Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 16 hours ago
47,966 skills
- memory-bridgeAr9av/obsidian-wikiBrowse or compare wiki knowledge by originating AI tool. Use for cross-tool memory questions, tool-specific knowledge, or gap/diff analysis between Codex, Claude, Hermes, and other agents.ProductivityNo warnings★ 3.6K↓ —
- golang-lintsamber/cc-skills-golangLinting best practices and golangci-lint configuration for Golang projects — running linters, configuring .golangci.yml, suppressing warnings with nolint directives, interpreting lint output, and selecting linters. Use when configuring golangci-lint, asking about lint warnings or nolint suppressions, setting up code quality tooling, or choosing linters. Also use when the user mentions golangci-lint, go vet, staticcheck, or revive. Not for wiring a lint step into a GitHub Actions pipeline (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).DevOpsNo warnings★ 3.7K↓ —
- omomomocode-yeongyu/oh-my-openagentEaster egg command - about oh-my-opencode. Triggers: omomomo, about, easter egg.OtherNo warnings★ 70.5K↓ —
- make-automationdavepoon/buildwithclaudeAutomate Make (Integromat) tasks via Rube MCP (Composio): operations, enums, language and timezone lookups. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- agentic-actions-auditortrailofbits/skillsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.SecurityNo warnings★ 7.9K↓ —
- audit-prep-assistanttrailofbits/skillsPrepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.SecurityNo warnings★ 7.9K↓ —
- narrative-baseline-mapperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "map what our surfaces say today", "inventory our current messaging", or "find the gap between what we say and what we mean"; produces the narrative baseline — a surface-by-surface inventory of what every owned touchpoint (homepage, pricing, docs, decks, social bios, email footers) claims RIGHT NOW, each line labeled Measured / User-provided / Estimated, plus a per-surface gap read vs the intended message and the drift-baseline snapshot the Evaluate phase measures future drift against. Not for authoring the canon — use message-system-architect; not for scoring the surfaces or running the vetoes — use narrative-quality-auditor. 现状叙事盘点/各触点口径/意图差距/漂移基线PlanningNo warnings★ 3K↓ —
- skill-livestreamZJU-REAL/Easel为直播生成完整方案：直播主题、流程时间表、开场白/过渡语/催单话术/感谢话术/互动话术。 适用于带货直播、知识分享直播、娱乐直播。 当用户说"直播策划"、"直播方案"、"直播话术"、"开播前准备"、"直播流程"、 "直播脚本"、"带货直播"、"怎么开播"、"直播怎么做"、"直播排期"、"写个直播话术"时触发。OtherNo warnings★ 4.2K↓ —
- pulumi-context-apipulumi/agent-skillsQuery the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill `pulumi-debug-failed-operation`).OfficialEngineeringNo warnings★ 78↓ —
- offsite-signal-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze backlinks", "analyze my off-site signals", or "track AI traffic / ChatGPT / Perplexity referrals"; profiles referring domains, anchor-text mix, toxic links, and disavow candidates (backlinks mode) or isolates AI-assistant referral sessions in GA4/GSC/logs and reports their trend, landing pages, and AI-vs-organic conversion (ai-referrals mode). Not for internal links — use site-structure-optimizer; not for keyword positions — use rank-tracker; not for multi-metric stakeholder reports — use performance-monitor. 外链分析/反向链接/AI流量/AI引荐/ChatGPT流量/AI转化MarketingNo warnings★ 3K↓ —
- gsd:ui-phasedavepoon/buildwithclaudeGenerate UI design contract (UI-SPEC.md) for frontend phasesDesignNo warnings★ 3.7K↓ —
- tao-train-segformerNVIDIA/skillsSegFormer for semantic segmentation. Lightweight transformer-based architecture with hierarchical feature extraction, efficient for real-time segmentation tasks. Use when training, evaluating, exporting, quantizing, or running inference for a TAO SegFormer model. Trigger phrases include "train SegFormer", "semantic segmentation", "lightweight transformer segmenter", "real-time semantic segmentation".PlanningNo warnings★ 3.8K↓ —
- dynamic-content-personalizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "personalize the email", "add merge tags / dynamic content", "set up conditional blocks per segment", or "make first-name and product-recommendation fields fall back safely"; produces a merge-tag map with per-tag fallbacks, conditional-block rules with per-segment variations, a fallback-safety audit, and a PII guard on what may render, informing the SEND E (Engagement/personalization) dimension. Not for building the segments — use list-segment-builder; not for writing the base copy — use email-creative-builder; not for scoring EQS or running vetoes — use email-quality-auditor. 邮件个性化/合并标签/条件内容块/兜底默认值MediaNo warnings★ 3K↓ —
- documentation-lookupforyourhealth111-pixel/Vibe-SkillsUse when the user needs current library, framework, or API documentation and version-specific code examples.PlanningNo warnings★ 3.8K↓ —
- reviewdavepoon/buildwithclaudePower-user audit of Origin's pending surfaces. Most users want `/brief` for revisions. That handles the daily flow. Use `/review` only for explicit deep-walk audits after bulk imports, or when you want to walk the full queue rather than the top 3 shown in /brief. Invoked as `/review captures` or `/review revisions`.EngineeringNo warnings★ 3.7K↓ —
- message-system-architectaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "author our durable brand message hierarchy", "build the brand message house that seeds the canon", or "define the main narrative, three pillars, and tagline for the whole brand"; produces the DURABLE brand message system — main narrative, three value pillars, per-persona proof points (each labeled Measured / User-provided / '[needs source]'), and the tagline/one-liner — that seeds the narrative-registry canon and from which every per-launch house derives. Not for a single launch's message house or PR-FAQ — use message-house-builder; not for claim adjudication — use offer-claims-registry; not for the change-narrative arc itself — use strategic-narrative-designer. 品牌消息屋/主叙事/三支柱/标语/持久叙事 canonPlanningNo warnings★ 3K↓ —
- technical-writingbacknotprop/pstackLayered technical-writing standard: Diátaxis structure, Google developer style sentences, STE instruction rules, Global English syntax. Use for /technical-writing or when writing or reviewing docs, RFCs, readmes, PR descriptions, or commit messages.WritingNo warnings★ 3.2K↓ —
- audience-mapperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze my target audience", "build an audience profile for influencer targeting", "research a niche community", or "deep-dive a subculture before partnering with creators"; in audience mode produces demographic/psychographic profiles, a platform-priority matrix, named personas, and an influencer-selection criteria set, and in niche mode produces a community map, culture decode (language/norms/taboos), key-voice tiers, a Brand Fit Score, and a phased entry strategy. Not for finding specific creators to contract — use influencer-discovery; not for scoring a shortlist on Suitability — use fit-scorer. 目标受众画像/人群分析 · 细分社群/亚文化调研ScienceNo warnings★ 3K↓ —
- route-handlersdavepoon/buildwithclaudeThis skill should be used when the user asks to "create an API route", "add an endpoint", "build a REST API", "handle POST requests", "create route handlers", "stream responses", or needs guidance on Next.js API development in the App Router.EngineeringNo warnings★ 3.7K↓ —
- tddmichael-denyer/pstack-claudeUse only when the user explicitly asks for TDD, a failing test, or a regression test, OR when the bug has an obvious cheap local test target. Skip when the test path is unclear, expensive, integration-heavy, or not requested.TestingNo warnings★ 3.7K↓ —
- narrative-resonance-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "measure how our narrative is landing", "track echo rate against our canon lexicon", or "check how AI answer engines describe our brand"; produces a resonance report — echo rate (overlap of market language with the narrative-registry canon lexicon, method declared), AI-answer perception via tavily.py --answer (proxy-labeled), share-of-voice on a locked competitor panel (reusing share-of-voice-tracker), and resonance signals from bluesky.py / gdelt.py / pageviews.py — every number labeled Measured / proxy / User-provided, feeding the TALE E dimension and the upstream of the E1 evidence-integrity veto. Not for rebuilding share-of-voice machinery — use share-of-voice-tracker; not for own-site GA4/GSC analytics — use performance-monitor; not for scoring TALE profile result — use narrative-quality-auditor; not for adjudicating claims — use offer-claims-registry. 回声率/AI回答感知/份额之声/共鸣信号DataNo warnings★ 3K↓ —
- embedding-strategiesforyourhealth111-pixel/Vibe-SkillsSelect and optimize embedding models for semantic search and RAG applications. Use when choosing embedding models, implementing chunking strategies, or optimizing embedding quality for specific domains.PlanningNo warnings★ 3.8K↓ —
- groq-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Groq rate limit handling with backoff, queuing, and header parsing. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Groq. Trigger with phrases like "groq rate limit", "groq throttling", "groq 429", "groq retry", "groq backoff".EngineeringNo warnings★ 2.9K↓ —
- interrogatebacknotprop/pstackUse for "interrogate", "adversarial review", "multi-model review", "challenge this", "stress test this code", "find blind spots", or "tear this apart". Adversaries try to break a change or design, and only findings proven by a run survive.TestingNo warnings★ 3.2K↓ —
offensive-bluetooth-ble
SnailSploit/Claude-Red
ScienceUpdated Oct 12, 2026
From the author
Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-bluetooth-ble -a claude-code
Installs to .claude/skills/offensive-bluetooth-ble/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md