Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 11 hours ago
47,966 skills
- hunt-ssrfelementalsouls/Claude-BugHunterHunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.SecurityNo warnings★ 5.4K↓ —
- remote-compute-sshaipoch/open-scienceEvaluate and use SSH Remote Compute before choosing where to run GPU, high-memory, parallel, batch, model-inference, bioinformatics, or other long-running scientific work; supports short remote commands and asynchronous jobs with automatic harvest and analysis.ScienceNo warnings★ 5.4K↓ —
- grade-testsdotnet/skillsGrade curated individual tests for readiness, A-F quality and improvements. ALWAYS USE FOR: grade tests, review only a named test, per-test readiness or quality bands for supplied methods, bodies, file spans or bounded PR diffs, including existing tests. Return Pass/Failed/Uncertain/Not applicable; unresolved/empty scopes omit grades. Compose read-only per-test evidence. Polyglot. DO NOT USE FOR: suite audits (test-engineer/test-anti-patterns), concrete fix/feature detection proof (test-value-evidence), writing/fixing tests, or coverage.TestingNo warnings★ 5.8K↓ —
- testinggrafana/skillsProbe, load-test, and instrument frontends from Grafana Cloud. Covers Synthetic Monitoring (HTTP / DNS / TCP / Ping / Traceroute / Multihttp / k6-browser scripted checks from 20+ global probes, alert on `probe_success` + TLS-cert expiry), Grafana Cloud k6 (distributed load tests across AWS load-zones, scenarios, `http_req_duration` thresholds, CI integration via `grafana/k6-action`), and Frontend Observability with Faro Web SDK (RUM, Core Web Vitals, custom events, `pushError`, distributed-trace correlation). Use when checking website / API uptime from multiple regions, gating a release on a load test, watching for TLS-cert renewal, instrumenting a React/Vue app, tracking Core Web Vitals, or correlating frontend errors to backend traces — even when the user says "is my login flow up?", "monitor my API", "ping our endpoint every minute", "release-gate load test", "browser performance monitoring", "session replay", or "RUM" without naming Synthetic Monitoring / k6 / Faro.OfficialTestingNo warnings★ 297↓ —
- database-optimizerzebbern/claude-code-guideUse when investigating slow queries, analyzing execution plans, or optimizing database performance. Invoke for index design, query rewrites, configuration tuning, partitioning strategies, lock contention resolution.DataNo warnings★ 4.7K↓ —
- replica-deployJakeschincariol/replica-skillShips an app clone live on the user's own domain: a preflight gate (tests green, parity must-haves done, rebrand sweep clean, listing linted, legal pages up), production database and env vars, the host, DNS records for the domain and for email, Stripe live mode, OAuth redirects, monitoring, and mobile builds to TestFlight and Play. Use when the user says "deploy it", "ship it", "put it live", "connect my domain", "go to production", "publish the app", or after /replica-launch.DevOpsNo warnings★ 6.6K↓ —
- camera-systemsgamedev-skills/awesome-gamedev-agent-skillsBuild game cameras that feel good — 2D follow with a deadzone, look-ahead, smoothing, and level-bounds clamping; 3D third-person orbit with collision and first-person look; plus multi-target framing and a shake hook. Engine-neutral techniques that pair with the engine's camera node and rigs like Unity Cinemachine or Godot Camera2D/PhantomCamera. Use when the user mentions camera follow, follow camera, deadzone, look-ahead, camera smoothing, camera bounds/ limits, third-person camera, orbit camera, first-person look, Cinemachine, or camera jitter.OtherNo warnings★ 5.8K↓ —
- deep-module-refactorzebbern/claude-code-guideExplore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more AI-navigable.EngineeringNo warnings★ 4.7K↓ —
- hunt-spa-apielementalsouls/Claude-BugHunterDiscover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.EngineeringNo warnings★ 5.4K↓ —
- golang-dependency-injectionsamber/cc-skills-golangComprehensive guide for dependency injection (DI) in Golang. Covers why DI matters (testability, loose coupling, separation of concerns, lifecycle management), manual constructor injection, and DI library comparison (google/wire, uber-go/dig, uber-go/fx, samber/do). Use this skill when designing service architecture, setting up dependency injection, refactoring tightly coupled code, managing singletons or service factories, or when the user asks about inversion of control, service containers, or wiring dependencies in Go. For a specific DI library, → See `samber/cc-skills-golang@golang-google-wire`, `samber/cc-skills-golang@golang-uber-dig`, `samber/cc-skills-golang@golang-uber-fx`, or `samber/cc-skills-golang@golang-samber-do` skills.PlanningNo warnings★ 3.7K↓ —
- no-commentsbacknotprop/pstackSpawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.OtherNo warnings★ 3.2K↓ —
- gitlab-automationdavepoon/buildwithclaudeAutomate GitLab project management, issues, merge requests, pipelines, branches, and user operations via Rube MCP (Composio). Always search tools first for current schemas.OtherNo warnings★ 3.7K↓ —
- hreflang-internationalnowork-studio/notfair-pluginInternational / multilingual SEO audit focused on hreflang correctness: missing or broken return tags, wrong language/region codes, missing x-default, self-referencing errors, hreflang vs canonical conflicts, and inconsistent signals across HTML head, HTTP headers and XML sitemap. Also reviews URL structure (ccTLD vs subdirectory vs subdomain), language targeting and geo signals. Use whenever the user runs a multi-language or multi-region site and asks about hreflang, international or multilingual SEO, the wrong-language page showing in search, or duplicate content across country versions. Trigger on: "hreflang", "international SEO", "multilingual SEO", "multi-region", "wrong language in Google", "x-default", "ccTLD vs subdirectory", "geo targeting", "language targeting", "my English page shows for Thai users", "th/en page ranking in the wrong country", or any cross-language/cross-country ranking question. For full-site audits use /seo-analysis; for a single URL use /seo-page.MarketingNo warnings★ 4.1K↓ —
- creator-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks "what did we pay this creator last time" or to "update the creator roster"; curates creator identity, rate, rights, exclusivity, compliance-event, and performance facts through the append-only creators event stream. Not for scoring fit — use fit-scorer; not for reviewing content — use creator-content-auditor. 创作者档案/达人名册LegalNo warnings★ 3K↓ —
- ml-data-leakage-guardforyourhealth111-pixel/Vibe-SkillsDetects and prevents data leakage in machine learning and mathematical modeling. Use after ML tasks involving data cleaning, feature engineering, data augmentation, algorithm development, normalization, missing value imputation, dimensionality reduction, feature selection, or time series modeling. Checks if features/statistics would be available at prediction time.ProductivityNo warnings★ 3.8K↓ —
- local-seonowork-studio/notfair-pluginLocal SEO and Google Business Profile audit: diagnose why a business isn't ranking in the local pack / map results and produce a fix plan. Covers GBP completeness, NAP (name/address/phone) consistency across the site and citations, local pack and "near me" ranking factors, review velocity and responses, local landing pages, service-area pages, and LocalBusiness JSON-LD. Use whenever the user asks about local rankings, map results, Google Maps ranking, NAP consistency, store/branch pages, or multi-location SEO. Trigger on: "local SEO", "Google Business Profile", "GBP audit", "rank on Google Maps", "local pack", "map pack", "near me ranking", "NAP", "local citations", "my business isn't on the map", "why don't I show up on Google Maps", "store locator SEO", "multi-location SEO", "service area pages", or any location-based ranking question. For full-site (non-local) audits use /seo-analysis; for a single URL use /seo-page.MarketingNo warnings★ 4.1K↓ —
- gsd:settingsdavepoon/buildwithclaudeConfigure GSD workflow toggles and model profileProductivityNo warnings★ 3.7K↓ —
- sitemap-auditnowork-studio/notfair-pluginXML sitemap audit — find and fix the sitemap problems that quietly waste crawl budget and slow indexing. Discovers the sitemap (robots.txt, /sitemap.xml, sitemap index), validates structure and size limits, and cross-checks the URLs it lists against reality: non-200 / redirected / noindex / canonicalized-away URLs that shouldn't be in a sitemap, plus indexable pages that are missing from it. Reviews lastmod accuracy, sitemap-index organization, and robots.txt reference. Use this skill whenever the user asks about sitemaps, sitemap errors in Search Console, "sitemap couldn't fetch / has errors", crawl budget, pages not getting indexed, or whether their sitemap is clean. Trigger on: "sitemap", "sitemap.xml", "XML sitemap", "sitemap errors", "sitemap audit", "couldn't fetch sitemap", "crawl budget", "pages not indexed sitemap", "sitemap index", "lastmod", "robots.txt sitemap", or any sitemap/crawl-coverage question. For a full-site SEO audit use /seo-analysis; for broken links use /broken-link-checker.BrowserNo warnings★ 4.1K↓ —
- brand-language-codifieraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "codify our brand voice", "define naming rules for our products and tiers", or "write the tone-of-voice guide with banned phrases"; produces the brand-level voice canon (register, tone spectrum, banned-phrase list, few-shot examples drawn only from the brand's own published material) and the naming tax (product / feature / tier naming rules plus approved and banned terms) that seeds the narrative-registry canon and that every channel's voice adaptation points up to. Not for per-platform voice adaptation — use channel-registry's voice-dossier; not for finished copy or blog posts — use content-writer; not for the message hierarchy itself — use message-system-architect; not for claim adjudication — use offer-claims-registry. 品牌语气/词汇表/命名税/禁用词/品牌语言规范FinanceNo warnings★ 3K↓ —
- google-ads-copynowork-studio/notfair-pluginGenerate and A/B test Google Ads copy. Use when asked to write ad copy, headlines, descriptions, create ad variants, test ad messaging, improve CTR, or generate RSA (Responsive Search Ad) components. Trigger on "ad copy", "write ads", "headlines", "descriptions", "RSA", "responsive search ad", "ad text", "ad creative", "improve CTR", "ad A/B test", "ad variants", "write me an ad", "ad variation experiment", or when the user wants to improve click-through rate on existing ads.MarketingNo warnings★ 4.1K↓ —
- rag-perfNVIDIA/skillsPerformance benchmarking for a deployed NVIDIA RAG Blueprint server: profiling pass + aiperf load test driven by a single YAML config. Not for accuracy / RAGAS scoring (use rag-eval) or for deploying / repairing services (use rag-blueprint).TestingNo warnings★ 3.8K↓ —
- doca-uromNVIDIA/skillsHost-side DOCA UROM library (doca_urom_*): offload an HPC / UCX / MPI application's remote memory operations (puts, gets, atomics, collectives) from the host CPU onto a BlueField DPU. Trigger on "MPI all-reduce burning host CPU", "push UCX traffic onto the BlueField", "first doca_urom call returns NOT_PERMITTED", or "host library and DPU service look out of sync", even without naming DOCA UROM. An offload needs both halves: this host library and the UROM Service on the DPU (doca-urom-svc), which owns deploying that container. Covers creating UROM Service contexts (doca_urom_service_*) and Worker contexts (doca_urom_worker_*) that run plugins on the DPU, discovering plugins via doca_urom_service_get_plugins_list, progressing completions, and DOCA_ERROR_* from doca_urom_* calls. Route elsewhere for UROM Service deployment on the DPU side, MPI / UCX collective algorithm design, and RDMA / RoCE / IB substrate bring-up.DevOpsNo warnings★ 3.8K↓ —
- doc-convertZJU-REAL/Easel把 Markdown 文稿排版并转换为 HTML、可打印 PDF 或长图 PNG。当用户说“Markdown/MD 转 HTML/PDF/图片、文章导出长图、MD 排版/渲染”时使用。仅处理 Markdown；DOCX/PPT 不在范围内，层级大纲转脑图用 mindmap。DocumentsNo warnings★ 4.2K↓ —
- figure-it-outmichael-denyer/pstack-claudeDesign an auditable playbook when no narrower one fits: a large migration, an ambitious multi-part change, or work a human reviews after stepping away. Scales rigor to the task, runs a hypothesis loop, and logs decisions. Use for /figure-it-out or 'figure it out'.DesignNo warnings★ 3.7K↓ —
email-render-builder
aaron-he-zhu/aaron-marketing-skills
MediaUpdated 18 hours ago
From the author
Use when the user asks to "build the email HTML", "make this email responsive", "fix dark-mode rendering", or "QA the email across clients"; produces the coded HTML build — a responsive table layout, dark-mode + accessibility pass, a client-render matrix, image-block fallbacks, and a plain-text parity check. Not for writing the copy — use email-creative-builder; not for scoring the email or computing EQS — use email-quality-auditor. 邮件HTML/响应式邮件/暗色模式渲染
Install
npx skills add aaron-he-zhu/aaron-marketing-skills --skill email-render-builder -a claude-code
Installs to .claude/skills/email-render-builder/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (3)
- SKILL.md
- references/client-render-matrix.md
- references/email-render-specs.md