Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,604 skills from 2,205 repositories · updated 13 hours ago
44,573 skills
- thermosmichael-denyer/pstack-claudeLaunch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.SecurityNo warnings★ 3.4K↓ —
- sharpenmichael-denyer/pstack-claudeSharpen a task before starting: the expert approach, what the user is really after, and the right level of specification. Use for /sharpen.PlanningNo warnings★ 3.4K↓ —
- genotoxictrailofbits/skillsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.TestingNo warnings★ 7.8K↓ —
- code-slice-heroheygen-com/hyperframesA tiled headline surface flips cell by cell under a sweeping depth field to reveal the rear headline. HyperFrames block, 1920×1080, 8s, 18 variables.OfficialEngineeringNo warnings★ 71.8K↓ —
- cosmos-vulnerability-scannertrailofbits/skillsScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.SecurityNo warnings★ 7.8K↓ —
- work-with-prcode-yeongyu/oh-my-openagentFull PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the smallest atomic, independently-mergeable PRs and builds the independent ones concurrently via one worktree per PR driven by parallel subagents or a team. Unbounded loop: any failing gate sends you back to fix-and-re-QA inside that PR's worktree. Use whenever implementation work needs to land as a PR. Triggers: 'create a PR', 'implement and PR', 'work on this and make a PR', 'implement issue', 'land this as a PR', 'split into atomic PRs', 'parallel PRs', 'work-with-pr', 'PR workflow', 'implement end to end', even when user just says 'implement X' if the context implies PR delivery.TestingNo warnings★ 70.3K↓ —Also in 1 other repo
- hyperplancode-yeongyu/oh-my-openagentAdversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', 'adversarial plan', 'hostile planning', 'cross-critique plan', '하이퍼플랜', '적대적 계획', '교차 비평'.PlanningNo warnings★ 70.3K↓ —
- fp-checktrailofbits/skillsSystematically verifies suspected security bugs to eliminate false positives, producing a TRUE POSITIVE or FALSE POSITIVE verdict with documented evidence for each. Use when asked whether a specific finding is real, exploitable, or a false positive, or to verify or validate a suspected vulnerability — not for hunting or discovering new bugs.SecurityNo warnings★ 7.8K↓ —
- vector-forgetrailofbits/skillsMutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/after mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving test vector coverage for crypto primitives.TestingNo warnings★ 7.8K↓ —
- terraform-stackshashicorp/agent-skillsComprehensive guide for working with HashiCorp Terraform Stacks. Use when creating, modifying, or validating Terraform Stack configurations (.tfcomponent.hcl, .tfdeploy.hcl files), working with stack components and deployments from local modules, public registry, or private registry sources, managing multi-region or multi-environment infrastructure, or troubleshooting Terraform Stacks syntax and structure.OfficialDevOpsNo warnings★ 907↓ —
- arenamichael-denyer/pstack-claudeSpawn N parallel candidates at the same task, pick a base, graft the strongest parts of the losers into it. Use for /arena, 'arena this', 'throw it in the arena', or when one attempt at a non-trivial artifact would lock in the wrong shape.ProductivityNo warnings★ 3.4K↓ —
- remotion-to-hyperframesheygen-com/hyperframesBring existing video code or footage into HyperFrames and verify it frame by frame against the original - Remotion first, also Motion Canvas, Lottie, Three.js, p5.js, canvas or plain HTML/CSS animation, or renders from Manim, After Effects or Blender. Use to port, convert, migrate or reuse work made with another tool.OfficialDesignNo warnings★ 71.8K↓ —
- x-searchcode-yeongyu/oh-my-openagentMUST read before searching X/Twitter with the x_search tool. When xAI is connected: date-bound every time-sensitive query (from_date >= yesterday, widen to 7 days), scope trusted accounts with allowed_x_handles, phrase queries as latest/recent with since:/from:/filter: operators, split into 2-3 searches by account and by keyword, and reconcile against web_search. Triggers: X search, Twitter search, tweets, posts on X, what people are saying on X, x_search, social signal.OtherNo warnings★ 70.3K↓ —
- tao-train-dinov3NVIDIA/skillsDINOv3 continual self-supervised pre-training. Domain-adapts public DINOv3 ViT backbones on unlabeled images via teacher-student self-distillation (DINO + iBOT + KoLeo, optional Gram anchoring) and converts the EMA teacher into a timm-format backbone for downstream tasks. Trigger phrases include "train DINOv3", "DINOv3 SSL", "domain-adapt a foundation backbone", "continual pretraining", "self-supervised finetune DINOv3".ProductivityNo warnings★ 3.7K↓ —
- pre-publish-reviewcode-yeongyu/oh-my-openagentNuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release synthesis. Runs ONLY when the user explicitly asks for a pre-publish review — a plain publish/release request MUST NOT trigger this; /publish ships directly. Triggers: 'pre-publish review', 'review before publish', 'release review', 'pre-release review', 'ready to publish?', 'can I publish?', 'pre-publish', 'safe to publish', 'publishing review', 'pre-publish check'.EngineeringNo warnings★ 70.3K↓ —Also in 1 other repo
- canvas-designdavepoon/buildwithclaudeCreate beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.DesignNo warnings★ 3.7K↓ —
- tech-debt-auditcode-yeongyu/oh-my-openagentThorough, file-cited technical debt audit across 9 dimensions using AST-grep (tree-sitter), grep, LSP, and language-native tooling. Produces TECH_DEBT_AUDIT.md with severity, effort estimates, and prioritized fixes. Use when asked for codebase health check, tech debt audit, architecture review, code quality assessment, or cleanup planning. Triggers: 'tech debt', 'technical debt', 'debt audit', 'code health', 'technical debt audit', 'codebase health check', 'find tech debt', 'debt analysis', 'audit code quality'.PlanningNo warnings★ 70.3K↓ —
- mass-ulwcode-yeongyu/oh-my-openagentDrives dependency-ordered child work through the native workflow tool, each phase's stages defined up front in one run, with retry/amend/send recovery. Use when the user asks for mass-ulw, a DAG of tasks, or fan-out work where some tasks must wait on others.ProductivityNo warnings★ 70.3K↓ —
- narrative-enablement-kitaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "make everyone tell the same story", "write our elevator pitch ladder", or "build a spokesperson Q&A and approved boilerplate pack"; derives from the narrative-registry canon, message house, and brand voice a repeatable enablement kit — an elevator ladder (10-second / 30-second / 2-minute), a spokesperson Q&A (tough questions with on-canon answers), an approved boilerplate/bio pack (25 / 50 / 100-word), and a do/don't language sheet — so sales, support, founders, and partners repeat one consistent story. Not for the launch-day runbook — use launch-day-conductor; not for finished per-channel copy — use content-writer or each discipline creative builder; not for launch-window battle cards — use sales-enablement-kit; this kit never adjudicates a claim. 叙事赋能包/电梯梯度/发言人问答/审定样板/该说不该说WritingNo warnings★ 3K↓ —
- coda-automationdavepoon/buildwithclaudeAutomate Coda tasks via Rube MCP (Composio): manage docs, pages, tables, rows, formulas, permissions, and publishing. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- attribution-reconcileraaron-he-zhu/aaron-marketing-skillsUse when platform-reported conversions disagree with GA4/ecommerce, when you suspect Meta and Google are double-counting the same sales, or for a standing (monthly) reconciliation workbook that de-dups stacked credit against an order-ID truth set, normalizes attribution windows and currency, compares attribution models, and reads incrementality from a geo/holdout test. Not for the point-in-time R2 veto or RQS gate — use ad-account-auditor; not for the ROI/ROAS ratio math itself — use roi-calculator; not for organic dark-social share attribution or GA4 direct-traffic decomposition — use dark-social-attributor. 付费广告归因对账/去重/增量TestingNo warnings★ 3K↓ —
- serp-analysisaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze the SERP" or "SERP分析"; maps SERP features, layout, ranking factors, search intent, AI Overviews, and snippet opportunities for a query. Not for keyword demand discovery — use keyword-research. SERP分析/搜索结果ScienceNo warnings★ 3K↓ —
- tiledbvcfforyourhealth111-pixel/Vibe-SkillsEfficient storage and retrieval of genomic variant data using TileDB. Scalable VCF/BCF ingestion, incremental sample addition, compressed storage, parallel queries, and export capabilities for population genomics.ScienceNo warnings★ 3.8K↓ —Also in 1 other repo
- doca-staNVIDIA/skillsUse this skill when the user builds an NVMe-over-Fabrics storage target on BlueField with DOCA STA — instantiating doca_sta, declaring doca_sta_subsystem NQNs and namespaces over local NVMe disks via doca_sta_be, validating platform support with doca_sta_cap_is_supported, sizing I/O queue depth, or decoding DOCA_ERROR_* statuses such as IO_FAILED on NVMe reads. Also load it for implied asks like "Identify Controller times out over RoCE", "offload the nvmf target", "NVMe-oF Connect never completes", or "16 I/O queues at depth 1024 — supported?". Refuse and route to the proper owner for raw RDMA movement, packet I/O, steering rules, initiator-side NVMe, or SDK install.OtherNo warnings★ 3.7K↓ —
entry-point-analyzer
trailofbits/skills
SecurityUpdated 2 days ago
From the author
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
Install
npx skills add trailofbits/skills --skill entry-point-analyzer -a claude-code
Installs to .claude/skills/entry-point-analyzer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (10)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/cosmwasm.md
- references/move-aptos.md
- references/move-sui.md
- references/solana.md
- references/solidity.md
- references/ton.md
- references/vyper.md