Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 15 hours ago
47,966 skills
- clawringdavepoon/buildwithclaudePhone calling skill for OpenClaw: agent makes real outbound phone calls to users for alerts, briefings, reminders, and urgent notifications. Managed service, no Twilio setup needed. 100+ countries, 70+ voices.OtherNo warnings★ 3.7K↓ —
- gsd:remove-phasedavepoon/buildwithclaudeRemove a future phase from roadmap and renumber subsequent phasesPlanningNo warnings★ 3.7K↓ —
- remediationdavepoon/buildwithclaudeGet a context-aware remediation plan for a vulnerability with fix verification stepsSecurityNo warnings★ 3.7K↓ —
- ops-dashdavepoon/buildwithclaudeInteractive pixel-art command center dashboard. Visual business HQ with instant hotkey navigation to all ops commands, live status indicators, fire alerts, C-suite reports, settings, sharing, and FAQ.OtherNo warnings★ 3.7K↓ —
- gsd:audit-milestonedavepoon/buildwithclaudeAudit milestone completion against original intent before archivingOtherNo warnings★ 3.7K↓ —
- doca-aes-gcmNVIDIA/skillsUse this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or "AEAD" — typical implicit phrasings: "decrypt completion IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.SecurityNo warnings★ 3.8K↓ —
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserNo warnings★ 7.9K↓ —
- principle-redesign-from-first-principlesmichael-denyer/pstack-claudeApply when integrating a new requirement into an existing design.DesignNo warnings★ 3.7K↓ —
- principle-test-behavior-not-implementationmichael-denyer/pstack-claudeApply when you write, change, or keep a test. Assert what the code's users can observe, so that the test fails when that behavior breaks and keeps passing when only the internals change.TestingNo warnings★ 3.7K↓ —
- ops-daemondavepoon/buildwithclaudeCheck claude-ops background daemon end-to-end and auto-fix common issues. Detects stale plist paths after plugin upgrades, missing service commands, dead processes, corrupt health files, and bash version mismatches.OtherNo warnings★ 3.7K↓ —
- gsd:extract-learningsdavepoon/buildwithclaudeExtract decisions, lessons, patterns, and surprises from completed phase artifactsOtherNo warnings★ 3.7K↓ —
- ops-revenuedavepoon/buildwithclaudeRevenue and costs tracker. AWS spend via aws ce, credits tracker, project revenue stages. Shows burn rate, runway estimate, credits expiring.DevOpsNo warnings★ 3.7K↓ —
- launch-retro-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "run a launch retro / post-mortem", "compare launch results vs targets by channel", or "decide what to keep or kill for the next launch"; produces a structured D1/W1/M1 retrospective — a per-channel actual-vs-target table (UTM-attributed own analytics as the truth column, platform self-reported numbers as reference, every figure labeled Measured / User-provided / Estimated), a 5-Whys chain on the single largest miss, keep / kill / change decisions per channel, 3-5 actionable learnings for the next launch, and an outcome snapshot submitted to the launch registry. Not for return math (CPA / ROI) — use roi-calculator; not for the stakeholder-facing report writeup — use report-generator; not for a metric deep-dive — use performance-analyzer. 发布复盘/渠道归因/5-Whys/keep-killDataNo warnings★ 3K↓ —
- orca-replaydavepoon/buildwithclaudeAnswers questions about a past agent run from its recording rather than from memory, and replays or forks that run. Use when asked why an earlier run did something, or to reproduce a failure.ProductivityNo warnings★ 3.7K↓ —
- big-pics-little-wordsplannotator/effective-htmlExplain the current subject in HTML with large visuals and minimal text while preserving key details.OtherNo warnings★ 3.8K↓ —
- wan27-mediadavepoon/buildwithclaudeGenerate images and videos with Wan27, discover available models, estimate credit costs, and retrieve generation results through its MCP tools or CLI. Use when the user chooses Wan27 or wan2-7.io for media creation or task tracking.EngineeringNo warnings★ 3.7K↓ —
- ops-monitordavepoon/buildwithclaudeUnified APM and monitoring surface. Polls Datadog, New Relic, and OpenTelemetry backends for active alerts, error traces, and entity health. Use --watch for live polling every 60 seconds. Use --setup to configure monitoring credentials.OtherNo warnings★ 3.7K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- golang-uber-fxsamber/cc-skills-golangGolang application framework using uber-go/fx — fx.New, fx.Provide, fx.Invoke, fx.Module, fx.Lifecycle hooks, fx.Annotate (name/group/As), fx.Decorate, fx.Supply, fx.Replace, fx.WithLogger, and signal-aware Run(). Apply when using or adopting uber-go/fx, when the codebase imports `go.uber.org/fx`, or when wiring services with fx.New. For raw DI without lifecycle, see `samber/cc-skills-golang@golang-uber-dig` skill.OtherNo warnings★ 3.7K↓ —
- html-wireframeplannotator/effective-htmlDirect-invocation specialist for low-fidelity, self-contained HTML wireframes that test information hierarchy, content, navigation, task flow, and responsive structure before visual design. Use when the user explicitly invokes html-wireframe or the broad html skill routes a wireframe request here. Do not activate independently from a general request. Do not use for polished mockups or production-like interaction; use html-prototype for those.TestingNo warnings★ 3.8K↓ —
- golang-goplssamber/cc-skills-golangGolang semantic code intelligence via `gopls`, the official Go language server — go-to-definition, find references, call/implementation hierarchy, workspace symbol search, package API discovery, diagnostics, safe rename, refactors (extract/inline/fill/rewrite code actions), formatting, and generated tests. Reaches an agent via gopls's own MCP server (`go_*` tools), Claude Code's native `LSP` tool, or the `gopls` CLI. Use when navigating or refactoring Go code — jumping to a definition, finding call sites before a rename, understanding a file's or package's dependencies, running diagnostics after an edit, or extracting/inlining/renaming. Not for the published ecosystem — packages not in your `go.mod`, versions, licenses, importers — → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`). Not for a whole-tree vulnerability audit → See `samber/cc-skills-golang@golang-security` skill (`govulncheck`).SecurityNo warnings★ 3.7K↓ —
- memstackdavepoon/buildwithclaude127 production skills across 10 categories (Security, Deployment, Dev, Business, Content, SEO, Marketing, Product, Automation, Core). Skills auto-load based on your task. Includes localhost dashboard with Agent Runner, Burn Report, and session diary.SecurityNo warnings★ 3.7K↓ —
- cdf-auto-labelingNVIDIA/skillsUse when a user needs to get started with CDF Auto-Labeling, plan a scenario, run or debug a shipped cookbook, author prompts or cookbooks, migrate a pipeline, configure a stage, or pull the prebuilt stage containers from NGC (nvcr.io). Confirm critical inputs (data path, output path, endpoints) and ask when any are missing. This is a router: read the matching reference instead of inventing a workflow.PlanningNo warnings★ 3.8K↓ —
- contract-helperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "draft an influencer contract", "review these agreement terms", or "build a partnership template"; produces a full influencer agreement framework (scope, compensation, usage rights, exclusivity, FTC disclosure), a clause-by-clause review with red flags, and a negotiation cheat sheet. Not for outreach negotiation before a deal exists — use outreach-manager. 达人合同/合作协议条款审查LegalNo warnings★ 3K↓ —
constant-time-analysis
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
Install
npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
Installs to .claude/skills/constant-time-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (12)
- README.md
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/compiled.md
- references/javascript.md
- references/kotlin.md
- references/php.md
- references/python.md
- references/ruby.md
- references/swift.md
- references/vm-compiled.md