Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 7 hours ago
47,307 skills
- offensive-open-redirectSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- verification-before-completionjnMetaCode/superpowers-zh在宣称工作完成、已修复或测试通过之前使用，在提交或创建 PR 之前——必须运行验证命令并确认输出后才能声称成功；始终用证据支撑断言OtherNo warnings★ 8.4K↓ —
- openrig-usermvschwarz/openrigUse when a specific `rig` command, subcommand, or flag is already known and you need its exact syntax, JSON shape, defaults, or error meaning. NOT for natural capability discovery, open-ended how-do-I questions, or choosing which OpenRig move applies.PlanningNo warnings★ 8.3K↓ —
- agent-operated-softwaremvschwarz/openrigUse when designing, building, operating, or diagnosing an ongoing application whose live backend or control loop includes OpenRig agents, including applications with a Markdown, YAML, or JSON agent control plane or a thin surface over specialist agent roles.PlanningNo warnings★ 8.3K↓ —
- chinese-commit-conventionsjnMetaCode/superpowers-zh中文 commit 与 changelog 配置参考——Conventional Commits 中文适配、commitlint/husky/commitizen 中文模板、conventional-changelog 中文配置。仅在用户显式 /chinese-commit-conventions 时调用，不要根据上下文自动触发。EngineeringNo warnings★ 8.4K↓ —
- offensive-z-waveSnailSploit/Claude-RedZ-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting Z-Wave smart home devices (door locks, sensors, garage controllers) — common in mid-2010s smart home deployments still in production.TestingNo warnings★ 9.7K↓ —
- offensive-file-uploadSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- queue-handoffmvschwarz/openrigUse when ending a turn, finishing a slice, blocked on another agent's work, or escalating to a human — durable work handoff via queue items so the system keeps moving across compactions, missed messages, and interruptions. Covers the hot-potato terminal-turn-rule (active work ends by passing the ball, not by going idle), default-nudge semantics, and when `--no-nudge` is appropriate for intentional cold park or human gate.OtherNo warnings★ 8.3K↓ —
- deck-obsidian-claudenexu-io/html-anythingGitHub-dark + 紫蓝环境光 + 三色渐变标题 + GitHub 风代码DocumentsNo warnings★ 9.3K↓ —
- frame-data-chart-nytnexu-io/html-anythingNYT-newsroom 排版 + 错峰揭示动画 + 编辑级图表 (折线/柱/范围带)OtherNo warnings★ 9.3K↓ —
- web-proto-brutalistnexu-io/html-anythingSwiss industrial-print 风: 单字 grotesque、巨数字、ASCII 装饰OtherNo warnings★ 9.3K↓ —
- rig-lifecyclemvschwarz/openrigUse when reasoning about the rig lifecycle operations family (create / start / stop / resume / restore / snapshot / release / unclaim / destroy), reading or trusting `rig ps` / lifecycle projections after recovery, or designing proof for a lifecycle scenario. Covers the 4 failure modes (auto-restore creates partial rig; projections report healthier than reality; provider auth treated as impl work; resume succeeds for one runtime fails another) plus the restore-honesty rule (failed resume is FAILED loudly — no auto fresh fallback).OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- openrig-herdrmvschwarz/openrigUse when opening OpenRig fleet terminals as a herdr wall — turning a rig, pod, mission, slice, or saved view into live interactive agent tiles via `rig terminal`, watching another rig read-only, or driving herdr on an agent's request ("open all my rigs + a mission as views"). Covers the `rig terminal open|views|status` verbs, the honest-partial/degrade reading of the result, the read-only-by-construction rail for cross-rig views, scroll/copy out of the box, and the same-size-only duplicate-pane limit. herdr is the default, proof-gated provider.OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- oversight-teammvschwarz/openrigUse when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention ladder (orchestrator-ping -> refocus -> human escalation), and the cheap+deep model economics. NOT for orchestrating your OWN rig (orchestration-team) and NOT the intervention primitive mechanics (watchdog).ProductivityNo warnings★ 8.3K↓ —Also in 1 other repo
- development-teammvschwarz/openrigUse when a development pod begins or hands off implementation, QA, or design work.TestingNo warnings★ 8.3K↓ —Also in 1 other repo
- competitive-teardownnexu-io/html-anything定位图 + 功能矩阵 + 价格对比 + 机会窗口, 把竞品资料转成产品决策报告OtherNo warnings★ 9.3K↓ —
- web-proto-editorialnexu-io/html-anythingEditorial-minimalist: 暖色单色 canvas + serif display + grotesque bodyWritingNo warnings★ 9.3K↓ —
- exec-summarymvschwarz/openrigGenerate a 1-2 page executive summary for a feature — orients sales, leadership, and engineering from a single document.ProductivityNo warnings★ 8.3K↓ —Also in 1 other repo
- ui-mockupmvschwarz/openrigCreate UI mockups at three fidelity levels — ASCII wireframes for quick iteration, standalone HTML mockups for delivery with requirements, and live prototypes for interaction testing.DesignNo warnings★ 8.3K↓ —Also in 1 other repo
- offensive-tls-attacksSnailSploit/Claude-RedComprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication attacSecurityNo warnings★ 9.7K↓ —
- openrig-cmuxmvschwarz/openrigUse when opening OpenRig fleet terminals into cmux — turning a rig, pod, mission, slice, or saved view into live agent tiles via `rig terminal --provider cmux`, or driving cmux on an agent's request. Same OpenRig view semantics as openrig-herdr (the verbs, honest-partial/degrade, read-only cross-rig, scroll/copy, same-size-only duplicates); cmux is the **best-effort** provider (herdr is the default and the proof-gated one). Prefer openrig-herdr unless cmux is specifically wanted.PlanningNo warnings★ 8.3K↓ —Also in 1 other repo
- human-in-the-loopmvschwarz/openrigUse when classifying a slice closeout (auto-continue / human gate / park), routing a real decision to a human, or designing a human queue/dashboard surface. Treats humans as durable network participants with attention surfaces, queues, and decision records — escalation lands as a durable attention item, not a chat message. Approval is NOT required for every clean closeout; the default RSI conveyor continues unless an explicit human gate is reached.OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- dogfoodmvschwarz/openrigSystematically explore and test a web application to find bugs, UX issues, and other problems. Use when asked to "dogfood", "QA", "exploratory test", "find issues", "bug hunt", "test this app/site/platform", or review the quality of a web application. Produces a structured report with full reproduction evidence -- step-by-step screenshots, repro videos, and detailed repro steps for every issue -- so findings can be handed directly to the responsible teams.TestingNo warnings★ 8.3K↓ —Also in 1 other repo
- shopify-expertJeffallan/claude-skillsBuilds and debugs Shopify themes (.liquid files, theme.json, sections), develops custom Shopify apps (shopify.app.toml, OAuth, webhooks), and implements Storefront API integrations for headless storefronts. Use when building or customizing Shopify themes, creating Hydrogen or custom React storefronts, developing Shopify apps, implementing checkout UI extensions or Shopify Functions, optimizing performance, or integrating third-party services. Invoke for Liquid templating, Storefront API, app development, checkout customization, Shopify Plus features, App Bridge, Polaris, or Shopify CLI workflows.DesignNo warnings★ 12.1K↓ —
offensive-file-upload
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
The frontmatter could not be read (no frontmatter); the folder name is shown instead.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-file-upload -a claude-code
Installs to .claude/skills/offensive-file-upload/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md