Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 11 hours ago
47,966 skills
- yellow-settlement-roominternet-court/internet-court-skillYellow Network Protocol app sessions for AI agents - a shared room where several agents pool funds, reallocate off-chain at machine speed, and settle one final split. Use for multiparty settlement among agents. Covers connecting, the funded-account prerequisite, creating a session with participants + weights + quorum, deposit, operate, withdraw, close, and the trust boundary. Grounded in the official @yellow-org/sdk lifecycle example.OtherNo warnings★ 7K↓ —
- okx-growth-competitioninternet-court/internet-court-skillList OKX Agentic Wallet exclusive trading competitions, register users for contests, track participation and leaderboard rankings, and claim won rewards. Use when users want to list available trading competitions or trading cups, view competition rules / prize pool / total prizes, register or sign up or enroll or join a contest, check the leaderboard (who is winning) or their own rank (am I in the prize zone, what is my place), ask did I win or query participation / claim status, claim won rewards or prizes from completed competitions, see which wallet account they registered with, or submit Telegram / WeChat / Email / Twitter contact for prize delivery to top-tier winners.MarketingNo warnings★ 7K↓ —
- jupiter-swap-migrationinternet-court/internet-court-skillMigration guide from Jupiter Metis (v1) or Ultra to Swap API v2. Use when migrating existing Jupiter swap integrations, updating base URLs, or transitioning from quote+swap-instructions to the unified build endpoint.EngineeringNo warnings★ 7K↓ —
- hunt-mfa-bypasselementalsouls/Claude-BugHunterHunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.EngineeringNo warnings★ 5.4K↓ —
- solana-devinternet-court/internet-court-skillUse when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", "deploy to devnet", or "explain Solana concepts" (rent, accounts, PDAs, CPIs, etc.). Also use for quick on-chain lookups via public RPC + curl — "what's the balance of <wallet>", "look up transaction <sig>", "token balance for <account>", "check this address on mainnet/devnet". End-to-end Solana development playbook covering wallet connection, Anchor/Pinocchio programs, Codama client generation, Surfpool/LiteSVM/Mollusk testing, security checklists, and JSON-RPC curl lookups against public clusters. Prefers @solana/kit v7 plugin clients (createClient + .use()), wallet connection via @solana/kit-plugin-wallet + @solana/react, web3.js v3 (Kit internals, RC) as the migration target for legacy codebases, and Surfpool for local networks and integration testing.SecurityNo warnings★ 7K↓ —
- hunt-subdomainelementalsouls/Claude-BugHunterHunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).SecurityNo warnings★ 5.4K↓ —
- eliminate-redundant-restoresdotnet/skillsRemove repeated NuGet restores from multi-step .NET builds safely. USE FOR: build/test/publish steps that each restore, Directory.Build.rsp with -restore, safe restore suppression, NETSDK1004/NETSDK1047 after --no-restore. DO NOT USE FOR: slow first restore, only one restore, version or lock errors, unranked build slowness (use build-perf-baseline).TestingNo warnings★ 5.8K↓ —
- linkedin-profile-optimizersergebulaev/linkedin-skillsAudit and rewrite a LinkedIn profile end-to-end for 2026: headline, About 7-step, Featured, banner, photo, Experience metrics, Skills, custom URL, recommendations. Triggers on "review my profile", "rewrite my headline", "fix my About", "optimize banner", "profile audit", "LinkedIn bio". Converts resume-style profiles to ones that convert 3-5x better. Not for writing feed content (use linkedin-post-writer).MarketingNo warnings★ 5.4K↓ —Also in 1 other repo
- agent-walletinternet-court/internet-court-skillGive the AI agent its own EVM wallet with admin-controlled policies the agent CANNOT bypass even under prompt injection. Encrypted keystore (AES-256-GCM, scrypt KDF), policy file the agent has no tool to write, deterministic policy gate on every signing operation, optional local HTTP dashboard. Triggers: agent wallet, give the agent a wallet, agent address, fund the agent, agent autonomy, policy gate, kill switch, agent permissions, bounded autonomy, ERC-4337 alternative, session-key alternative.WritingNo warnings★ 7K↓ —
- fit-scoreraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "score this influencer", "rank these creators for our campaign", or "tell me which influencer is the best fit"; produces the typed STAR Suitability (S) read plus a separately labeled campaign-fit ranking without mixing campaign-specific commercial fit into the Suitability read. Not for finding new influencers — use influencer-discovery; not for sending outreach — use outreach-manager. 达人适配度评分/创作者筛选排名MarketingNo warnings★ 3K↓ —
- content-quality-auditoraaron-he-zhu/aaron-marketing-skillsUse when auditing content quality, E-E-A-T, or publish readiness; runs a typed 80-item CORE-EEAT profile with evidence coverage, veto checks, and a fix plan. Not for structural tags/headers alone — use on-page-seo-checker; not for domain/citation trust — use domain-authority-auditor. 内容质量/EEAT评分MarketingNo warnings★ 3K↓ —
- fuzzing-dictionarytrailofbits/skillsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.PlanningNo warnings★ 7.9K↓ —
- solve-challengeljagiello/ctf-skillsSolves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.PlanningNo warnings★ 3.6K↓ —
- ctf-ai-mlljagiello/ctf-skillsProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.OtherNo warnings★ 3.6K↓ —
- golang-how-tosamber/cc-skills-golangGolang skills orchestrator — always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most relevant skills from samber/cc-skills-golang, often multiple at once: writing a gRPC service loads golang-grpc + golang-testing + golang-error-handling; debugging a panic loads golang-troubleshooting + golang-safety; auditing security loads golang-security + golang-lint + golang-safety. Also: disambiguates competing clusters when two skills seem to overlap (performance vs benchmark vs troubleshooting, samber/lo vs mo vs ro, DI cluster, safety vs security), and configures the project's agent-config file (CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, or Copilot instructions) to force-trigger skills in a project (/golang-how-to configure).SecurityNo warnings★ 3.7K↓ —
- thought-partnerjeremylongshore/tons-of-skills-marketplaceCollaborative thinking partner for exploring ideas, challenges, and decisions. Use when the user needs to analyze ambiguity, test assumptions, or compare options. Trigger with "think through", "explore", "brainstorm", "help me figure out", or an open-ended strategy or priority question.TestingNo warnings★ 2.9K↓ —
- hex-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Hex rate limiting, backoff, and idempotency patterns. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Hex. Trigger with phrases like "hex rate limit", "hex throttling", "hex 429", "hex retry", "hex backoff".EngineeringNo warnings★ 2.9K↓ —
- cairo-vulnerability-scannertrailofbits/skillsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.SecurityNo warnings★ 7.9K↓ —
- groq-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Groq rate limit handling with backoff, queuing, and header parsing. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Groq. Trigger with phrases like "groq rate limit", "groq throttling", "groq 429", "groq retry", "groq backoff".EngineeringNo warnings★ 2.9K↓ —
- remotion-to-hyperframesheygen-com/hyperframesBring existing video code or footage into HyperFrames and verify it frame by frame against the original - Remotion first, also Motion Canvas, Lottie, Three.js, p5.js, canvas or plain HTML/CSS animation, or renders from Manim, After Effects or Blender. Use to port, convert, migrate or reuse work made with another tool.OfficialDesignNo warnings★ 75.8K↓ —
- i4h-workflow-finetuneNVIDIA/skillsFine-tune a manifest-backed GR00T or openpi remote Task on compatible LeRobot data. Use for training; do not use for inference-only Tasks or checkpoint rollout.ProductivityNo warnings★ 3.8K↓ —
- ramp-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect a minimal, safe Ramp API diagnostic bundle centered on trace IDs and reproducible contract evidence. Use when escalating a persistent API, webhook, deferred-task, or accounting failure. Trigger with "Ramp debug bundle" or "Ramp support evidence".EngineeringNo warnings★ 2.9K↓ —
- tao-train-single-stepNVIDIA/skillsStandard single-step train/eval/export workflow for any TAO model. Use when training a TAO model on a dataset without iterative data augmentation, AutoML, or DEFT loops. Trigger phrases include "single train run", "train then evaluate then export", "plain TAO training", "normal training", "no AutoML", "skip the loop". Routes through the per-model SKILL.md for action specifics and through `tao-launch-workflow` for platform/credentials/dataset intake.PlanningNo warnings★ 3.8K↓ —
- options-payoffhimself65/finance-skillsRender an interactive options payoff chart — expiry P&L plus Black-Scholes theoretical value — with sliders for strikes, premium, IV, DTE, and spot. Use this skill whenever the user describes or shares an options position or strategy and wants to see how it makes or loses money: vertical, calendar, diagonal, or ratio spreads, butterflies, condors and iron condors, straddles, strangles, covered calls, protective or naked puts, or any multi-leg structure. This includes pasted strikes, premiums, and expiries, requests like "show me the payoff" or "draw the P&L curve", and broker screenshots (IBKR, TastyTrade, Robinhood). Use it even when details are partial — defaults fill the gaps.MediaNo warnings★ 3.5K↓ —
hunt-subdomain
elementalsouls/Claude-BugHunter
SecurityUpdated 20 hours ago
From the author
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-subdomain -a claude-code
Installs to .claude/skills/hunt-subdomain/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (MIT) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 91
Security100
Provenance85
Maintenance100
Licence100
Adoption59
Files (1)
- SKILL.md