Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,307 skills from 2,272 repositories · updated 14 hours ago
47,307 skills
- offensive-api-abuseSnailSploit/Claude-RedAdvanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for authoEngineeringNo warnings★ 9.7K↓ —
- voice-changerelevenlabs/skillsTransform the voice in an audio recording into a different target voice while preserving emotion, timing, and delivery using the ElevenLabs Voice Changer (speech-to-speech) API. Use when converting one voice to another, changing the speaker/narrator of an existing recording, dubbing a voice-over in a different voice, creating character voices from a scratch performance, anonymizing a speaker, or any "voice conversion / voice transfer / speech-to-speech" task. Make sure to use this skill whenever the user mentions voice changing, voice conversion, speech-to-speech, swapping a voice in audio, re-voicing a clip, or applying a different voice to an existing recording — even if they don't explicitly say "voice changer". Do not use this skill to create or clone a new voice from a voice sample — that is voice cloning (IVC/PVC), a separate feature; this skill only converts an existing recording into an existing voice_id.OfficialMediaNo warnings★ 515↓ —
- kibana-anomaly-detectionelastic/agent-skillsElastic ML anomaly detection — investigation/RCA, score explanation, job lifecycle troubleshooting, and job operations. Use when answering "what broke?"/"which entity?"/RCA, "why is score high/low?"/renormalization, "datafeed stopped"/"memory limit"/hard_limit, or configuring ML anomaly detection jobs. Reads results from `.ml-anomalies-*` and job state from ML REST APIs.OfficialFinanceNo warnings★ 602↓ —Also in 1 other repo
- querying-the-dbt-information-schemadbt-labs/dbt-agent-skillsUse when answering questions about a dbt v2 project's own metadata — which models, sources, tests, columns, configs, tags, packages or lineage exist, what is untested or undocumented, what depends on what, how long models took in the last run — or when using `dbt show --info`, `{{ info_schema() }}`, `--generate-info-schema`, `target/info_schema/`, or writing `dbt check` SQL. Prefer this over grepping YAML or parsing `manifest.json` on dbt v2.OfficialDataNo warnings★ 747↓ —
- game-developerJeffallan/claude-skillsUse when building game systems, implementing Unity/Unreal Engine features, or optimizing game performance. Invoke to implement ECS architecture, configure physics systems and colliders, set up multiplayer networking with lag compensation, optimize frame rates to 60+ FPS targets, develop shaders, or apply game design patterns such as object pooling and state machines. Trigger keywords: Unity, Unreal Engine, game development, ECS architecture, game physics, multiplayer networking, game optimization, shader programming, game AI.DesignNo warnings★ 12.1K↓ —
- firebase-auth-basicsfirebase/agent-skillsGuide for setting up and using Firebase Authentication. Use this skill when the user's app requires user sign-in, user management, or secure data access using auth rules.OfficialOtherNo warnings★ 491↓ —
- kibana-workflowselastic/agent-skillsAuthor, validate, test, run, and inspect Elastic Workflow YAML definitions. Use when the user wants to turn natural language into a Kibana workflow, fix workflow YAML, understand triggers or steps, or run a quick test loop against a real Kibana.OfficialTestingNo warnings★ 602↓ —Also in 1 other repo
- using-dbt-statedbt-labs/dbt-agent-skillsUse when a user is enabling, configuring, optimizing, or debugging dbt State (the server-backed reuse mechanism that clones or skips nodes instead of rebuilding them). Use when they conflate dbt State with the `state:modified` selector or `--state` deferral. Use when asked about models rebuilding unexpectedly, views with `select *` rebuilding, volatile SQL (`current_timestamp()`, `random()`) rebuilding or not, cross-developer cloning, lag_tolerance.OfficialDataNo warnings★ 747↓ —
- offensive-osintSnailSploit/Claude-RedComprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.SecurityNo warnings★ 9.7K↓ —
- offensive-idorSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.7K↓ —
- rdd-advisory-transportGentleman-Programming/gentle-aiTrigger: reviewer transport, advisory transport, review adapter, lens prompt/schema, OpenCode reviewer plugin, Codex reviewer, ReviewProviderContract. Enforce the shared Go advisory reviewer transport contract.LegalNo warnings★ 8.1K↓ —
- fullstack-guardianJeffallan/claude-skillsBuilds security-focused full-stack web applications by implementing integrated frontend and backend components with layered security at every level. Covers the complete stack from database to UI, enforcing auth, input validation, output encoding, and parameterized queries across all layers. Use when implementing features across frontend and backend, building REST APIs with corresponding UI, connecting frontend components to backend endpoints, creating end-to-end data flows from database to UI, or implementing CRUD operations with UI forms. Distinct from frontend-only, backend-only, or API-only skills in that it simultaneously addresses all three perspectives—Frontend, Backend, and Security—within a single implementation workflow. Invoke for full-stack feature work, web app development, authenticated API routes with views, microservices, real-time features, monorepo architecture, or technology selection decisions.SecurityNo warnings★ 12.1K↓ —
- offensive-sqliSnailSploit/Claude-RedSQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.SecurityNo warnings★ 9.7K↓ —
- dubbingelevenlabs/skillsDub audio and video into other languages using the ElevenLabs Dubbing API (dubbing_v2), preserving the original speakers' voices. Use when translating videos, podcasts, or recordings into other languages, localizing media content, reviewing or correcting dubbing transcripts and translations, or regenerating a dub after edits.OfficialMediaNo warnings★ 515↓ —
- nekiplanetscale/database-skillsGuidance for Neki, PlanetScale's distributed (sharded) Postgres. Load when working with a Neki database — connecting, data topology and shard keys, query routing and fanout, cross-shard transactions, schema changes, resharding and migration, NK013 errors — or when scaling and sharding Postgres.OfficialDataNo warnings★ 730↓ —
- mcp-builderjnMetaCode/superpowers-zh在构建 MCP 服务器或 MCP 工具时使用 —— 系统化的生产级 MCP 构建方法论，覆盖工具设计、错误处理、传输层选择与测试，让 AI 助手连接外部能力OtherNo warnings★ 8.4K↓ —
- go-testingGentleman-Programming/gentle-aiTrigger: Go tests, go test coverage, Bubbletea teatest, golden files. Apply focused Go testing patterns.TestingNo warnings★ 8.1K↓ —
- judgment-dayGentleman-Programming/gentle-aiTrigger: judgment day, dual review, adversarial review, juzgar. Run explicit blind dual review with at most two scoped fix/re-judgment rounds.EngineeringNo warnings★ 8.1K↓ —
- nestjs-expertJeffallan/claude-skillsCreates and configures NestJS modules, controllers, services, DTOs, guards, and interceptors for enterprise-grade TypeScript backend applications. Use when building NestJS REST APIs or GraphQL services, implementing dependency injection, scaffolding modular architecture, adding JWT/Passport authentication, integrating TypeORM or Prisma, or working with .module.ts, .controller.ts, and .service.ts files. Invoke for guards, interceptors, pipes, validation, Swagger documentation, and unit/E2E testing in NestJS projects.TestingNo warnings★ 12.1K↓ —
- building-dbt-semantic-layerdbt-labs/dbt-agent-skillsUse when creating or modifying dbt Semantic Layer components — semantic models, metrics, dimensions, entities, measures, or time spines. Covers MetricFlow configuration, metric types (simple, derived, cumulative, ratio, conversion), and validation for both latest and legacy YAML specs.OfficialDataNo warnings★ 747↓ —
- using-git-worktreesjnMetaCode/superpowers-zh当需要开始与当前工作区隔离的功能开发，或在执行实现计划之前使用——通过原生工具或 git worktree 回退机制确保隔离工作区存在EngineeringNo warnings★ 8.4K↓ —
- claude-settings-auditgetsentry/skillsAnalyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.OfficialEngineeringNo warnings★ 1.1K↓ —
- musicelevenlabs/skillsGenerate music using ElevenLabs Music API. Use when creating instrumental tracks, songs with lyrics, background music, jingles, or any AI-generated music composition. Supports prompt-based generation, composition plans for granular control, and detailed output with metadata.OfficialMediaNo warnings★ 515↓ —
- test-driven-developmentmvschwarz/openrigUse when implementing any feature or bugfix, before writing implementation codeTestingNo warnings★ 8.3K↓ —Also in 1 other repo
blog-writing-guide
getsentry/skills
OfficialWritingUpdated 3 days ago
From the author
Write, review, and improve blog posts for the Sentry engineering blog following Sentry's specific writing standards, voice, and quality bar. Use this skill whenever someone asks to write a blog post, draft a technical article, review blog content, improve a draft, write a product announcement, create an engineering deep-dive, or produce any written content destined for the Sentry blog or developer audience. Also trigger when the user mentions "blog post," "blog draft," "write-up," "announcement post," "engineering post," "deep dive," "postmortem," or asks for help with technical writing for Sentry. Even if the user just says "help me write about [feature/topic]" — if it sounds like it could become a Sentry blog post, use this skill.
Install
npx skills add getsentry/skills --skill blog-writing-guide -a claude-code
Installs to .claude/skills/blog-writing-guide/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 92
Security100
Provenance100
Maintenance100
Licence100
Adoption49
Files (1)
- SKILL.md