Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 9 hours ago
47,307 skills
- vue-expert-jsJeffallan/claude-skillsCreates Vue 3 components, builds vanilla JS composables, configures Vite projects, and sets up routing and state management using JavaScript only — no TypeScript. Generates JSDoc-typed code with @typedef, @param, and @returns annotations for full type coverage without a TS compiler. Use when building Vue 3 applications with JavaScript only (no TypeScript), when projects require JSDoc-based type hints, when migrating from Vue 2 Options API to Composition API in JS, or when teams prefer vanilla JavaScript, .mjs modules, or need quick prototypes without TypeScript setup.EngineeringNo warnings★ 12.1K↓ —
- observability-csp-investigationNewelastic/agent-skillsInvestigate cloud-provider (CSP) service issues — AWS today (the reasoning applies to any AWS service; schema and failure signatures are deepest for RDS, Lambda, SQS, ALB, EC2), and in future GCP and Azure — using OTel-schema cloud metrics in Elastic. Use when diagnosing cloud-resource problems, whether alert-triggered or ad hoc: database connection/CPU/memory pressure, function error rates and throttling, queue backlog and consumer lag, load-balancer 5xx, instance saturation. Correlates the resource under investigation against its own baseline, classifies the failure mode, and rules out co-occurring but unrelated conditions.OfficialDevOpsNo warnings★ 602↓ —Also in 1 other repo
- vitessplanetscale/database-skillsVitess best practices, query optimization, and connection troubleshooting for PlanetScale Vitess databases. Load when working with Vitess databases, sharding, VSchema configuration, keyspace management, or MySQL scaling issues.OfficialDataNo warnings★ 730↓ —
- mysqlplanetscale/database-skillsPlan and review MySQL/InnoDB schema, indexing, query tuning, transactions, and operations. Use when creating or modifying MySQL tables, indexes, or queries; diagnosing slow/locking behavior; planning migrations; or troubleshooting replication and connection issues. Load when using a MySQL database.OfficialDataNo warnings★ 730↓ —
- release-skillsJimLiu/baoyu-skillsUniversal release workflow. Auto-detects version files and changelogs. Supports Node.js, Python, Rust, Claude Plugin, GitHub Releases, annotated tags, historical release backfill, and generic projects. Use when user says "release", "发布", "new version", "bump version", "push", "推送", "release notes", "GitHub Release", or "回填 Release".EngineeringNo warnings★ 27K↓ —Also in 1 other repo
- using-git-worktreesjnMetaCode/superpowers-zh当需要开始与当前工作区隔离的功能开发，或在执行实现计划之前使用——通过原生工具或 git worktree 回退机制确保隔离工作区存在EngineeringNo warnings★ 8.4K↓ —
- specification-systemmvschwarz/openrigUse when authoring rig specs, agent specs, workflow specs, startup/context fragments, operating-mode declarations, or designing the user spec library. Covers the 4 failure modes (spec instantiates topology but not workflow/mode; spec depends on local paths and fails on another host; agents modify specs as one-off files instead of preserving reusable intent; validation proves YAML shape but not whether topology can run) and the validation-vs-runtime-realization distinction.PlanningNo warnings★ 8.3K↓ —Also in 1 other repo
- cross-host-rig-commandsmvschwarz/openrigUse when addressing a registered remote OpenRig host, choosing its transport, or interpreting a cross-host result.OtherNo warnings★ 8.3K↓ —Also in 1 other repo
- verification-before-completionmvschwarz/openrigUse when about to claim work is complete, fixed, or passing, or before committing or creating PRsOtherNo warnings★ 8.3K↓ —Also in 1 other repo
- creating-mermaid-dbt-dagdbt-labs/dbt-agent-skillsGenerates a Mermaid flowchart diagram of dbt model lineage using MCP tools, manifest.json, or direct code parsing as fallbacks. Use when visualizing dbt model lineage and dependencies as a Mermaid diagram in markdown format.OfficialDataNo warnings★ 747↓ —
- gentle-ai-chained-prGentleman-Programming/gentle-aiTrigger: PRs over 400 lines, stacked PRs, review slices. Split oversized changes into chained PRs that protect review focus.EngineeringNo warnings★ 8.1K↓ —
- firebase-remote-config-basicsfirebase/agent-skillsManages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.OfficialDevOpsNo warnings★ 491↓ —
- security-alert-analysisNewelastic/agent-skillsInvestigate a specific Elastic Security detection alert: gather context, assess entity risk, classify the threat, document findings, and optionally acknowledge. Use when triaging a single known alert, performing SOC investigation, or following up after the security-alert-triage skill identifies a group to investigate.OfficialSecurityNo warnings★ 602↓ —Also in 1 other repo
- hive.context-preservationaden-hive/hiveProactively extract critical values from tool results into working notes before automatic context pruning destroys them.ProductivityNo warnings★ 11.1K↓ —
- firebase-hosting-basicsfirebase/agent-skillsDeploys and configures classic Firebase Hosting for static websites, single-page apps (SPAs), and microservices. Use when deploying static sites/SPAs, setting up custom domains, configuring firebase.json hosting settings (redirects, rewrites, headers, multi-site), or managing preview channels. Don't use for Firebase App Hosting (Next.js/SSR), Auth, Firestore queries/rules, Data Connect, or Crashlytics.OfficialDevOpsNo warnings★ 491↓ —
- comment-writerGentleman-Programming/gentle-aiWrite warm, direct collaboration comments. Trigger: PR feedback, issue replies, reviews, Slack messages, or GitHub comments.WritingNo warnings★ 8.1K↓ —Also in 1 other repo
- offensive-zigbee-thread-matterSnailSploit/Claude-RedZigbee, Thread, and Matter mesh-protocol attack methodology — IEEE 802.15.4 sniffing with TI CC2531 / CC2540 / Sonoff Zigbee Dongle E, KillerBee toolkit, Touchlink commissioning abuse with the well-known transport key, replay/injection attacks, Zigbee Cluster Library command abuse for door locks and bulbs, Thread network credential theft, Matter commissioning chain analysis, and 6LoWPAN/IPv6 routing exploitation. Use when targeting smart-home or commercial mesh deployments, Zigbee-based door locks, lighting, or sensor networks.DevOpsNo warnings★ 9.7K↓ —
- offensive-phishingSnailSploit/Claude-RedPhishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition and aging, SPF/DKIM/DMARC alignment), payload delivery vectors (Office macro weaponization, HTA droppers, ISO/IMG container abuse, LNK shortcut hijacking, OneNote embedded payloads, HTML smuggling), email authentication bypass techniques (SPF softfail exploitation, DKIM replay attacks, display name spoofing, homoglyph and cousin domain registration), credential harvesting with MFA bypass (EvilGinx2 transparent proxy, Modlishka session relay, pixel-perfect HTML cloning), spear phishing pretext development informed by OSINT, email security gateway evasion, QR code phishing (quishing), and callback phishing for initial access. Integrates with GoPhish for campaign management, EvilGinx2 for adversary-in-the-middle credential interception, King Phisher for template design, and the Social Engineering Toolkit for payload gSecurityNo warnings★ 9.7K↓ —
- offensive-supply-chainSnailSploit/Claude-RedComprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) anDevOpsNo warnings★ 9.7K↓ —
- offensive-reportingSnailSploit/Claude-RedPenetration test and red team report writing methodology. Covers executive summary structuring (risk-led narrative for non-technical readers), technical finding format (title, severity, affected scope, narrative, reproduction steps, impact, remediation, references), CVSS v3.1 / v4.0 scoring with vector justification, OWASP risk rating, evidence hygiene (redacting credentials, hashing client data, time-stamping every action), screenshot and PoC artifact management, finding chain narratives, scope/limitations/assumptions documentation, retest evidence and remediation tracking, deliverable formats (PDF, DOCX, HTML, JSON for SIEM ingestion), client-customer-deliverable separation, and common report mistakes (over-CVSSing, undermining the triager, missing the 'so what'). Use at the end of an engagement when authoring a deliverable, when restructuring a draft for executive readability, or when establishing a reusable report template for a consulting practice.SecurityNo warnings★ 9.7K↓ —
- offensive-osintSnailSploit/Claude-RedComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.SecurityNo warnings★ 9.7K↓ —
- offensive-oauthSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- offensive-xssSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- angular-developerangular/skillsGenerates Angular code and provides architectural guidance. Trigger when creating projects, components, services, or HTTP communication, or for best practices on reactivity (signals, linkedSignal, resource, httpResource), queries and content projection, forms, dependency injection, routing, server and hybrid rendering (SSR, prerendering, hydration), accessibility (ARIA), animations, styling (component styles, Tailwind CSS), testing, naming conventions, or CLI tooling.OfficialTestingNo warnings★ 701↓ —
invoice
nexu-io/html-anything
OtherUpdated Oct 13, 2026
From the author
标准发票: 寄件/收件 + 明细 + 税 + 总额 + 付款指引
Install
npx skills add nexu-io/html-anything --skill invoice -a claude-code
Installs to .claude/skills/invoice/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance88
Maintenance100
Licence100
Adoption62
Files (2)
- SKILL.md
- example.html