Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 16 hours ago
47,966 skills
- maintain-verification-skillbacknotprop/pstackPeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.2K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.9K↓ —
- site-structure-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "plan my site structure", "design the page hierarchy / navigation / URL taxonomy", "fix internal linking", or "find orphan pages"; runs two modes — architecture (hierarchy, nav, URL patterns, hub/spoke clusters, Mermaid site maps) and linking (link graph, authority flow, anchor text, orphan disposition, source/target/anchor plan) — and outputs a structure score /100 plus a handoff summary. Not for external backlinks — use offsite-signal-analyzer; not for XML sitemap or indexation issues — use technical-seo-checker. 网站架构/信息架构/站点地图/内链优化DesignNo warnings★ 3K↓ —
- agent-creatorjeremylongshore/tons-of-skills-marketplaceCreate production-grade agent .md files aligned with the current Anthropic subagent contract. Also validates existing agents against the marketplace compliance rules. Use when building custom subagents, reviewing agent quality, or creating parallel agent architectures for orchestrator skills. Trigger with "/agent-creator", "create an agent", "build a subagent", or "validate my agent". Make sure to use this skill whenever creating agents/*.md files for plugins or standalone use.LegalNo warnings★ 2.9K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- adk-agent-builderjeremylongshore/tons-of-skills-marketplaceScaffold production-ready AI agents on Google's Agent Development Kit (ADK): ReAct-style single agents, multi-agent orchestration (Sequential/Parallel/Loop), tool wiring, evaluation, and optional Vertex AI Agent Engine deployment. Use when building, scaffolding, or deploying ADK agents on Google Cloud, or when wiring ADK tools and orchestration patterns. Trigger with "build an ADK agent", "scaffold an agent on ADK", or "deploy to Agent Engine".DevOpsNo warnings★ 2.9K↓ —
- clerk-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Clerk costs and understand pricing. Use when planning budget, reducing costs, or understanding Clerk pricing model. Trigger with phrases like "clerk cost", "clerk pricing", "reduce clerk cost", "clerk billing", "clerk budget".PlanningNo warnings★ 2.9K↓ —
- exa-observabilityjeremylongshore/tons-of-skills-marketplaceInstrument Exa calls with content-free metrics, traces, cost, and asynchronous lifecycle signals that support diagnosis without logging retrieved text. Use when operating or reviewing this Exa boundary. Trigger with "Exa observability", "review Exa observability", or "fix Exa observability".DevOpsNo warnings★ 2.9K↓ —
- sales-enablement-kitaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build battle cards", "prep the sales team for launch", or "write the internal launch FAQ"; produces the internal enablement kit for a sales-led launch — battle cards vs each named alternative (where we win / where they win / trap questions, every fact traceable), a sales talk track derived from the PR-FAQ spine, an objection-handling table (objection → response → evidence), internal FAQ + CS macros, and an internal launch announcement with embargo discipline. Not for the external message house — use message-house-builder; not for competitor tracking itself — use competitor-tracker or competitor-analysis; not for outbound sequences — use cold-outbound-sequencer. 销售赋能/battle card/销售叙事/异议处理/内部FAQWritingNo warnings★ 3K↓ —
- launch-readiness-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit our launch plan", "are we ready to launch", or evaluate launch execution/outcomes; runs one typed RAMP preflight, execution, or outcome profile without mixing time horizons. Not for recording launch state — use launch-registry; not for running launch day — use launch-day-conductor. 发布就绪审计/RAMP分阶段评估/发布前放行PlanningNo warnings★ 3K↓ —
- budget-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "allocate my influencer budget", "optimize spend across tiers", or "compare budget scenarios"; produces a tier/platform/content allocation table, ROI and CPM/CPE projections, scenario comparisons, and mid-campaign reallocation moves. Not for building the full campaign plan — use campaign-planner. 达人预算分配/投放预算优化MarketingNo warnings★ 3K↓ —
- product-feed-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "optimize my Shopping feed", "fix product disapprovals", "improve product titles/attributes", or "build feed-driven PMax asset groups"; audits and rewrites the Shopping/Performance Max product feed — title/description patterns, required and recommended attributes, GTIN/availability/price hygiene, disapproval triage, and feed-driven asset-group / listing-group structure — informing the ROAS O (Offer) dimension. Not for text ad copy — use ad-creative-builder; not for scoring the account or the RQS — use ad-account-auditor. 商品Feed优化/购物广告Feed/商品标题优化/商品禁投修复MarketingNo warnings★ 3K↓ —
- social-calendar-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build our social posting calendar", "set weekly slots and queue depth per channel", or "plan the evergreen recycle rotation"; produces the always-on brand calendar — pillar allocation with hero/hub/help balance and give:ask targets (all labeled Estimated starting heuristics to calibrate against own analytics, never scored rules), per-channel recurring slots with queue depth, a batching workflow, an evergreen recycle cycle with freshness re-checks, deliberate open slots for realtime/trend moments fed by trend-spotter go/skip verdicts, and first-comment/publish-order ops — cadence commitments filed to the channel registry, and no batch ships to the queue without a SHIP verdict from social-quality-auditor pre-publish mode. Not for repurposing an existing asset or the paid-amplification calendar — use content-amplifier. 社媒排期/内容日历/栏目配比/常青循环复用ProductivityNo warnings★ 3K↓ —
- deliverability-qaaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "run a deliverability pre-flight before I send", "check my SPF/DKIM/DMARC/BIMI", "why am I landing in spam / promotions", or "score my sender reputation and list hygiene"; runs the ONE-TIME pre-send SEND S1 authentication pre-flight and builds the SEND S (Sender-integrity / Deliverability) evidence read — DNS + DMARC-RUA auth, domain/IP reputation, inbox placement, content/link/render, and point-in-time bounce/complaint hygiene — using Pass/Partial/Fail/Unknown/N/A states and scoring only at complete applicable coverage. Not for the recurring hygiene trend — use list-hygiene-monitor; not for final EQS or veto verdicts — use email-quality-auditor; not for segments/suppression lists — use list-segment-builder. 邮件送达率预检/SPF DKIM DMARC认证/发件域声誉TestingNo warnings★ 3K↓ —
- subject-line-labaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "generate subject line variants", "pre-score my subject lines", or "will this subject get truncated / trigger spam filters"; produces a labeled subject + preheader variant set and a per-variant heuristic pre-score card — spam-trigger flags, length/truncation across desktop + mobile, emoji-count, and the inbox preview render (from-name + subject + preheader) — before any test is run. Not for the body copy or CTA — use email-creative-builder; not for the A/B test design or significance read — use send-experiment-designer; not for the profile-weighted EQS or the S1/S2/N1/D1 vetoes — use email-quality-auditor. 邮件主题行生成/主题行预打分/截断与垃圾词检查TestingNo warnings★ 3K↓ —
- semgrep-rule-creatortrailofbits/skillsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.SecurityNo warnings★ 7.9K↓ —
- mocking-apisjeremylongshore/tons-of-skills-marketplaceGenerate mock API servers for testing and development with realistic response data. Use when creating mock APIs for development and testing. Trigger with phrases like "create mock API", "generate API mock", or "setup mock server".TestingNo warnings★ 2.9K↓ —
- short-video-scripteraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "script this short video", "write a TikTok / Reels / Shorts script", "给这条抖音或视频号视频写脚本", or "fix the hook — viewers drop off in the first seconds"; produces timestamped beat-sheet scripts on the retention-gate model (0-2s hook / 2-5s confirmation / 5-15s payoff / loop-or-CTA) with per-scene script lines, on-screen text for muted viewing, asset keywords, and 9:16 format-param rows per platform norm card for TikTok, Reels, Shorts, 抖音, and 视频号 — plus 2-3 hook options from named hook families and an AI-content disclosure line by default on realistic synthetic media. Spec-only: rendering, TTS, and publishing stay with the user's own tools — no pipelines, no upload automation. Not for creator video briefs — use brief-generator; long-form video SEO belongs to content-writer. 短视频脚本/抖音分镜/开头钩子/竖屏9:16MediaNo warnings★ 3K↓ —
- memory-managementaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "remember project context", review saved findings, initialize runtime memory, archive stale work, reconcile notes, or erase a subject; manages authorized HOT/WARM/COLD working memory across all disciplines while preserving registry event ownership and privacy controls. Not for changing canonical registry facts - route those through the owning registry. 项目记忆/跨会话ProductivityNo warnings★ 3K↓ —
- gh-dashjeremylongshore/tons-of-skills-marketplaceProvides a GitHub pull request dashboard directly in the terminal. Use when the user wants to view PR status, check CI/CD progress, review bot comments, or merge pull requests without leaving Claude Code. Trigger with phrases like "show PR dashboard", "PR status", "check CI progress", "merge this PR", or "review pull request".DevOpsNo warnings★ 2.9K↓ —
- gsd:code-reviewdavepoon/buildwithclaudeReview source files changed during a phase for bugs, security issues, and code quality problemsEngineeringNo warnings★ 3.7K↓ —
- quit-sponsorjeremylongshore/tons-of-skills-marketplaceTurns an AI agent with persistent memory into a quit-smoking sponsor. Use when a person asks for help quitting smoking (cigarettes or other smoked tobacco), announces they are quitting, reports a craving, a slip, or a relapse, goes silent mid-quit, or asks the agent to witness and track a quit. Provides evidence-based protocols (immediate execution of the quit decision, urge surfing, slip attribution coaching, withdrawal timelines, nutrition and alcohol rules, NRT guidance, a two-year aftercare cadence) plus a sponsor decision tree with an order-of-operations for colliding rules, a three-clause contract, purge ritual, graded live-crisis ladder for a pack already in hand, wave protocol, slip and post-relapse protocols, recurrence escalation, silence protocol, a Ulysses pact, a red-flag medical playbook, high-risk situation mapping, if-then plans, and a timestamped logbook. Includes a low-verbal client mode and an optional module for cannabis co-use and tobacco-mixed joints. Not a medical device.ScienceNo warnings★ 2.9K↓ —
- kiro-validate-gapgotalab/cc-sddAnalyze implementation gap between requirements and existing codebasePlanningNo warnings★ 3.7K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —Also in 5 other repos
harness-writing
trailofbits/skills
WritingUpdated 3 days ago
From the author
Designs and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, and deciding what to fuzz together. Use when writing a first LLVMFuzzerTestOneInput or fuzz_target! harness, when a campaign finds nothing or reports crashes that will not reproduce, or when the target API needs structured rather than raw input.
Install
npx skills add trailofbits/skills --skill harness-writing -a claude-code
Installs to .claude/skills/harness-writing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg