Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 11 hours ago
47,966 skills
- evidence-hygieneelementalsouls/Claude-BugHunterEvidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.BrowserNo warnings★ 5.4K↓ —
- roblox-physicsgamedev-skills/awesome-gamedev-agent-skillsImplement Roblox physical simulation and queries with assemblies, anchoring, constraints, collision groups, CanCollide/CanTouch/CanQuery, raycasts and overlap queries, mass, impulses, forces, velocity, moving assemblies, cleanup, and network ownership. Use for Roblox collisions, hit detection, RaycastParams, PhysicsService, projectiles, vehicles, knockback, constraints, deprecated BodyMovers, unstable motion, or client-owned physics exploits.ScienceNo warnings★ 5.8K↓ —
- linkedin-hook-extractorsergebulaev/linkedin-skillsReverse-engineer the hook formula from a viral LinkedIn post URL. Returns which of the 20 canonical 2026 formulas it uses (anaphora, R.I.P., year-pivot, time-anchor, curiosity-gap, contrarian, comment-gate, emotional cold-open, named-gratitude, and 11 more), why it worked, and a blank template. Use to learn from a competitor's post, not to write your own (use linkedin-post-writer).MarketingNo warnings★ 5.4K↓ —Also in 1 other repo
- unreal-behavior-treesgamedev-skills/awesome-gamedev-agent-skillsBuild NPC AI in Unreal Engine 5 with Behavior Trees and Blackboards: composites (Selector/Sequence), tasks, decorators, services, and running the tree from an AIController. Use when creating enemy/NPC AI, BT_/BB_ assets, custom BTTask or BTService nodes, or when the user mentions Behavior Tree, Blackboard, AIController, BTTask, decorator, or service.ProductivityNo warnings★ 5.8K↓ —
- clr-activation-debuggingdotnet/skillsDiagnoses .NET Framework CLR activation issues using CLR activation logs (CLRLoad logs) produced by mscoree.dll. Use when: the shim picks the wrong runtime, fails to load any runtime, shows unexpected .NET 3.5 Feature-on-Demand (FOD) dialogs, unexpectedly does NOT show FOD dialogs, loads both v2 and v4 into the same process causing failures, or any time someone is wondering "what is happening with .NET Framework activation?"EngineeringNo warnings★ 5.8K↓ —
- hunt-ntlm-infoelementalsouls/Claude-BugHunterHunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.MarketingNo warnings★ 5.4K↓ —
- typescript-prozebbern/claude-code-guideUse when building TypeScript applications requiring advanced type systems, generics, or full-stack type safety. Invoke for type guards, utility types, tRPC integration, monorepo setup.EngineeringNo warnings★ 4.7K↓ —
- sn-research-reportOpenSenseNova/SenseNova-Skills用于撰写或组织研究报告结构。按读者认知任务（全景/对比/调查/时序）和领域惯例（学术/医疗/法律/政策）选择报告模板。ScienceNo warnings★ 6K↓ —
- hunt-atoelementalsouls/Claude-BugHunterHunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.SecurityNo warnings★ 5.4K↓ —
- mortgage-compliancedavepoon/buildwithclaudeEnforces mortgage regulatory compliance — TRID, RESPA, TILA, ECOA/Fair Lending, state licensing, required disclosures, and data privacy rules for all borrower interactions.LegalNo warnings★ 3.7K↓ —
- post-formatterZJU-REAL/Easel用 PAS、AIDA、BAB、STAR、SLAY 等经典框架将主题结构化为社媒帖子。 200-250 字、20 行以内、移动端友好排版。适用于公众号、知乎、微博、LinkedIn 等长文帖子。 当用户说"用 PAS 写"、"AIDA 框架"、"结构化帖子"、"套框架写"时使用。 和 social-content 的区别：post-formatter 严格套用营销框架，social-content 偏自由写作。MarketingNo warnings★ 4.2K↓ —
- skill-strategy-advisorZJU-REAL/Easel基于现有内容数据和画像迭代优化内容策略。分析过去一段时间的内容表现、画像信息、 行业趋势，给出下一阶段的内容方向调整、新赛道建议、内容形式优化、发布节奏调整、 画像微调等策略建议。当用户说"下一步怎么做"、"策略建议"、"怎么调整"、"内容方向"、 "下个月策略"、"优化建议"、"迭代方向"时触发。 和 skill-content-strategy 的区别：content-strategy 从零制定策略， strategy-advisor 基于现有数据做迭代优化。OtherNo warnings★ 4.2K↓ —
- hex-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate a minimal working Hex example. Use when starting a new Hex integration, testing your setup, or learning basic Hex API patterns. Trigger with phrases like "hex hello world", "hex example", "hex quick start", "simple hex code".TestingNo warnings★ 2.9K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validation. Use when reviewing design before implementation.DesignNo warnings★ 3.7K↓ —
- hex-sdk-patternsjeremylongshore/tons-of-skills-marketplaceApply production-ready Hex SDK patterns for TypeScript and Python. Use when implementing Hex integrations, refactoring SDK usage, or establishing team coding standards for Hex. Trigger with phrases like "hex SDK patterns", "hex best practices", "hex code patterns", "idiomatic hex".EngineeringNo warnings★ 2.9K↓ —
- skill-brand-onboardingZJU-REAL/Easel创作者/品牌入驻：通过结构化访谈收集视觉风格、内容调性、受众画像和运营目标，生成完整的账号画像档案。 当用户说"账号入驻""建档案""新账号建立画像""品牌入驻""从零建号""完善账号信息""onboarding"时使用。 产出覆盖多维度的完整账号档案；只建声音画像用 skill-voice-builder，只建受众画像用 skill-audience-profiler。OtherNo warnings★ 4.2K↓ —
- tradingview-readerhimself65/finance-skillsRead the user's local TradingView desktop app through opencli: quotes, options chains with greeks and per-strike IV, options expiries, screener results across stocks, crypto, forex, futures, and bonds, gainers and losers, news headlines and full stories, alerts (active, fired, offline fires), watchlists including colored flag lists, symbol search, chart state, and chart screenshots. Use this skill whenever the user asks for any of these from TradingView ("TV") — for example an options chain, puts, or IV skew for a ticker, an oversold-stock screen, their red flag list, which alerts fired, or a screenshot of their chart. For plain quotes, TA readouts, scans, or futures without the desktop app, prefer tradingview-mcp. Read-only: it never places trades or edits watchlists, alerts, or layouts.FinanceNo warnings★ 3.5K↓ —
- creator-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks "what did we pay this creator last time" or to "update the creator roster"; curates creator identity, rate, rights, exclusivity, compliance-event, and performance facts through the append-only creators event stream. Not for scoring fit — use fit-scorer; not for reviewing content — use creator-content-auditor. 创作者档案/达人名册LegalNo warnings★ 3K↓ —
- discord-readerhimself65/finance-skillsRead Discord for financial research through opencli connected to the Discord desktop app: servers, channels, members, recent messages in the active channel, and message search. Use this skill whenever the user wants to check their Discord, list servers or channels, read or search messages in trading, crypto, or market communities, or gauge what a Discord community is saying about a ticker or coin. Read-only: it cannot send, react to, edit, or delete messages.ScienceNo warnings★ 3.5K↓ —
- principle-fix-root-causesmichael-denyer/pstack-claudeApply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.EngineeringNo warnings★ 3.7K↓ —
- wiki-queryAr9av/obsidian-wikiSearch and synthesize answers from the compiled Obsidian wiki, including cited and multi-hop answers. Use for questions about existing wiki knowledge or fast index-only lookups, and for challenge requests ("challenge this", "argue against X", "poke holes in my plan") that look for the vault's own evidence against a plan. Supports named-vault routing such as wiki-query @work; not for ingesting new sources.PlanningNo warnings★ 3.6K↓ —
- maintain-verification-skillbacknotprop/pstackPeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.2K↓ —
- fintel-datahimself65/finance-skillsQuery Fintel (fintel.io) institutional market data through its REST API or official MCP server. Use this skill whenever the user mentions Fintel or asks about short interest, short interest ratio or days to cover, short squeeze data, borrow rate or cost to borrow, shares available to borrow, daily short volume, fails-to-deliver (FTD), 13F institutional owners ("who owns X"), insider buying or selling from SEC Form 3/4/5, analyst price targets, ratings and forecasts, dividend or earnings history and calendars, EOD or last prices, security lookup by ticker, CUSIP, ISIN, or FIGI, Fintel leaderboards, or their Fintel watchlists and alerts. Read-only: GET endpoints only.SecurityNo warnings★ 3.5K↓ —
- offensive-wifi-reconSnailSploit/Claude-RedWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each.LegalNo warnings★ 9.9K↓ —
esmfold2
aipoch/open-science
ScienceUpdated 17 hours ago
From the author
Biohub ESMFold2 / ESMFold2-Fast all-atom co-folding (Candido et al. 2026, github.com/Biohub/esm). Single-sequence and MSA modes; protein, DNA, RNA, ligand (CCD/SMILES), modified residues. FoldBench Ab-Ag 50-55%, PPI 70-77% DockQ-pass. Also covers the ESMC-{300M,600M,6B} protein language models from the same release: masked-LM logits, hidden states, mutation scoring, contact prediction, and the SAE interpretability head. MIT-licensed weights on HuggingFace org `biohub`. Use this skill when: (1) Predicting complex structures with single-sequence input, (2) Validating designed binders with ESMFold2-Fast, (3) Running ESMFold2 with MSA input, (4) Getting ESMC embeddings or per-residue mutation scores, (5) Choosing kernel backend and sampling-step settings for paper-faithful throughput.
Install
npx skills add aipoch/open-science --skill esmfold2 -a claude-code
Installs to .claude/skills/esmfold2/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 91
Security100
Provenance85
Maintenance100
Licence100
Adoption59
Files (4)
- .catalog_stamp
- SKILL.md
- references/design-hook.md
- references/esmc.md