Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 16 hours ago
47,966 skills
- gsd:eval-reviewdavepoon/buildwithclaudeRetroactively audit an executed AI phase's evaluation coverage — scores each eval dimension as COVERED/PARTIAL/MISSING and produces an actionable EVAL-REVIEW.md with remediation planEngineeringNo warnings★ 3.7K↓ —
- principle-migrate-callers-then-delete-legacy-apismichael-denyer/pstack-claudeApply when introducing a new internal API while old callers still exist. Migrate callers and delete the old API in the same wave instead of preserving compatibility layers.EngineeringNo warnings★ 3.7K↓ —
- landing-experience-checkeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "pre-launch check the landing page", "run a Quality-Score preflight", or "verify ad-to-page message match before launch"; produces an ad↔page continuity report — message-match gaps, above-the-fold check, page-speed read, form-friction count, mobile-render flags — as a pass/fix punch list. Not for redesigning or rewriting the page — use landing-optimizer; not for scoring the account or the RQS — use ad-account-auditor. 落地页体验预检/广告落地页一致性检查DesignNo warnings★ 3K↓ —
- ops-deploydavepoon/buildwithclaudeDeploy status across all projects. Shows ECS service versions, Vercel deployments, recent deploys, pending deploys, and CI/CD pipeline state.DevOpsNo warnings★ 3.7K↓ —
- ops-lineardavepoon/buildwithclaudeLinear command center. Shows current sprint, creates/updates issues, manages priorities, syncs with GSD phases.OtherNo warnings★ 3.7K↓ —
- dcf-modelanthropics/financial-servicesReal DCF (Discounted Cash Flow) model creation for equity valuation. Retrieves financial data from SEC filings and analyst reports, builds comprehensive cash flow projections with proper WACC calculations, performs sensitivity analysis, and outputs professional Excel models with executive summaries. Use when users need to value a company using DCF methodology, request intrinsic value analysis, or ask for detailed financial modeling with growth projections and terminal value calculations.OfficialFinanceNo warnings★ 40.9K↓ —Also in 3 other repos
- video-to-articleZJU-REAL/Easel把口播、讲座、直播或 Vlog 转录并改写成小红书笔记、公众号文章或知乎内容，同时抽帧配图。当用户说“视频转图文/文章/笔记、视频扒文案、口播转文章、视频内容复用”时使用。只生成字幕文件用 auto-subtitle；翻译已有字幕用 subtitle-translate。MediaNo warnings★ 4.2K↓ —
- golang-dependency-injectionsamber/cc-skills-golangComprehensive guide for dependency injection (DI) in Golang. Covers why DI matters (testability, loose coupling, separation of concerns, lifecycle management), manual constructor injection, and DI library comparison (google/wire, uber-go/dig, uber-go/fx, samber/do). Use this skill when designing service architecture, setting up dependency injection, refactoring tightly coupled code, managing singletons or service factories, or when the user asks about inversion of control, service containers, or wiring dependencies in Go. For a specific DI library, → See `samber/cc-skills-golang@golang-google-wire`, `samber/cc-skills-golang@golang-uber-dig`, `samber/cc-skills-golang@golang-uber-fx`, or `samber/cc-skills-golang@golang-samber-do` skills.PlanningNo warnings★ 3.7K↓ —
- doca-capsNVIDIA/skillsUse this skill when the user wants to invoke the read-only doca_caps CLI to ask what DOCA sees on this host — listing DOCA devices and PCIe addresses, listing representor devices, asking which DOCA libraries are available on the current OS, checking per-device per-library capabilities, scoping output to a specific PCIe address, or capturing a side-effect-free capability snapshot for debug or install smoke-test. Trigger even when the user does not explicitly mention "doca_caps" or "capabilities print tool" — typical implicit phrasings include "what does DOCA actually see on this box", "is my BlueField PF visible to DOCA", "is Flow available on my RHEL host", "enumerate VF representors for pf0", "doca_caps: command not found", or "empty output for RDMA, is the tool broken". Refuse and route elsewhere for DOCA installation (doca-setup owns it; never walk the steps), library-internal capability matrices (Flow pipe creation, RDMA verbs features), streaming telemetry / DTS, or modifying the shipped binary.TestingNo warnings★ 3.8K↓ —
- golang-how-tosamber/cc-skills-golangGolang skills orchestrator — always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most relevant skills from samber/cc-skills-golang, often multiple at once: writing a gRPC service loads golang-grpc + golang-testing + golang-error-handling; debugging a panic loads golang-troubleshooting + golang-safety; auditing security loads golang-security + golang-lint + golang-safety. Also: disambiguates competing clusters when two skills seem to overlap (performance vs benchmark vs troubleshooting, samber/lo vs mo vs ro, DI cluster, safety vs security), and configures the project's agent-config file (CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, or Copilot instructions) to force-trigger skills in a project (/golang-how-to configure).SecurityNo warnings★ 3.7K↓ —
- property-based-testingforyourhealth111-pixel/Vibe-SkillsProperty-based testing with fast-check (TypeScript/JavaScript) and Hypothesis (Python). Generate test cases automatically, find edge cases, and test mathematical properties. Use when user mentions property-based testing, fast-check, Hypothesis, generating test data, QuickCheck-style testing, or finding edge cases automatically.TestingNo warnings★ 3.8K↓ —
- proposal-drafterdavepoon/buildwithclaudeDraft a tailored freelance proposal or platform profile bio from a real job posting/brief and the freelancer's actual background. Use when responding to a listing on Contra/Upwork/etc, or writing/updating a freelance profile. Never invents experience, clients, or credentials that weren't provided.WritingNo warnings★ 3.7K↓ —
- recallmichael-denyer/pstack-claudeReconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents), then hand back a tight current-state brief. Use for 'recall my work on X', 'catch me up', 'what have I been working on', 'where did I leave off', before starting or resuming work, and before telling the user that something was never recorded.ProductivityNo warnings★ 3.7K↓ —
- yt-researchjeremylongshore/tons-of-skills-marketplaceAnalyze competitor YouTube coverage and video opportunities using sourced observations with explicit sampling limits. Use when researching channels or a niche before ideation. Trigger with "research channels" or "competitive video research".ScienceNo warnings★ 2.9K↓ —
- principle-encode-lessons-in-structurebacknotprop/pstackApply when you catch yourself writing the same instruction a second time, or notice a recurring correction. Encode the rule as a lint, metadata flag, runtime check, or script instead of more text.WritingNo warnings★ 3.2K↓ —Also in 1 other repo
- whymichael-denyer/pstack-claudeUse for 'why does X work this way', 'why we picked Y', design rationale, regressions, postmortems, or data-backed thresholds. Discovers available MCPs and queries each evidence category (source control, issue tracker, long-form docs, real-time chat, infrastructure observability, error tracking, product analytics warehouse) in parallel, then returns a cited read on decisions and tradeoffs. Use how for runtime behavior.DevOpsNo warnings★ 3.7K↓ —
- social-selling-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "set up my founder social-selling routine", "build a daily engagement block for target accounts", or "turn funding / hiring signals into selling plays"; produces the founder/seller daily operating block — a time-boxed engagement-block spec (substantive value-add comments on target-account posts, never a pitch), warm-touch-before-ask cadence rules, trigger-response plays consuming the social-pulse-monitor B2B trigger watchlist (funding / hiring / launch signals), and a quarterly diagnostic that reads LinkedIn SSI as an input diagnostic only (Estimated, vendor-defined — never a target metric). All volume norms are Estimated/community-derived; all execution is human — zero mass-DM, zero connection-request automation, zero engagement automation (LinkedIn UA §8.2 red line); 1:1 pitch and DM mechanics route to outreach-manager. Not for cold email sequences — use cold-outbound-sequencer. 社交销售/创始人日常互动块/热身触达节奏/触发信号剧本PlanningNo warnings★ 3K↓ —
- earnings-recaphimself65/finance-skillsAnalyze a company's most recent (or a specified past) earnings report from Yahoo Finance data (yfinance): actual vs estimated EPS, surprise size, revenue and margin trends, and the stock's price reaction. Use this skill whenever the user asks how earnings went — beat or miss, earnings surprise, quarterly results, the post-earnings move, or an earnings call recap — including casual references to a past report such as "AMZN reported last night" or "how did they do". For an upcoming report, use earnings-preview.FinanceNo warnings★ 3.5K↓ —
- principle-migrate-callers-then-delete-legacy-apisbacknotprop/pstackApply when introducing a new internal API while old callers still exist. Migrate callers and delete the old API in the same wave instead of preserving compatibility layers.EngineeringNo warnings★ 3.2K↓ —Also in 1 other repo
- thumbgatedavepoon/buildwithclaudeA single hub to find Claude Skills, Agents, Commands, Hooks, Plugins, and Marketplace collections to extend Claude Code, Claude Desktop, Agent SDK and OpenClawEngineeringNo warnings★ 3.7K↓ —
- work-with-prcode-yeongyu/oh-my-openagentFull PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the smallest atomic, independently-mergeable PRs and builds the independent ones concurrently via one worktree per PR driven by parallel subagents or a team. Unbounded loop: any failing gate sends you back to fix-and-re-QA inside that PR's worktree. Use whenever implementation work needs to land as a PR. Triggers: 'create a PR', 'implement and PR', 'work on this and make a PR', 'implement issue', 'land this as a PR', 'split into atomic PRs', 'parallel PRs', 'work-with-pr', 'PR workflow', 'implement end to end', even when user just says 'implement X' if the context implies PR delivery.TestingNo warnings★ 70.5K↓ —Also in 1 other repo
- replay-regressiontrailofbits/skillsUse when independently verifying a supplied PoC against fresh live before/after deployments.DevOpsNo warnings★ 7.9K↓ —
- ops-whatsapp-bizdavepoon/buildwithclaudeWhatsApp Business Cloud API — send approved template messages at scale, manage templates with approval tracking, and integrate product catalogs. Separate from wacli personal WhatsApp.EngineeringNo warnings★ 3.7K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 7.9K↓ —
trailmark-structural
trailofbits/skills
ProductivityUpdated 3 days ago
From the author
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.
Install
npx skills add trailofbits/skills --skill trailmark-structural -a claude-code
Installs to .claude/skills/trailmark-structural/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg