Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 25 minutes ago
47,966 skills
- hunt-spa-apielementalsouls/Claude-BugHunterDiscover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.EngineeringNo warnings★ 5.4K↓ —
- sn-deepresearch-cliOpenSenseNova/SenseNova-Skills一键启用 SenseNova-Skills-DeepResearch，用于行业与市场研究、竞品分析、政策或技术调研、商业尽调、趋势分析、方案对比、事实核查，以及研究报告、白皮书等交付场景。用户提出深度研究、调研、调查、尽调、research/deepresearch，或任务需要跨来源取证、多维度比较和交叉验证时主动使用；Skill 会完成环境检查、SenseNova-Skills-DeepResearch 安装或升级、Harness 与 Search/Camofox 准备、参数确认、研究启动和 Web 进度提示。简单常识问答、单一来源整理和纯文字润色不使用。EngineeringNo warnings★ 6K↓ —
- frontend-session-rcagrafana/skillsDiagnoses a Grafana Frontend Observability (RUM) session: whether it is healthy, what went wrong, ranked problems with timestamps and evidence, likely cause, how to fix it. Optional follow-up: zoom in on the top error, impact across sessions, Session Replay, or a Tempo trace if the user asks. Fetches telemetry with `gcx frontend sessions get --save` and reads only that dump file. Use when the user asks to explain, diagnose, analyse, RCA, or review a session; asks if a session is healthy; pastes Frontend Observability session context (app id, session id, datasource UID); or mentions Faro, user journey, Core Web Vitals, exceptions, ANR, or a web or mobile RUM session — even if they do not say "session narrator" or "frontend-session-rca". Do not use this skill to instrument an app (Faro Web, React Native, Flutter, native OpenTelemetry) — use `app-observability` for Faro Web setup instead.OfficialDesignNo warnings★ 297↓ —
- hunt-sessionelementalsouls/Claude-BugHunterHunt Session Management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).SecurityNo warnings★ 5.4K↓ —
- mirrord-prev-envmetalbear-co/mirrordHelp users create and manage mirrord preview environments — running a modified service as an isolated pod in a shared Kubernetes cluster, scoped by an environment key and HTTP/queue traffic filtering, so teams can validate and review changes against real traffic without affecting live services. Use when a developer wants to run "mirrord preview" ad hoc, share a preview via a link (mirrord-share-ingress), or wire preview environments into CI with the metalbear-co/mirrord-preview GitHub Action (e.g. per-PR previews, least-privilege cluster access).DevOpsNo warnings★ 5.4K↓ —
- top-web-vulnerabilitieszebbern/claude-code-guideThis skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.SecurityNo warnings★ 4.7K↓ —
- hunt-grpcelementalsouls/Claude-BugHunterHunt gRPC vulnerabilities — server reflection enabled (enumerate all services/methods), missing authentication / metadata-stripping on internal endpoints, plaintext gRPC over HTTP/2, internal endpoint disclosure, proto file leakage, gRPC-Web/grpc-gateway transcoding injection, and HTTP/2 Rapid Reset DoS (CVE-2023-44487). Use when target exposes port 50051 / 443 / 8443 / 9090 with HTTP/2, when grpcurl/grpcui detects reflection, when an Envoy or grpc-gateway proxy is fronting a microservice, or when recon reveals a microservice architecture.SecurityNo warnings★ 5.4K↓ —
- hunt-sstielementalsouls/Claude-BugHunterHunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.DocumentsNo warnings★ 5.4K↓ —
- excel-sheet-filter-exportOpenSenseNova/SenseNova-Skills动态统计多Sheet Excel文件行数以判断大文件处理逻辑，并根据特定条件筛选数据、重命名字段后导出为包含下载链接的新Excel文件，适用于多Sheet数据探查与条件过滤导出场景。DocumentsNo warnings★ 6K↓ —
- dynamic-large-file-parquet-analysisOpenSenseNova/SenseNova-Skills动态统计Excel总行数，当数据量过大（≥10000行）时自动转换为Parquet格式加速读取，并对指定目标列进行条件筛选、分类汇总与结果导出，适用于超大体积Excel文件的快速读取与统计分析。DocumentsNo warnings★ 6K↓ —
- authoring-github-workflowsdotnet/skillsAuthor and review GitHub Actions workflow YAML safely so syntactically-valid YAML can't ship a workflow that GitHub Actions refuses to run. USE FOR: editing, adding, or reviewing any file under .github/workflows/, writing run-name/name/if/env/run values that contain ${{ }} expressions, diagnosing a run that fails with 'This run likely failed because of a workflow file issue' and no jobs starting, deciding when a workflow scalar must be quoted, validating workflows with actionlint. DO NOT USE FOR: authoring application YAML unrelated to GitHub Actions, Azure Pipelines, GitLab CI, or non-workflow YAML. SCOPE: this skill covers *syntactic/structural* correctness of workflow YAML (quoting, parsing, actionlint); for *semantic and functional* workflow design (what a workflow should do, agentic-workflow behavior), see .github/agents/agentic-workflows.agent.md — the two are complementary. INVOKES: actionlint (downloaded pinned binary) plus git/grep for inspection.DevOpsNo warnings★ 5.8K↓ —
- kleros-curateinternet-court/internet-court-skillInteract with Kleros Curate registries across Ethereum Mainnet, Gnosis Chain, and Sepolia. Use when the user mentions Curate, Light Curate/LightGeneralizedTCR/LGTCR, Stake Curate/PermanentGTCR/PGTCR, Scout, token-curated registry/TCR, token lists, address/CDN tags, Goldsky, MetaEvidence, Verify Your List, or Curate calls such as addItem, removeItem, challengeItem, challengeRequest, and fundAppeal. Covers registry discovery and queries; policy/schema inspection; submissions, removals, challenges, evidence, appeals, rewards, execution; factory deployment; and frontend verification on all three networks. Also trigger for registry/list operations paired with Kleros, arbitrator, dispute, juror, or PNK context, and whenever the user names or tests kleros-curate. Do NOT use for non-Kleros registries or generic IPFS uploads without Curate context; route standalone uploads to kleros-ipfs-upload.TestingNo warnings★ 7K↓ —
- ligandmpnnaipoch/open-scienceInverse-fold a backbone with ligand, nucleic-acid, and metal context using LigandMPNN (Dauparas et al. 2023, github.com/dauparas/LigandMPNN). Reach for this skill to redesign the residues lining a binding pocket around a bound small molecule or cofactor, to design metal-coordinating sites where the geometry must be respected, or to get threaded designed-sequence PDBs out of any MPNN run.DesignNo warnings★ 5.4K↓ —
- code-testingdotnet/skillsALWAYS USE for test work that requires changes: write, add, generate, repair, or strengthen tests for existing code in xUnit, MSTest, NUnit, pytest, Vitest/Jest, Go, or another framework. Includes regression cases, failing or flaky tests, coverage-driven additions, and audit-then-fix requests. Focused work stays direct; broad or multi-stage work invokes test-engineer. DO NOT USE for only running tests, analysis-only audits, framework/platform migrations, a test blocked on a missing production seam (testability-obstacle), or MSTest API/configuration corrections that do not design new cases (writing-mstest-tests). Within an active test-engineer pipeline, reuse supplied guidance and do not re-enter this skill.TestingNo warnings★ 5.8K↓ —
- unreal-enhanced-inputgamedev-skills/awesome-gamedev-agent-skillsSet up player input in Unreal Engine 5 with Enhanced Input: Input Actions, Input Mapping Contexts, modifiers and triggers, adding the mapping context, and binding actions by ETriggerEvent. Use when wiring movement/look/jump input, creating IA_/IMC_ assets, binding in C++ or Blueprints, or when the user mentions Enhanced Input, Input Mapping Context, Input Action, IA_/IMC_, or ETriggerEvent.ProductivityNo warnings★ 5.8K↓ —
- hunt-nosqlielementalsouls/Claude-BugHunterHunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.OtherNo warnings★ 5.4K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for duolingo.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignNo warnings★ 4.4K↓ —
- vercel-composition-patternszebbern/claude-code-guideReact composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.MediaNo warnings★ 4.7K↓ —
- run-testsdotnet/skillsALWAYS USE before running .NET tests or answering with a test command or flags. Trigger on "run the tests", "exact dotnet test command", one test/class/category/trait/target framework, combined filters, `--filter-query`, `--no-build`, `--diag`, diagnostic logs, TRX, coverage collection, crash/hang dumps, filter errors, or unrecognized options. Chooses repository-compatible classic, VSTest, bridged MTP, or native MTP syntax for MSTest/xUnit/NUnit/TUnit. DO NOT USE for platform identification alone (platform-detection), writing or debugging test code, interpreting an existing coverage report, CI investigation, migration, or a persistent hot reload/watch loop.TestingNo warnings★ 5.8K↓ —
- threejs-scene-setupgamedev-skills/awesome-gamedev-agent-skillsStand up a three.js scene: import maps and the three/addons path, the Scene/PerspectiveCamera/WebGLRenderer trio, the setAnimationLoop render loop, responsive resize, OrbitControls, and opting into WebGPURenderer. Use when starting or debugging a three.js app — when the user mentions three.js, THREE.Scene, WebGLRenderer, WebGPURenderer, PerspectiveCamera, the render loop, resizing, or OrbitControls. For models use threejs-gltf-loading; for materials/lights use threejs-materials-lighting.MediaNo warnings★ 5.8K↓ —
- large-file-parquet-analysis-and-highlightOpenSenseNova/SenseNova-Skills当Excel文件总行数超过1万行时，通过转换为Parquet格式提升读取性能，提取目标指标并计算最大值，最后将结果输出为Excel并对特定行进行高亮标注。DocumentsNo warnings★ 6K↓ —
- pie-chart-data-analysisOpenSenseNova/SenseNova-Skills对多Sheet Excel或CSV数据进行分类汇总统计，自动识别关键字段并生成包含占比、数值及美化饼图的可下载分析报告。DataNo warnings★ 6K↓ —
- mirrord-temporalmetalbear-co/mirrordHelps DevOps engineers configure mirrord Operator's Temporal task queue splitting feature end-to-end. Generates the MirrordSplitConfig and MirrordPropertyList Kubernetes CRD YAMLs, the matching mirrord.json split_queues section with message_filter and jq_filter, and Helm value guidance. Use this skill whenever the user mentions Temporal splitting with mirrord, Temporal task queue splitting, splitting a Temporal worker, configuring mirrord with Temporal or Temporal Cloud, routing Temporal workflow or activity tasks to a local worker, or troubleshooting Temporal splitting sessions. Also trigger on split_queues with queue_type Temporal, or connecting mirrord to a Temporal frontend. This is an alpha Team/Enterprise feature of mirrord.DevOpsNo warnings★ 5.4K↓ —
- database-optimizerzebbern/claude-code-guideUse when investigating slow queries, analyzing execution plans, or optimizing database performance. Invoke for index design, query rewrites, configuration tuning, partitioning strategies, lock contention resolution.DataNo warnings★ 4.7K↓ —
linkedin-marketing
sergebulaev/linkedin-skills
MarketingUpdated 3 days ago
From the author
Plan, draft, audit, and publish LinkedIn posts and comments. Use when the user wants to write a viral LinkedIn post, draft a comment or reply on any LinkedIn post URL, audit a draft against 2026 algorithm heuristics, remove AI tells, extract hook formulas from viral posts, or plan a week of content. Powered by the Publora API for publishing. User provides post/comment URLs, skill drafts content, user approves, then publishes.
Install
npx skills add sergebulaev/linkedin-skills --skill linkedin-marketing -a claude-code
Installs to .claude/skills/linkedin-marketing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 91
Security100
Provenance85
Maintenance100
Licence100
Adoption59
Files (12)
- .codexignore
- .env.example
- .gitignore
- AGENTS.md
- CLAUDE.md
- LICENSE
- README.md
- SECURITY.md
- SKILL.md
- requirements-dev.txt
- requirements-lock.txt
- requirements.txt