Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 8 hours ago
47,966 skills
- hunt-nodejselementalsouls/Claude-BugHunterHunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.SecurityNo warnings★ 5.4K↓ —
- hunt-sqlielementalsouls/Claude-BugHunterHunting skill for sqli vulnerabilities. Built from 12 public bug bounty reports including modern NoSQL injection (Rocket.Chat CVE-2021-22911 MongoDB $regex, Mongoose ORM CVE-2024-53900 $where bypass), modern ORM raw-fragment SQLi (Django CVE-2024-42005, Sequelize GHSA-wrh9-cjv3-2hpw), second-order SOQL injection (HackerOne Salesforce), time-based blind SQLi in GraphQL resolvers, and SQLi on OIDC-proxy backends. Use when hunting SQLi on any target. Dedicated NoSQL operator injection (MongoDB/CouchDB $where/$regex/$ne) is owned by hunt-nosqli — NoSQL appears here only as adjacent ORM/WAF context.SecurityNo warnings★ 5.4K↓ —
- phaser-coregamedev-skills/awesome-gamedev-agent-skillsSet up and debug a Phaser 4 game: the Game config, the Scene lifecycle (init/preload/create/update), the asset loader, cameras, and cross-scene communication. Use when building or debugging a Phaser game — when the user mentions Phaser, Phaser.Game, Phaser.Scene, preload/create/update, this.load, this.add, or scene transitions. For Arcade Physics movement/collisions use phaser-arcade-physics.ScienceNo warnings★ 5.8K↓ —
- computer-useThinkInAIXYZ/deepchatDrive native desktop apps through DeepChat's built-in Computer Use tools. Use when the user asks to operate, inspect, automate, or perform a GUI task in a real desktop application.ProductivityNo warnings★ 6.4K↓ —
- dialogue-systemsgamedev-skills/awesome-gamedev-agent-skillsBuild branching dialogue and narrative — a node/choice graph with conditions, variables, and localization hooks — and choose between authoring tools Ink and Yarn Spinner or a custom data-driven runner. Engine-neutral. Use when the user mentions dialogue system, branching dialogue, conversation tree, choices, Ink (.ink), Yarn Spinner (.yarn), or NPC dialogue.OtherNo warnings★ 5.8K↓ —
- get-prompt-from-imagewuyoscar/GPT-Image2-SkillAnalyze user-provided reference images and reverse-engineer high-fidelity AI image-generation prompts. Use when the user asks to recreate, imitate, reverse-engineer, or extract prompts from photographs, illustrations, 3D renders, products, characters, landscapes, typography, logos, posters, or other visual references. Do not use for requests that only require OCR or an ordinary image description.MediaNo warnings★ 6K↓ —
- code-reviewThinkInAIXYZ/deepchatComprehensive code review assistant that analyzes code quality, security, and best practicesEngineeringNo warnings★ 6.4K↓ —
- egm-drift-reportNewgoogle/elephant-goldfish-modelRuns drift detection on all design documents to check for document and code consistency. Produces an actionable report with differences. Use when the user asks to detect drift or check for consistency across all design documents or READMEs in a directory.DesignNo warnings★ 6.5K↓ —Also in 1 other repo
- hunt-shadow-apielementalsouls/Claude-BugHunterHunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.EngineeringNo warnings★ 5.4K↓ —
- lifelinesbrycewang-stanford/Auto-Empirical-Research-SkillsComplete survival analysis library in Python. Handles right-censored data, Kaplan-Meier curves, and Cox regression. Standard for clinical trial analysis and epidemiology.ScienceNo warnings★ 4.8K↓ —
- hunt-sharepointelementalsouls/Claude-BugHunterHunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection enumeration via Picker.aspx, NTLM Type-2 AD topology disclosure, custom-branding module discovery, EoL farm permanent-CVE-window exploitation, FormDigest anonymous issuance, file-extension blocklist NOT-an-oracle pattern, custom-zone Forms auth bridging on-prem AD. Use when target has SharePoint headers (SPRequestGuid, X-MS-InvokeApp, X-SharePointHealthScore, MicrosoftSharePointTeamServices) or paths (/_layouts/15/, /_vti_bin/, /_api/, /_catalogs/).SecurityNo warnings★ 5.4K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for railway.app — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignNo warnings★ 4.4K↓ —
- starknet-identityinternet-court/internet-court-skillRegister AI agents on-chain using the ERC-8004 Trustless Agents standard. Manage agent identity as NFTs, build reputation through feedback, and request third-party validation.OtherNo warnings★ 7K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for netflix.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignNo warnings★ 4.4K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for retool.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignNo warnings★ 4.4K↓ —
- platformergamedev-skills/awesome-gamedev-agent-skillsBuild a 2D platformer: run/jump control with coyote time, jump buffering, and variable jump height, wall slide and wall jump, plus tiled levels and hazards. Use for a platformer or Mario/Celeste-like, or tuning jump feel.DocumentsNo warnings★ 5.8K↓ —
- excel-threshold-analysis-and-stylingOpenSenseNova/SenseNova-Skills根据 Excel 数据量级自动判断处理策略，执行数值列清洗、条件过滤，并使用 openpyxl 对符合条件的单元格进行样式标记与导出。DocumentsNo warnings★ 6K↓ —
- hunt-ssrfelementalsouls/Claude-BugHunterHunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.SecurityNo warnings★ 5.4K↓ —
- antfu-issue-triageantfu/skillsTriage open issues and PRs of the current GitHub repo - find already-fixed, duplicate, and spam items, suggest labels, gauge demand from reactions and comments, then present a table of proposed actions and comments for confirmation before touching anything. Use when asked to triage, organize, clean up, or groom issues and PRs.OtherNo warnings★ 6K↓ —
- remote-compute-sshaipoch/open-scienceEvaluate and use SSH Remote Compute before choosing where to run GPU, high-memory, parallel, batch, model-inference, bioinformatics, or other long-running scientific work; supports short remote commands and asynchronous jobs with automatic harvest and analysis.ScienceNo warnings★ 5.4K↓ —
- linkedin-hook-extractorsergebulaev/linkedin-skillsReverse-engineer the hook formula from a viral LinkedIn post URL. Returns which of the 20 canonical 2026 formulas it uses (anaphora, R.I.P., year-pivot, time-anchor, curiosity-gap, contrarian, comment-gate, emotional cold-open, named-gratitude, and 11 more), why it worked, and a blank template. Use to learn from a competitor's post, not to write your own (use linkedin-post-writer).MarketingNo warnings★ 5.4K↓ —Also in 1 other repo
- deepchat-cliThinkInAIXYZ/deepchatUse DeepChat's bundled CLI control plane for model inference, image/video/speech generation, transcription, OCR, artifact inspection, public configuration, Skills, and MCP operations. Activate when a user asks to invoke DeepChat capabilities that are not already exposed as a more specific tool, compare models, run a benchmark, inspect DeepChat runtime state, or manage DeepChat through the CLI.EngineeringNo warnings★ 6.4K↓ —
- test-analysis-extensionsdotnet/skillsProvides file paths to language-specific reference files for the test ANALYSIS skills (assertion-quality, test-anti-patterns, test-gap-analysis, test-smell-detection, test-tagging). Read this catalog to discover available extension files (e.g., dotnet.md for .NET/MSTest/xUnit/NUnit/TUnit, python.md for pytest/unittest, typescript.md for Jest/Vitest/Mocha, java.md for JUnit/TestNG, etc.). Do not invoke this reference-only skill — its bundled files are read by the quality agent and analysis skills needing framework-specific lookup tables (test markers, assertion APIs, skip annotations, sleep patterns, mystery guest indicators, integration markers, setup/teardown, tag-support capability).TestingNo warnings★ 5.8K↓ —
- html-injection-testingzebbern/claude-code-guideThis skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.TestingNo warnings★ 4.7K↓ —
send-data
grafana/skills
OfficialDevOpsUpdated 23 hours ago
From the author
Sending telemetry data to Grafana Cloud — metrics via Prometheus remote write or OTLP, logs via Loki push or Alloy, traces via OTLP to Tempo, profiles via Pyroscope. Covers Alloy-based pipelines, direct SDK/agent integrations, cloud integrations catalog, and credentials management. Use when connecting an application or infrastructure to Grafana Cloud, setting up data ingestion, configuring remote write, or choosing between ingestion methods.
Install
npx skills add grafana/skills --skill send-data -a claude-code
Installs to .claude/skills/send-data/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 91
Security100
Provenance100
Maintenance100
Licence100
Adoption41
Files (1)
- SKILL.md