Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 12 hours ago
47,966 skills
- checkdavepoon/buildwithclaudeRun CIAgent regression checks after changing an AI agent's code, prompts, or knowledge base in a repo that has agentci_spec.yaml, and interpret the results. Use after editing agent logic, before committing agent changes, or when the user asks whether the agent still works.WritingNo warnings★ 3.7K↓ —
- pulumi-best-practicespulumi/agent-skillsLoad when the user is writing, reviewing, or debugging Pulumi TypeScript/Python programs; asks about Output<T> or apply() usage; wants to create ComponentResource classes; needs to refactor resources without destroying them (aliases); is setting up secrets or config; or is configuring a pulumi preview/up CI workflow. Also load for questions about resource dependency order, parent/child resource relationships, or pulumi.interpolate.OfficialWritingNo warnings★ 78↓ —
- doca-pccNVIDIA/skillsUse this skill when the user is doing hands-on host-side DOCA PCC work to load a CUSTOM Programmable Congestion Control algorithm onto a BlueField DPU — creating per-port `doca_pcc` contexts, loading a `dpacc`-compiled `doca_pcc_app` onto the `doca_dev` for the RoCE-bearing port, parameterizing it, walking triple-axis capability discovery (DOCA cap-query + DPA-capable BlueField + firmware custom-PCC slot enabled), or debugging `DOCA_ERROR_*` from `doca_pcc_*`. Trigger even without explicit "DOCA PCC" phrasing — implicit forms include "loading my own congestion control onto a BF port", "DOCA_ERROR_NOT_PERMITTED on algorithm load", "DOCA_ERROR_DRIVER when I attach my custom algorithm", "my custom rate-update isn't affecting RoCE traffic", or "load succeeds but no on-wire change". Refuse and route elsewhere for DPA-side algorithm-body design, the `pcc_counters` CLI, default factory PCC in ConnectX firmware, or setting up the RDMA / RoCE traffic — those belong to other skills.DesignNo warnings★ 3.8K↓ —
- saas-valuation-compressionhimself65/finance-skillsAnalyze how a private SaaS company's ARR valuation multiple changed across funding rounds, and attribute the compression or expansion to rate cycles and macro selloffs, growth deceleration, narrative shifts (including an AI premium), competition, and investor demand, benchmarked against private-market medians and peers. Use this skill whenever the user asks about valuation compression, ARR multiples, round-to-round valuation or multiple changes, down rounds, or wants to compare a VC-backed software company's funding rounds. Research the rounds rather than answering from memory.FinanceNo warnings★ 3.5K↓ —
- secure-workflow-guidetrailofbits/skillsGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.ProductivityNo warnings★ 7.9K↓ —
- principle-separate-before-serializing-shared-statebacknotprop/pstackApply when concurrent actors might write to the same file, branch, key, or state object. Eliminate the sharing first; serialize structurally only when one shared writer is a real invariant.WritingNo warnings★ 3.2K↓ —Also in 2 other repos
- thumbgatedavepoon/buildwithclaudeA single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClawEngineeringNo warnings★ 3.7K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 7.9K↓ —
- correctbacknotprop/pstackFind the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.TestingNo warnings★ 3.2K↓ —
- jetson-video-benchmarkNVIDIA/skillsUse when measuring Jetson Video Codec SDK or PyNvVideoCodec encode/decode throughput, comparing presets or surfaces, testing codec-worker capacity with authenticated samples and user media, or producing a clearly labeled documentation-derived planning estimate when representative media is absent. Also use for a video request limited to PSNR or SSIM, to apply the terminal scope response.MediaNo warnings★ 3.8K↓ —
- close-automationdavepoon/buildwithclaudeAutomate Close CRM tasks via Rube MCP (Composio): create leads, manage calls/SMS, handle tasks, and track notes. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- design-qaplugin87/ux-ui-agent-skillsSet up or run design QA gates for token + hardcoded-value lint, automated a11y (axe), contrast, visual regression across variants/states/themes/RTL, and the manual a11y checklist. Use when the user wants CI quality gates, to prevent design regressions, or to QA a component/screen before shipping.TestingNo warnings★ 3.1K↓ —
- skill-hook-generatorZJU-REAL/Easel针对任意主题生成多种 Hook（开头钩子）变体，用经过验证的互动公式抓住开头注意力，附字数校验。 当用户说"写钩子""开头怎么写""Hook""抓眼球的开头""标题钩子""前三秒""怎么开头"时使用。 本 SKILL 专攻可复用的开头钩子变体；成篇营销文案用 copywriting，视频分秒脚本用 video-script。MediaNo warnings★ 4.2K↓ —
- i4h-workflow-scene-editNVIDIA/skillsEdit an existing workflow Scene or task contract. Use for assets, layout, cameras, randomization, task text, or success rules; do not use to create a new workflow.WritingNo warnings★ 3.8K↓ —
- ctf-reverseljagiello/ctf-skillsProvides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.SecurityNo warnings★ 3.6K↓ —
- security-guardrailsdavepoon/buildwithclaudeAdversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow bypass, and social engineering attacks.SecurityNo warnings★ 3.7K↓ —
- claude-md-reviewwesammustafa/Claude-Code-Everything-You-Need-to-KnowAudit a CLAUDE.md file for the patterns that actually degrade Claude Code's output — vagueness, unnamed files, stale facts, and bloat. Use when asked to review, audit, improve, shrink, or fix a CLAUDE.md, and when a project's results feel inconsistent or Claude keeps rediscovering the same context.EngineeringNo warnings★ 3.5K↓ —
- youtube-automationdavepoon/buildwithclaudeAutomate YouTube tasks via Rube MCP (Composio): upload videos, manage playlists, search content, get analytics, and handle comments. Always search tools first for current schemas.DataNo warnings★ 3.7K↓ —
- i4h-lerobot-vizNVIDIA/skillsServe and visually inspect a converted LeRobot dataset in the browser. Use for videos and state/action timelines; do not use for raw workflow HDF5 or incomplete conversion output.BrowserNo warnings★ 3.8K↓ —
- token-buildplugin87/ux-ui-agent-skillsSet up or run the token build pipeline. Transform the DTCG tokens/*.json (source of truth) into platform artifacts (CSS variables, Tailwind @theme, JS/TS, iOS Asset Catalog, Android, Compose) with Style Dictionary / Tokens Studio / W3C DTCG export. Use when the user wants to generate platform theme files from tokens, wire token CI, or multi-platform token output.DesignNo warnings★ 3.1K↓ —
- lamindbforyourhealth111-pixel/Vibe-SkillsThis skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.DevOpsNo warnings★ 3.8K↓ —Also in 1 other repo
- mcore-testingNVIDIA/skillsTest system for Megatron-LM. Covers test layout, recipe YAML structure, adding and running unit and functional tests, golden values, marker filters, and CI parity.TestingNo warnings★ 3.8K↓ —
- setup-pstackbacknotprop/pstackConfigure which models pstack uses per role and at what reasoning budget. Detects your available models and writes an always-applied rule that overrides the skill defaults. Use for /setup-pstack, "configure pstack models", "pstack budget", or changing pstack's model choices.WritingNo warnings★ 3.2K↓ —
- yt-briefjeremylongshore/tons-of-skills-marketplaceCreate a YouTube production brief with viewer outcome, angle, demo scope and CTA. Use when developing a selected video idea before packaging. Trigger with "write a video brief" or "brief this idea".MediaNo warnings★ 2.9K↓ —
validate-bug
trailofbits/skills
OtherUpdated 3 days ago
From the author
Use when a bug PoC package needs an independent rerun and judgment before patching.
Install
npx skills add trailofbits/skills --skill validate-bug -a claude-code
Installs to .claude/skills/validate-bug/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (1)
- SKILL.md