Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 10 hours ago
47,966 skills
- borzoiaipoch/open-sciencePredict genome-wide functional tracks (RNA-seq, CAGE, DNase, ChIP) from DNA sequence with Borzoi. Use this skill when: (1) Scoring the regulatory effect of a variant on expression/accessibility, (2) Generating predicted coverage tracks for a locus, (3) Prioritising non-coding variants by predicted track delta.ScienceNo warnings★ 5.4K↓ —
- xss-html-injectionzebbern/claude-code-guideThis skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.SecurityNo warnings★ 4.7K↓ —
- sn-team-harnessOpenSenseNova/SenseNova-SkillsUse when a user asks what SenseNova Team Harness is, wants an introduction or overview, is getting started, or is deciding whether it fits — a self-hosted workspace where people and local AI agents collaborate on conversations, projects, work items, and artifacts. Covers its core concepts (Workspace, Project, Conversation, Agent, WorkItem, Resource, Artifact, Local Computer), main capabilities, how to run it, and the basic usage flow.OtherNo warnings★ 6K↓ —
- learntw93/WazaRuns a six-phase research workflow from source bundle to publish-ready output. Use when researching an unfamiliar domain or compiling materials into one reference. Not for quick lookups or single-file reads.ScienceNo warnings★ 7.5K↓ —Also in 1 other repo
- frontend-session-rcagrafana/skillsDiagnoses a Grafana Frontend Observability (RUM) session: whether it is healthy, what went wrong, ranked problems with timestamps and evidence, likely cause, how to fix it. Optional follow-up: zoom in on the top error, impact across sessions, Session Replay, or a Tempo trace if the user asks. Fetches telemetry with `gcx frontend sessions get --save` and reads only that dump file. Use when the user asks to explain, diagnose, analyse, RCA, or review a session; asks if a session is healthy; pastes Frontend Observability session context (app id, session id, datasource UID); or mentions Faro, user journey, Core Web Vitals, exceptions, ANR, or a web or mobile RUM session — even if they do not say "session narrator" or "frontend-session-rca". Do not use this skill to instrument an app (Faro Web, React Native, Flutter, native OpenTelemetry) — use `app-observability` for Faro Web setup instead.OfficialDesignNo warnings★ 297↓ —
- egm-resolveNewgoogle/elephant-goldfish-modelThe Elephant resolution skill. Ingests flat deficiency reports from concurrent Goldfish reviewers, applies automated fixes for PROPOSE FIX items via UI multiple-choice gates, and presents interactive negotiation/re-sync checkpoints.DesignNo warnings★ 6.5K↓ —Also in 1 other repo
- coordinate-componentsdotnet/skillsShare state between components that don't have a direct parent-child parameter relationship, using cascading values, scoped services with change events, or CascadingValueSource via DI. USE WHEN the user needs a CascadingParameter or CascadingValue that works across render mode boundaries, a shopping cart or notification count accessible from multiple pages, a theme or user preference cascaded app-wide, or when components in different parts of the tree must react when shared data changes. Also USE WHEN cascading values aren't reaching interactive children in per-page interactivity mode, or when the user needs to understand scoped vs singleton service lifetime for state on Blazor Server. DO NOT USE for direct parent-child parameter passing or EventCallback (see author-component), for persisting state across prerender-to-interactive transitions (see support-prerendering), or for service abstractions for data fetching in Auto/WebAssembly (see fetch-and-send-data).MediaNo warnings★ 5.8K↓ —
- paper-compilewanshuiyin/Auto-claude-code-research-in-sleepCompile LaTeX paper to PDF, fix errors, and verify output. Use when user says "编译论文", "compile paper", "build PDF", "生成PDF", or wants to compile LaTeX into a submission-ready PDF.ScienceNo warnings★ 18.3K↓ —Also in 1 other repo
- hunt-brute-forceelementalsouls/Claude-BugHunterHunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).PlanningNo warnings★ 5.4K↓ —
- report-writingelementalsouls/Claude-BugHunterBug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Validation gates and the submittability/always-rejected decision are owned by triage-validation; this skill owns the written report itself (templates, tone, formulas). Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.WritingNo warnings★ 5.4K↓ —
- audit-and-reduce-dependenciesgrafana/skillsReduces JavaScript dependency footprint with pnpm while preserving lockfile, workspace layout, and dependency range style. Runs /check-npm first, then removes unused deps, dedupes versions, ranks transitive closure, and reports Keep/Replace/Remove triage. Use when cleaning up pnpm dependencies, reducing lockfile size, or shrinking node_modules in Grafana plugins; not for Go modules or full GitHub Actions workflow audits.OfficialDevOpsNo warnings★ 297↓ —
- linkedin-employee-advocacysergebulaev/linkedin-skillsStand up and run a LinkedIn employee advocacy program for a marketing or sales team. Covers 14-day launch playbook, brand-guideline governance, per-post time budget, cadence benchmarks, and team ROI (reach, engagement, pipeline). Triggers on "employee advocacy", "get the team posting", "scale LinkedIn across team", "advocacy ROI". Not for planning one person's own calendar (use linkedin-content-planner).MarketingNo warnings★ 5.4K↓ —Also in 1 other repo
- mirrord-propagation-discoverymetalbear-co/mirrordScans a live Kubernetes environment with `mirrord dump` to find an identifier mirrord can filter traffic on: a header, a `baggage` or `tracestate` member, a tenant or user id, a trace id (W3C, B3, X-Ray, Google, Jaeger), a JWT claim, a cookie, a path segment, or a JSON body field that is present on every hop of a request chain, unique to one developer's traffic, and settable by that developer. Runs mirror-only dumps on each service, sends a tagged probe request at the edge or observes real traffic, scores the candidates, and produces the matching `http_filter` (regex, jq on headers, path, method, body, or combinations) plus a per-hop report of where each identifier is dropped. Installs the mirrord CLI through a package manager when it is missing. Use when the user asks what to filter on, whether the cluster already propagates a request id or trace context, how to isolate their own requests on a shared staging cluster, how to filter on a JWT or cookie with mirrord, or wants to inspect live traffic with mirrordDevOpsNo warnings★ 5.4K↓ —
- typescript-prozebbern/claude-code-guideUse when building TypeScript applications requiring advanced type systems, generics, or full-stack type safety. Invoke for type guards, utility types, tRPC integration, monorepo setup.EngineeringNo warnings★ 4.7K↓ —
- lokigrafana/skillsGrafana Loki log aggregation and LogQL query language. Covers LogQL syntax (log queries, metric queries, label matchers, line filters, parsers: json/logfmt/pattern/regexp/unpack, label filters, line_format), Loki architecture, log ingestion via Alloy/Promtail/Fluent Bit, structured metadata, and Logs Drilldown. Use when writing LogQL queries, configuring Loki, troubleshooting log pipelines, or analyzing logs.OfficialWritingNo warnings★ 297↓ —
- mirrord-configmetalbear-co/mirrordHelps users generate, edit, and validate mirrord.json configuration files for mirrord (MetalBear). Use when the user wants to connect their local process to a Kubernetes environment, configure features (env/fs/network), or needs feedback on an existing mirrord.json. Always ensures output JSON is valid and schema-conformant.DevOpsNo warnings★ 5.4K↓ —
- mirrord-chaosmetalbear-co/mirrordHelp users chaos test their app with mirrord: inject artificial latency or connection errors into a mirrord session's outgoing traffic via per-session chaos rules managed with the `mirrord chaos` CLI. Use when a user wants to add latency or delay to outgoing connections or a dependency (e.g. a slow database), simulate connection failures (reset, timed out, refused), test app behavior under degraded network conditions, or wire chaos rules into CI test runs. Always use this skill instead of the deprecated _experimental_.latency mirrord config option.TestingNo warnings★ 5.4K↓ —
- mirrord-kafkametalbear-co/mirrordHelps DevOps engineers configure mirrord Operator's Kafka queue splitting feature end-to-end. Generates the MirrordSplitConfig and MirrordPropertyList Kubernetes CRD YAMLs (the current resources; MirrordKafkaTopicsConsumer + MirrordKafkaClientConfig are deprecated but still supported), the matching mirrord.json split_queues section with message_filter and jq_filter, and Helm value guidance. Use this skill whenever the user mentions Kafka splitting with mirrord, MirrordSplitConfig, MirrordPropertyList, MirrordKafkaClientConfig, MirrordKafkaTopicsConsumer, Kafka queue/topic splitting, configuring mirrord with Kafka, Kafka Streams splitting, MSK IAM auth, or troubleshooting Kafka splitting sessions. Also trigger on split_queues with queue_type Kafka, or connecting mirrord to a Kafka cluster. This is a Team/Enterprise feature of mirrord.DevOpsNo warnings★ 5.4K↓ —
- migrate-xunit-to-xunit-v3dotnet/skillsMigrate .NET test projects from xUnit.net v2 to xunit.v3 and fix v3 breaks. Use for package/CPM conversion, OutputType=Exe, preserving the VSTest or MTP runner (including projects currently using YTest.MTP.XUnit2), incompatible TFMs, async void tests, string-to-Type attributes, custom Fact/Theory/BeforeAfterTest attributes, Xunit.SkippableFact, xunit.abstractions/extensibility consolidation, and Xunit.Combinatorial/StaFact compatibility. Do not use for framework conversion or a runner-only migration. For xUnit v3 MTP filter syntax, also use migrate-vstest-to-mtp.TestingNo warnings★ 5.8K↓ —
- replica-buildJakeschincariol/replica-skillRebuilds an app screen by screen from the recon map: app shell first, then the core flow as a vertical slice, then every screen with all its states, ticking off the feature matrix as it goes. Writes every line fresh, never the original's code, assets or copy. Use when the user says "build the clone", "build screen S07", "start building", "rebuild this screen", "implement the booking page", or after /replica-design.DesignNo warnings★ 6.6K↓ —
- web2-reconelementalsouls/Claude-BugHunterWeb2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.BrowserNo warnings★ 5.4K↓ —
- hunt-aspnetelementalsouls/Claude-BugHunterHunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.PlanningNo warnings★ 5.4K↓ —
- linkedin-content-plannersergebulaev/linkedin-skillsGenerate a 7-day LinkedIn content plan from a theme, audience, and pillars. Produces per-day post pillar, format, hook type, CTA, posting time, daily comment targets, and a weekly inbound-readiness check. Use when the user wants to plan a week or month of content, not draft a single post (use linkedin-post-writer).MarketingNo warnings★ 5.4K↓ —Also in 1 other repo
- your-skill-namegrafana/skillsClear description of what this skill does and when to use it. Use when the user asks about X or wants to work with Y. Include specific trigger phrases so agents auto-load it correctly. Max 1024 characters.OfficialPlanningNo warnings★ 297↓ —
check-npm
grafana/skills
OfficialSecurityUpdated yesterday
From the author
Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
Install
npx skills add grafana/skills --skill check-npm -a claude-code
Installs to .claude/skills/check-npm/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 91
Security100
Provenance100
Maintenance100
Licence100
Adoption41
Files (4)
- SKILL.md
- references/fix-snippets.md
- references/managers.md
- references/protocols.md