Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 13 hours ago
47,966 skills
- kiro-spec-statusgotalab/cc-sddShow specification status and progressPlanningNo warnings★ 3.7K↓ —
- deslopforyourhealth111-pixel/Vibe-SkillsIntelligent Skill routing and workflow orchestration for AI agents — +21.12 pp reward, −29.6% tokens on SkillsBench with DeepSeekV4Flash-VE.ProductivityNo warnings★ 3.8K↓ —
- skill-trend-riderZJU-REAL/Easel给定一个热点事件或话题，结合创作者账号定位，输出蹭热点的具体内容方案。 包含切入角度、内容形式、标题建议、风险提醒。 当用户说"这个热点怎么蹭"、"蹭热点"、"怎么结合"、"热点和我有关吗"、 "追热点"、"热点方案"、"借势"、"怎么追这个热点"、"热点怎么切"时触发。 和 skill-trending-topics 的区别：trending-topics 发现和筛选热点， trend-rider 拿到一个具体热点后规划怎么蹭、怎么切内容。OtherNo warnings★ 4.2K↓ —
- doc-convertZJU-REAL/Easel把 Markdown 文稿排版并转换为 HTML、可打印 PDF 或长图 PNG。当用户说“Markdown/MD 转 HTML/PDF/图片、文章导出长图、MD 排版/渲染”时使用。仅处理 Markdown；DOCX/PPT 不在范围内，层级大纲转脑图用 mindmap。DocumentsNo warnings★ 4.2K↓ —
- principle-never-block-on-the-humanbacknotprop/pstackApply when tempted to ask 'should I do X?' on reversible work.OtherNo warnings★ 3.2K↓ —Also in 1 other repo
- testing-handbook-generatortrailofbits/skillsGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.TestingNo warnings★ 7.9K↓ —
- skill-zhihu-publisherZJU-REAL/Easel知乎发布：把文章发布到知乎专栏（也可用于回答草稿）。当用户说"发知乎""知乎发布" "发布知乎文章""知乎专栏""投知乎"时使用。基于通用浏览器发布框架（Playwright + 登录态持久化）。TestingNo warnings★ 4.2K↓ —
- correctbacknotprop/pstackFind the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.TestingNo warnings★ 3.2K↓ —
- conversion-value-mapperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "set up conversion values so tROAS optimizes profit not orders", "map margin onto my purchase value", "build value rules for lead / phone / signup conversions", or "stop bidding to revenue when I care about profit"; defines and QAs the conversion VALUE model — per-conversion values, margin/net-value adjustment, static-vs-dynamic value rules, proxy values for non-revenue actions, and a value-vs-count sanity check — as a value-model spec plus a pre-launch value QA sheet. Not for whether the tag fires or UTMs are clean — use conversion-signal-qa; not for cross-platform double-count de-dup — use attribution-reconciler; not for scoring R1/R2 — that is a scored veto in ad-account-auditor. 付费广告转化价值建模/利润出价/价值规则QAMarketingNo warnings★ 3K↓ —
- technical-writingmichael-denyer/pstack-claudeLayered technical-writing standard: Diátaxis structure, Google developer style sentences, STE instruction rules, Global English syntax. Use for /technical-writing or when writing or reviewing docs, RFCs, readmes, PR descriptions, or commit messages.WritingNo warnings★ 3.7K↓ —
- memoryjeremylongshore/tons-of-skills-marketplaceUse when sharpening a perception or observation you ALREADY formed about conversation state, user behavior, drift, emotional shifts, or cross-turn patterns. Trigger phrases include "what did you notice about X", "the user keeps doing Y", "I sense something has changed", "is the user X-ing", "what does this pattern suggest", "what shifted across our turns", "am I missing something here", "why did the conversation move from X to Y", or any moment requiring verification of whether a felt signal is real or projection. The skill calls the memory MCP tool to retrieve a perception scaffold (perception failure, detection procedure, suppression vectors) that SHARPENS an observation you already have. It is NOT a substitute for observing first. Do NOT trigger for fact extraction, summarization, list-making, factual lookups, or write-heavy memory tasks (storing/retrieving structured data). Memory harness is filter/perception oriented; calling on write-heavy tasks produces scaffold paralysis.ProductivityNo warnings★ 2.9K↓ —
- graph-colorizeAr9av/obsidian-wikiConfigure Obsidian graph colors by tag, folder, category, or visibility by updating .obsidian/graph.json. Use for graph colorization; preserve other graph settings and back up before changes.ProductivityNo warnings★ 3.6K↓ —
- bid-strategy-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "pick a bid strategy", "set a tCPA/tROAS target", or "plan the learning-phase entry"; produces a bid-strategy choice (tCPA / tROAS / max-conversions / manual CPC), the starting target math, a portfolio grouping map, and a learning-phase entry plan. Not for splitting the budget across campaigns — use budget-optimizer; not for in-flight pacing/scale moves — use budget-pacing-monitor; not for scoring the account — use ad-account-auditor. 出价策略/tCPA目标/tROAS/学习期PlanningNo warnings★ 3K↓ —
- ramp-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement a shared Ramp request budget with rolling-window throttling, bounded retries, pagination, and 504 recovery. Use when clients receive 429 or 504 responses or share one outbound IP. Trigger with "Ramp rate limit" or "Ramp 429".OtherNo warnings★ 2.9K↓ —
- kiro-spec-designgotalab/cc-sddGenerate comprehensive technical design translating requirements (WHAT) into architecture (HOW) with discovery process. Use when creating architecture from requirements.DesignNo warnings★ 3.7K↓ —
- apollo-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Apollo.io rate limiting and backoff. Use when handling rate limits, implementing retry logic, or optimizing API request throughput. Trigger with phrases like "apollo rate limit", "apollo 429", "apollo throttling", "apollo backoff", "apollo request limits".EngineeringNo warnings★ 2.9K↓ —
- clerk-androidclerk/skillsImplement Clerk authentication for native Android apps using Kotlin and Jetpack Compose with clerk-android source-guided patterns. Use for prebuilt AuthView/UserButton or custom API-driven auth flows. Do not use for Expo or React Native projects.OfficialEngineeringNo warnings★ 89↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 9.9K↓ —
- nvmolkit-usageNVIDIA/skillsUse when writing or debugging nvMolKit Python code for GPU-accelerated RDKit fingerprints, similarity, conformers, clustering, and molecular searches.WritingNo warnings★ 3.8K↓ —
- gsd:inboxdavepoon/buildwithclaudeTriage and review all open GitHub issues and PRs against project templates and contribution guidelinesEngineeringNo warnings★ 3.7K↓ —
- load-testing-apisjeremylongshore/tons-of-skills-marketplaceExecute comprehensive load and stress testing to validate API performance and scalability. Use when validating API performance under load. Trigger with phrases like "load test the API", "stress test API", or "benchmark API performance".TestingNo warnings★ 2.9K↓ —
- single-cell-rna-qcanthropics/knowledge-work-pluginsPerforms quality control on single-cell RNA-seq data (.h5ad or .h5 files) using scverse best practices with MAD-based filtering and comprehensive visualizations. Use when users request QC analysis, filtering low-quality cells, assessing data quality, or following scverse/scanpy best practices for single-cell analysis.OfficialOtherNo warnings★ 34K↓ —
- golang-stay-updatedsamber/cc-skills-golangGolang ecosystem watch list — official sources (go.dev/blog, pkg.go.dev, tour.golang.org, golang-nuts), newsletters (Golang Weekly, Awesome Go Newsletter), communities (r/golang, gophers.slack.com, Go Forum, go.dev/wiki), blogs (Dave Cheney, Ardan Labs, Rob Pike), YouTube channels (Gopher Academy, GopherCon EU/UK), conferences, and Go contributors to follow on GitHub, X and Bluesky. Use when seeking Golang learning resources, discovering new libraries or tools, finding community channels or meetups, picking Go people to follow, or keeping up with Go language changes and releases. Not for querying a specific module's versions, docs, or vulnerabilities from the CLI (→ See `samber/cc-skills-golang@golang-pkg-go-dev` skill).SecurityNo warnings★ 3.7K↓ —
- offensive-data-exfiltrationSnailSploit/Claude-RedDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitationDevOpsNo warnings★ 9.9K↓ —
lindy-install-auth
jeremylongshore/tons-of-skills-marketplace
OtherUpdated yesterday
From the author
Set up a Lindy account and authenticated webhook trigger. Use when onboarding to Lindy, configuring bearer authentication for webhook triggers, or connecting Lindy agents to your application. Trigger with phrases like "install lindy", "setup lindy", "lindy auth", "configure lindy webhook", "lindy webhook secret".
Install
npx skills add jeremylongshore/tons-of-skills-marketplace --skill lindy-install-auth -a claude-code
Installs to .claude/skills/lindy-install-auth/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (2)
- SKILL.md
- references/implementation-guide.md