads-reportAgriciDaniel/claude-adsRender Markdown, HTML, or PDF paid-advertising reports from a validated Claude Ads JSON run bundle. Use for ads report, client report, audit PDF, executive audience reporting, or exporting prior audit and plan results.MarketingNo warnings★ 10.5K↓ —
- ads-appleAgriciDaniel/claude-adsAudit Apple Ads measurement, AdServices and AdAttributionKit, campaign and keyword structure, Search Match, App Store placements, custom product pages, bidding, budgets, MMP reconciliation, and policy. Use for Apple Ads, Apple Search Ads, App Store ads, Search Match, custom product pages, AdServices, or Apple app-install campaigns.MarketingNo warnings★ 10.5K↓ —
- cli-developerJeffallan/claude-skillsUse when building CLI tools, implementing argument parsing, or adding interactive prompts. Invoke for parsing flags and subcommands, displaying progress bars and spinners, generating bash/zsh/fish completion scripts, CLI design, shell completions, and cross-platform terminal applications using commander, click, typer, or cobra.EngineeringNo warnings★ 12.1K↓ —
offensive-active-directory
SnailSploit/Claude-Red
DevOpsUpdated Oct 12, 2026
From the author
Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-active-directory -a claude-code
Installs to .claude/skills/offensive-active-directory/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md