Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 12 hours ago
47,966 skills
- strategic-narrative-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "design our change narrative", "build the old-world-to-new-game story arc", or "frame the shift our category is undergoing"; produces a Raskin-style strategic narrative arc — old world → the undeniable shift → winners vs losers under the new rules → the promised land → proof the promised land is real — derived from the positioning truth set and the belief/objection map, feeding the TALE Architecture arc sub-item. Every proof beat is labeled Measured / User-provided / [needs source] and this skill never adjudicates a claim. Not for the message house hierarchy — use message-system-architect; not for the pitch deck narrative — use pitch-narrative-builder; not for claim substantiation — use offer-claims-registry. 变革叙事弧/旧世界/应许之地/战略叙事结构DocumentsNo warnings★ 3K↓ —
- single-cell-rna-qcanthropics/knowledge-work-pluginsPerforms quality control on single-cell RNA-seq data (.h5ad or .h5 files) using scverse best practices with MAD-based filtering and comprehensive visualizations. Use when users request QC analysis, filtering low-quality cells, assessing data quality, or following scverse/scanpy best practices for single-cell analysis.OfficialOtherNo warnings★ 34K↓ —
- token-integration-analyzertrailofbits/skillsToken integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Use when integrating or accepting arbitrary ERC20/ERC721 tokens, auditing a token implementation for standards conformity, or assessing risk from weird tokens such as fee-on-transfer, rebasing, missing return values, or blocklists.LegalNo warnings★ 7.9K↓ —
- miro-rate-limitsjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side Miro REST traffic controls from credit weights, supplied headers, bounded queues, and reset-aware retries. Use when preventing or recovering from Miro 429 responses. Trigger with "Miro rate limit".DesignNo warnings★ 2.9K↓ —
- sepia-refactorNanako0129/sepiaUse when a user explicitly requests Sepia refactor for minimal in-place prose revision.EngineeringNo warnings★ 3.6K↓ —
- ramp-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement a shared Ramp request budget with rolling-window throttling, bounded retries, pagination, and 504 recovery. Use when clients receive 429 or 504 responses or share one outbound IP. Trigger with "Ramp rate limit" or "Ramp 429".OtherNo warnings★ 2.9K↓ —
- publishcode-yeongyu/oh-my-openagentPublish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. Ship-only: never runs pre-publish-review or re-reviews merged code unless the user explicitly asks. Argument: <patch|minor|major|explicit-semver>. Triggers: publish, release, deploy, npm publish.DevOpsNo warnings★ 70.5K↓ —
- shipping-build-artifactskajisho5/ffmpeg-skillMake the build step a real gate on what you actually distribute — build scripts that warn and exit 0 on a missing input, size checks with only an upper bound, hand-maintained file lists that drift from the entrypoints they must cover, committed bundles that go stale when only the source changes, GNU-only shell in release scripts that aborts on the other OS, and verification that runs against the source tree instead of the artifact. Use when writing or reviewing a build/package script, a `dist/` copy step, a release workflow that uploads a zip or installer, or a committed compiled asset.WritingNo warnings★ 4.1K↓ —
- wiki-narrateAr9av/obsidian-wikiTurn a wiki topic into a cited Markdown briefing, plain-language explanation, or progressive lecture. Use this skill for topic-based briefing, explanation, and lecture requests that must stay within the evidence compiled in an Obsidian vault.ProductivityNo warnings★ 3.6K↓ —
- fuzzing-obstaclestrailofbits/skillsPatches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use when a fuzzer is stuck at validation, when coverage shows large regions behind a checksum, or when valid inputs are impractical to generate.OtherNo warnings★ 7.9K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- tao-train-codetrNVIDIA/skillsCo-DETR (CoDINO) for object detection. A DETR-family detector with collaborative hybrid assignment — auxiliary one-to-many heads supervise the encoder during training, giving strong closed-set accuracy at high inference cost. Use when training, evaluating, or running inference for a TAO Co-DETR model. Trigger phrases include "train Co-DETR", "run CoDINO", "codetr inference", "collaborative DETR", "autolabel detections with Co-DETR".OtherNo warnings★ 3.8K↓ —
- golang-securitysamber/cc-skills-golangSecurity best practices and vulnerability prevention for Golang — injection (SQL, command, XSS), cryptography, path traversal, SSRF and HTTP security headers, cookies, secrets management, memory safety, PII in logs, STRIDE/DREAD threat modeling, plus `gosec` SAST, race detection, and fuzz testing. Apply when writing, reviewing, or auditing Go code for security, or when touching crypto, file or network I/O, secrets, user input, or authentication. Not for non-exploitable defensive bugs such as nil panics or slice aliasing (→ See `samber/cc-skills-golang@golang-safety` skill), dependency vulnerability scanning with govulncheck (→ See `samber/cc-skills-golang@golang-dependency-management` skill), or wiring security scanners into CI pipelines (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).SecurityNo warnings★ 3.7K↓ —
- maintain-verification-skillbacknotprop/pstackPeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.2K↓ —
- benchmark-checklistbacknotprop/pstackVet a perf measurement (limiter, tuning, limits, errors, repeatability, relevance, and whether the work happened) before you report or act on it. Use when you run a benchmark or report a speedup or regression you measured.OtherNo warnings★ 3.2K↓ —
- zendesk-automationdavepoon/buildwithclaudeAutomate Zendesk tasks via Rube MCP (Composio): tickets, users, organizations, replies. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- vercel-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Vercel API rate limits, implement retry logic, and configure WAF rate limiting. Use when hitting 429 errors, implementing retry logic, or setting up rate limiting for your Vercel-deployed API endpoints. Trigger with phrases like "vercel rate limit", "vercel throttling", "vercel 429", "vercel retry", "vercel backoff", "vercel WAF rate limit".DevOpsNo warnings★ 2.9K↓ —
- golang-uber-digsamber/cc-skills-golangImplements dependency injection in Golang using uber-go/dig — reflection-based container, Provide/Invoke, dig.In/dig.Out parameter and result objects, named values, value groups, optional dependencies, scopes, and Decorate. Apply when using or adopting uber-go/dig, when the codebase imports `go.uber.org/dig`, or when wiring an application graph at startup. For higher-level lifecycle and modules, see `samber/cc-skills-golang@golang-uber-fx` skill.OtherNo warnings★ 3.7K↓ —
- wiki-rebuildAr9av/obsidian-wikiArchive and rebuild wiki knowledge from source, or restore a prior archive. Use for full restart/recovery when incremental repair is inappropriate; this is broader and more destructive than ordinary update or lint.OtherNo warnings★ 3.6K↓ —
- upload-postdavepoon/buildwithclaudePublish and schedule content to 15 social platforms through one Upload-Post API call: TikTok, Instagram, YouTube, LinkedIn, Facebook, X, Threads, Pinterest, Bluesky, Reddit, Discord, Telegram, Mastodon, WordPress, and Google Business Profile. Use when the user wants to post or schedule a video, photo carousel, text, or document across several platforms at once, check upload status, pull analytics, or run Instagram comment-to-DM funnels.DataNo warnings★ 3.7K↓ —
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 9.9K↓ —
- offensive-krack-fragattacksSnailSploit/Claude-RedKRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.SecurityNo warnings★ 9.9K↓ —
- exploits-searchdavepoon/buildwithclaudeSearch for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSSSecurityNo warnings★ 3.7K↓ —
- exa-observabilityjeremylongshore/tons-of-skills-marketplaceInstrument Exa calls with content-free metrics, traces, cost, and asynchronous lifecycle signals that support diagnosis without logging retrieved text. Use when operating or reviewing this Exa boundary. Trigger with "Exa observability", "review Exa observability", or "fix Exa observability".DevOpsNo warnings★ 2.9K↓ —
speckit-checklist
foryourhealth111-pixel/Vibe-Skills
PlanningUpdated 5 days ago
From the author
Generate custom quality checklists for validating requirements completeness and clarity. Use to create unit tests for English that ensure spec quality before implementation.
Install
npx skills add foryourhealth111-pixel/Vibe-Skills --skill speckit-checklist -a claude-code
Installs to .claude/skills/speckit-checklist/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md