Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 7 hours ago
47,307 skills
- session-source-forkmvschwarz/openrigUse when authoring a rig spec member or `rig expand` payload that needs to start a new managed seat from a prior runtime conversation source — `session_source: { mode: fork, ref: { kind, value } }`. v1 supports `mode: fork` with `ref.kind: native_id` for Claude and Codex. The new seat persists a NEW post-fork token; the parent token is NEVER written onto the new seat. NOT for restoring an existing seat or for artifact-backed mental-model rebuild.WritingNo warnings★ 8.3K↓ —Also in 1 other repo
- ads-creativeAgriciDaniel/claude-adsAudit paid-ad copy, images, video, hooks, concepts, format coverage, platform-native fit, message match, creative fatigue, accessibility, and policy across supported platforms. Use for creative audit, ad creative, creative fatigue, creative diversity, ad copy review, video review, image review, or production priorities.MarketingNo warnings★ 10.5K↓ —Also in 1 other repo
- exec-summarymvschwarz/openrigGenerate a 1-2 page executive summary for a feature — orients sales, leadership, and engineering from a single document.ProductivityNo warnings★ 8.3K↓ —Also in 1 other repo
- java-architectJeffallan/claude-skillsUse when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming. Invoke to implement WebFlux endpoints, optimize JPA queries and database performance, configure Spring Security with OAuth2/JWT, or resolve authentication issues and async processing challenges in cloud-native Spring applications.PlanningNo warnings★ 12.1K↓ —
- chinese-code-reviewjnMetaCode/superpowers-zh中文 review 沟通参考——话术模板、分级标注（必须修复/建议修改/仅供参考）、国内团队常见反模式应对。仅在用户显式 /chinese-code-review 时调用，不要根据上下文自动触发。EngineeringNo warnings★ 8.4K↓ —
- queue-handoffmvschwarz/openrigUse when ending a turn, finishing a slice, blocked on another agent's work, or escalating to a human — durable work handoff via queue items so the system keeps moving across compactions, missed messages, and interruptions. Covers the hot-potato terminal-turn-rule (active work ends by passing the ball, not by going idle), default-nudge semantics, and when `--no-nudge` is appropriate for intentional cold park or human gate.OtherNo warnings★ 8.3K↓ —
- ui-mockupmvschwarz/openrigCreate UI mockups at three fidelity levels — ASCII wireframes for quick iteration, standalone HTML mockups for delivery with requirements, and live prototypes for interaction testing.DesignNo warnings★ 8.3K↓ —Also in 1 other repo
- release-skillsJimLiu/baoyu-skillsUniversal release workflow. Auto-detects version files and changelogs. Supports Node.js, Python, Rust, Claude Plugin, GitHub Releases, annotated tags, historical release backfill, and generic projects. Use when user says "release", "发布", "new version", "bump version", "push", "推送", "release notes", "GitHub Release", or "回填 Release".EngineeringNo warnings★ 27K↓ —Also in 1 other repo
- workflow-runnerjnMetaCode/superpowers-zh在 Claude Code / OpenClaw / Cursor 中直接运行 agency-orchestrator YAML 工作流——无需 API key，使用当前会话的 LLM 作为执行引擎。当用户提供 .yaml 工作流文件或要求多角色协作完成任务时触发。ProductivityNo warnings★ 8.4K↓ —
- chaos-engineerJeffallan/claude-skillsDesigns chaos experiments, creates failure injection frameworks, and facilitates game day exercises for distributed systems — producing runbooks, experiment manifests, rollback procedures, and post-mortem templates. Use when designing chaos experiments, implementing failure injection frameworks, or conducting game day exercises. Invoke for chaos experiments, resilience testing, blast radius control, game days, antifragile systems, fault injection, Chaos Monkey, Litmus Chaos.TestingNo warnings★ 12.1K↓ —
- diagnosing-superpowersjnMetaCode/superpowers-zh当一次 superpowers 会话出了问题、你的人类伙伴想知道原因时使用——重复劳动、无视计划、磕磕绊绊、结果质量差、某个技能没触发、"太慢了"、"为什么这么贵"、"它到底在干什么"——或者想给 superpowers 维护者整理一份 bug 报告；适用于当前会话，或按 id / 路径指定的过往会话，任何工具均可OtherNo warnings★ 8.4K↓ —
- fastapi-expertJeffallan/claude-skillsUse when building high-performance async Python APIs with FastAPI and Pydantic V2. Invoke to create REST endpoints, define Pydantic models, implement authentication flows, set up async SQLAlchemy database operations, add JWT authentication, build WebSocket endpoints, or generate OpenAPI documentation. Trigger terms: FastAPI, Pydantic, async Python, Python API, REST API Python, SQLAlchemy async, JWT authentication, OpenAPI, Swagger Python.DataNo warnings★ 12.1K↓ —
- openrig-usermvschwarz/openrigUse when a specific `rig` command, subcommand, or flag is already known and you need its exact syntax, JSON shape, defaults, or error meaning. NOT for natural capability discovery, open-ended how-do-I questions, or choosing which OpenRig move applies.PlanningNo warnings★ 8.3K↓ —
- offensive-active-directorySnailSploit/Claude-RedActive Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.DevOpsNo warnings★ 9.7K↓ —
- offensive-social-engineeringSnailSploit/Claude-RedSocial engineering attack techniques beyond email phishing for authorized red team and physical penetration testing engagements. Covers pretexting methodology (persona creation, authority and urgency psychological triggers, rapport building), vishing (voice phishing via caller ID spoofing, IVR system exploitation, VoIP infrastructure setup with Twilio/Asterisk), smishing (SMS-based phishing, carrier gateway abuse, short code impersonation), physical social engineering (tailgating and piggybacking, RFID badge cloning with Proxmark3, lock picking and bypass, dumpster diving for sensitive documents), USB drop attacks (Rubber Ducky keystroke injection, Bash Bunny multi-vector payloads, O.MG cable covert implants, BadUSB firmware attacks), watering hole attack planning and execution, and OSINT-driven targeting (LinkedIn harvesting, organizational chart reconstruction, employee pattern analysis). Integrates with the Social Engineering Toolkit for attack automation, Proxmark3 for RFID/NFC cloning, USB Rubber Ducky aTestingNo warnings★ 9.7K↓ —
- hive.terminal-tools-job-controladen-hive/hiveUse when launching anything that runs longer than a minute, anything that streams logs, anything you want to keep running while doing other work — or when terminal_exec auto-backgrounded on you and returned a job_id. Teaches the start→poll→wait pattern with terminal_job_logs offset bookkeeping, bounded blocking polls, platform-specific process control via terminal_job_manage capabilities, and the hard rule that jobs die when the terminal-tools server restarts. Read before calling terminal_job_start, or right after terminal_exec auto-backgrounded.PlanningNo warnings★ 11.1K↓ —
- prototype-webnexu-io/html-anything可点击的功能性 Web 原型, 含导航、英雄区、特性区、CTAOtherNo warnings★ 9.3K↓ —
- gentle-ai-collab-perfectGentleman-Programming/gentle-aiTrigger: contributing to Gentleman-Programming/gentle-ai as an external collaborator. Strict issue-first workflow, honest PR bodies, contributor-vs-maintainer scope, chained-PR strategy, verification protocol, docstring coverage. Load whenever the active repo is Gentleman-Programming/gentle-ai and any part of the contribution flow is in scope: opening an issue, drafting or editing a PR body, splitting a change into chained/stacked PRs, or auditing a PR before requesting review.WritingNo warnings★ 8.1K↓ —
- vue-expertJeffallan/claude-skillsBuilds Vue 3 components with Composition API patterns, configures Nuxt 3 SSR/SSG projects, sets up Pinia stores, scaffolds Quasar/Capacitor mobile apps, implements PWA features, and optimises Vite builds. Use when creating Vue 3 applications with Composition API, writing reusable composables, managing state with Pinia, building hybrid mobile apps with Quasar or Capacitor, configuring service workers, or tuning Vite configuration and TypeScript integration.WritingNo warnings★ 12.1K↓ —
- kibana-context-engineNewelastic/agent-skillsQuery Elastic Context Engine AI Indices, and the Knowledge Indicators (KIs) they store. Use when asked to search, explore, count, or answer questions from an AI Index / KI / Context Engine knowledge index, and when writing the ES|QL that queries one.OfficialProductivityNo warnings★ 602↓ —Also in 1 other repo
- offensive-xssSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- offensive-phishingSnailSploit/Claude-RedPhishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name spoofing, homoglyph and cousin domain registration), credential harvesting with MFA bypass (EvilGinx2 transparent proxy, Modlishka session relay, pixel-perfect HTML cloning), spear phishing pretext development informed by OSINT, email security gateway evasion, QR code phishing (quishing), and callback phishing for initial access. Integrates with GoPhish for campaign management, EvilGinx2 for adversary-in-the-middle credential interception, King Phisher for template design, and the Social Engineering Toolkit for payload gSecurityNo warnings★ 9.7K↓ —
- migrating-dbt-core-to-v2dbt-labs/dbt-agent-skillsUse when a user needs help triaging dbt-core to dbt v2 migration errors. Runs dbt-autofix first, then classifies remaining errors into actionable categories (auto-fixable, guided fixes, needs input, blocked).OfficialDataNo warnings★ 747↓ —
- creating-mermaid-dbt-dagdbt-labs/dbt-agent-skillsGenerates a Mermaid flowchart diagram of dbt model lineage using MCP tools, manifest.json, or direct code parsing as fallbacks. Use when visualizing dbt model lineage and dependencies as a Mermaid diagram in markdown format.OfficialDataNo warnings★ 747↓ —
security-reviewer
Jeffallan/claude-skills
SecurityUpdated 18 hours ago
From the author
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.
Install
npx skills add Jeffallan/claude-skills --skill security-reviewer -a claude-code
Installs to .claude/skills/security-reviewer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance89
Maintenance100
Licence100
Adoption64
Files (7)
- SKILL.md
- references/infrastructure-security.md
- references/penetration-testing.md
- references/report-template.md
- references/sast-tools.md
- references/secret-scanning.md
- references/vulnerability-patterns.md