Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 11 hours ago
48,166 skills
- offensive-network-attacksSnailSploit/Claude-RedDense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.TestingNo warnings★ 10K↓ —
- neon-functionsneondatabase/agent-skillsLong-running, serverless Node.js HTTP functions deployed onto your Neon branch, with DATABASE_URL injected automatically and compute that runs next to your data. Use when a user wants to host an API, an AI agent with long streaming responses, a WebSocket or server-sent-events (SSE) server, a webhook handler, a Discord bot, an MCP server, or any request/response workload that risks timing out on short, lambda-style serverless functions — and wants it to branch with their database. Also use for Function Triggers: a cron or an object-storage event that POSTs to a function. Triggers include "serverless function", "deploy an API", "long-running function", "streaming agent", "SSE server", "WebSocket server", "webhook handler", "MCP server", "cron", "scheduled function", "object storage trigger", "on upload", "function that won't time out", "function logs", "Neon Functions", "Neon Compute", "DDoS protection", "rate limiting", and "production hardening". For live UIs over database rows, use neon-realtime.OfficialDevOpsNo warnings★ 108↓ —Also in 1 other repo
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.TestingNo warnings★ 10K↓ —
- ulw-loopcode-yeongyu/oh-my-openagentA goal-like loop that decomposes work into systematic, evidence-bound ultrawork steps. Use when the user wants a goal loop or durable, checkpointed execution.OtherNo warnings★ 70.5K↓ —
- gsd:threaddavepoon/buildwithclaudeManage persistent context threads for cross-session workProductivityNo warnings★ 3.7K↓ —
- engagement-inbox-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "triage our comments, DMs, and mentions", "draft replies to this thread", "can we repost this fan post", or "set up inbox SLAs and an escalation path"; produces a ranked triage queue with register detection (sincere / ironic / performative / parasocial, sentiment-inversion table included — "this is so bad" under a comedy register is praise), a commenter taxonomy (troll monitor-only / rager / misguided / unhappy-customer / advocate) with a response-tier ladder and per-channel SLAs, an escalation matrix ending at the crisis path, a moderation ladder plus house rules for owned spaces, and a UGC curation-and-rights mode whose dated permission entries route to the channel registry — every reply is a ranked DRAFT a human posts; nothing is ever auto-sent. Not for launch-window feedback triage — use launch-feedback-synthesizer. 评论私信提及分诊/语域识别/回复草稿/UGC授权OtherNo warnings★ 3K↓ —
- hyperplancode-yeongyu/oh-my-openagentAdversarial multi-agent planning skill. Self-orchestrates 5 hostile category members (unspecified-low, unspecified-high, deep, ultrabrain, artistry) via team-mode for ruthless cross-critique debate, distills only the defensible insights, then MANDATORILY hands the distilled insight bundle to the `plan` agent for executable plan formalization. Use when planning needs maximum rigor and surfacing of weak assumptions, blind spots, and over-engineering. Triggers: 'hyperplan', 'hpp', '/hyperplan', 'adversarial plan', 'hostile planning', 'cross-critique plan', '하이퍼플랜', '적대적 계획', '교차 비평'.PlanningNo warnings★ 70.5K↓ —
- groq-sdk-patternsjeremylongshore/tons-of-skills-marketplaceApply production-ready Groq SDK patterns for TypeScript and Python. Use when implementing Groq integrations, refactoring SDK usage, or establishing team coding standards for Groq. Trigger with phrases like "groq SDK patterns", "groq best practices", "groq code patterns", "idiomatic groq".EngineeringNo warnings★ 2.9K↓ —
- freshie-inventoryjeremylongshore/tons-of-skills-marketplaceManage the freshie ecosystem inventory database — a CMDB tracking all plugins, skills, packs, and compliance grades across 51 SQLite tables. Use when checking ecosystem health, running discovery scans, validating compliance, remediating issues, querying inventory data, comparing runs, exporting data, or generating status reports. Trigger with "freshie status", "inventory scan", "ecosystem audit", "grade report", "compliance check", "remediate skills", "query freshie", "compare runs", "export grades", or "freshie report".DataNo warnings★ 2.9K↓ —
- offensive-fuzzingSnailSploit/Claude-RedPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.WritingNo warnings★ 10K↓ —
- apify-hello-worldjeremylongshore/tons-of-skills-marketplaceRun your first Apify Actor and retrieve results via apify-client. Use when starting a new Apify integration, testing connectivity, or learning the Actor call/dataset retrieval pattern. Trigger with "apify hello world", "apify example", "run an apify actor", "apify quick start", "first apify scrape".TestingNo warnings★ 2.9K↓ —
- builderjeremylongshore/tons-of-skills-marketplaceHands-on implementation partner for creating tools, scripts, dashboards, and prototypes. Use when the user wants working software. Trigger with "build", "create tool", "make app", "implement", "prototype", or "automate".OtherNo warnings★ 2.9K↓ —
- agentic-actions-auditortrailofbits/skillsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.SecurityNo warnings★ 7.9K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- yt-researchjeremylongshore/tons-of-skills-marketplaceAnalyze competitor YouTube coverage and video opportunities using sourced observations with explicit sampling limits. Use when researching channels or a niche before ideation. Trigger with "research channels" or "competitive video research".ScienceNo warnings★ 2.9K↓ —
- excel-lbo-modelerjeremylongshore/tons-of-skills-marketplaceBuild leveraged buyout (LBO) models in Excel with debt schedules and IRR analysis. Use when structuring LBO transactions or analyzing PE returns. Trigger with phrases like 'excel lbo', 'build lbo model', 'calculate pe returns'.DocumentsNo warnings★ 2.9K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- benchmark-checklistbacknotprop/pstackVet a perf measurement (limiter, tuning, limits, errors, repeatability, relevance, and whether the work happened) before you report or act on it. Use when you run a benchmark or report a speedup or regression you measured.OtherNo warnings★ 3.3K↓ —
- nvshmem-docsNVIDIA/skillsFind version-aware official NVSHMEM and NVSHMEM4Py documentation for releases, installation, APIs, runtime settings, transports, containers, and troubleshooting.OtherNo warnings★ 3.8K↓ —
- comprehensive-research-agentforyourhealth111-pixel/Vibe-SkillsEnsure thorough validation, error recovery, and transparent reasoning in research tasks with multiple tool callsScienceNo warnings★ 3.8K↓ —
- category-narrative-mapperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "map the category narrative", "tear down how competitors tell their story", or "find the language conventions in our market"; produces a category narrative map — the dominant stories and points of view in the category, its language conventions and framing clichés, and a per-competitor narrative teardown (arc, claimed onlyness, proof pattern) plus how each rival's messaging has shifted over time (scraped copy vs archived copy). Not for the positioning canvas itself — use positioning-mapper; not for the beachhead's beliefs and objections — use audience-belief-mapper; not for SERP keyword targeting — use keyword-research; not for claim adjudication — use offer-claims-registry. 品类叙事/竞争叙事拆解/语言惯例/叙事演变BrowserNo warnings★ 3K↓ —
- principle-migrate-callers-then-delete-legacy-apisbacknotprop/pstackApply when introducing a new internal API while old callers still exist. Migrate callers and delete the old API in the same wave instead of preserving compatibility layers.EngineeringNo warnings★ 3.3K↓ —Also in 1 other repo
- gmail-automationdavepoon/buildwithclaudeAutomate Gmail tasks via Rube MCP (Composio): send/reply, search, labels, drafts, attachments. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- narrative-quality-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit our brand narrative" or "is this message on-canon"; runs separate typed TALE truth, system, or effectiveness profiles and never averages them into one composite. Checks differentiation, canon, landing consistency, and evidence integrity. Not for launch readiness — use launch-readiness-auditor; not for social operations — use social-quality-auditor. 品牌叙事分层审计/发布前一致性放行OtherNo warnings★ 3K↓ —
ai-image-gen
ZJU-REAL/Easel
MediaUpdated 7 days ago
From the author
通用 AI 生图：文生图 / 图生图 / 图像变体。当用户说 AI 生图、AI 画图、文生图、图生图、生成图片、生成配图、图像生成、AI 出图、AI 作图、换图、改图、图像编辑、给我画一张、生成一张图 时使用。支持 OpenAI 兼容 API 与 apimart 异步 API，用户自备 API key。
Install
npx skills add ZJU-REAL/Easel --skill ai-image-gen -a claude-code
Installs to .claude/skills/ai-image-gen/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (2)
- EASEL-META.md
- SKILL.md