Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 16 hours ago
47,966 skills
- work-with-prcode-yeongyu/oh-my-openagentFull PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the smallest atomic, independently-mergeable PRs and builds the independent ones concurrently via one worktree per PR driven by parallel subagents or a team. Unbounded loop: any failing gate sends you back to fix-and-re-QA inside that PR's worktree. Use whenever implementation work needs to land as a PR. Triggers: 'create a PR', 'implement and PR', 'work on this and make a PR', 'implement issue', 'land this as a PR', 'split into atomic PRs', 'parallel PRs', 'work-with-pr', 'PR workflow', 'implement end to end', even when user just says 'implement X' if the context implies PR delivery.TestingNo warnings★ 70.5K↓ —Also in 1 other repo
- wiki-updateAr9av/obsidian-wikiSync knowledge from the current project into the Obsidian wiki. Use when work already in the current project should be distilled into the vault; named-vault routing includes @work update wiki. wiki-capture saves the current conversation and wiki-ingest handles external/new sources.ProductivityNo warnings★ 3.6K↓ —
- secure-workflow-guidetrailofbits/skillsGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.ProductivityNo warnings★ 7.9K↓ —
- principle-foundational-thinkingmichael-denyer/pstack-claudeApply before writing logic: choosing core types and data structures, sequencing scaffold-vs-feature work, asking what concurrent actors share. Get the data structures right so downstream code becomes obvious.WritingNo warnings★ 3.7K↓ —
- plotlyforyourhealth111-pixel/Vibe-SkillsInteractive scientific and statistical data visualization library for Python. Use when creating charts, plots, or visualizations including scatter plots, line charts, bar charts, heatmaps, 3D plots, geographic maps, statistical distributions, financial charts, and dashboards. Supports both quick visualizations (Plotly Express) and fine-grained customization (graph objects). Outputs interactive HTML or static images (PNG, PDF, SVG).DocumentsNo warnings★ 3.8K↓ —Also in 2 other repos
- mcore-create-issueNVIDIA/skillsInvestigate a failing GitHub Actions run or job and create a GitHub issue for the failure.DevOpsNo warnings★ 3.8K↓ —
- create-verification-skillbacknotprop/pstackGenerate a project-local verification skill that drives your app the way a user does — any language, framework, or platform. Use for /create-verification-skill, "make a control skill for this repo", or when a project has no scripted way to prove UI/CLI/service behavior.DesignNo warnings★ 3.2K↓ —
- groq-observabilityjeremylongshore/tons-of-skills-marketplaceSet up observability for Groq integrations: latency histograms, token throughput, rate limit gauges, cost tracking, and Prometheus alerts. Use when instrumenting Groq API calls, building a metrics dashboard, or wiring latency/cost/rate-limit alerts. Trigger with phrases like "groq monitoring", "groq metrics", "groq observability", "monitor groq", "groq alerts", "groq dashboard".DevOpsNo warnings★ 2.9K↓ —
- gsd:audit-milestonedavepoon/buildwithclaudeAudit milestone completion against original intent before archivingOtherNo warnings★ 3.7K↓ —
- ops-dashdavepoon/buildwithclaudeInteractive pixel-art command center dashboard. Visual business HQ with instant hotkey navigation to all ops commands, live status indicators, fire alerts, C-suite reports, settings, sharing, and FAQ.OtherNo warnings★ 3.7K↓ —
- nemo-retriever-mcpNVIDIA/skillsUse when a task needs to search or add documents through NeMo Retriever MCP.ProductivityNo warnings★ 3.8K↓ —
- principle-prove-it-worksbacknotprop/pstackApply after completing a task, before declaring done. Verify against the real artifact (run the feature, read the actual value, inspect the diff), not a proxy, self-report, or 'it compiles.'ProductivityNo warnings★ 3.2K↓ —Also in 2 other repos
- gsd:resume-atdavepoon/buildwithclaudeSchedule a future resume of work - e.g. '/gsd:resume-at 09:00', '/gsd:resume-at +2h', or '/gsd:resume-at 04:00 --cmd /gsd:execute-phase 9'OtherNo warnings★ 3.7K↓ —
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 9.9K↓ —
- upgradenowork-studio/notfair-pluginUpgrade the NotFair plugin to the latest version. Updates the marketplace repo, installs the new version to the plugin cache, and updates installed_plugins.json. Use when asked to "upgrade notfair", "update notfair", or "get latest version". Also handles inline upgrade prompts when a skill detects UPGRADE_AVAILABLE at startup.OtherNo warnings★ 4.1K↓ —
- docs-reviewforyourhealth111-pixel/Vibe-SkillsReview documentation changes for compliance with the Metabase writing style guide. Use when reviewing pull requests, files, or diffs containing documentation markdown files.EngineeringNo warnings★ 3.8K↓ —
- thermosmichael-denyer/pstack-claudeLaunch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.SecurityNo warnings★ 3.7K↓ —
- clawringdavepoon/buildwithclaudePhone calling skill for OpenClaw: agent makes real outbound phone calls to users for alerts, briefings, reminders, and urgent notifications. Managed service, no Twilio setup needed. 100+ countries, 70+ voices.OtherNo warnings★ 3.7K↓ —
- opsdavepoon/buildwithclaudeBusiness operations command center. Routes to the right ops command based on what you need — briefing, inbox, fires, projects, comms, triage, linear, revenue, deploy, or yolo mode.DevOpsNo warnings★ 3.7K↓ —
- clerk-orgsclerk/skillsClerk Organizations for B2B and multi-tenant apps - org switching, roles and permissions, verified domains, and enterprise SSO. Use for team workspaces, RBAC, org-scoped routing, member management. Also load this when a project treats teams, workspaces, tenants, or companies as its customers - shared accounts, inviting teammates, per-seat pricing, per-company data isolation - even when the words "organization" or "B2B" are never used.OfficialOtherNo warnings★ 89↓ —
- clerk-billingclerk/skillsClerk Billing for subscription management - render Clerk's PricingTable and in-app checkout drawer, configure subscription plans, seat-limit plans for B2B, feature entitlements with has(), and billing webhooks. Use for SaaS monetization, plan gating, checkout flows, trials, invoicing, and subscription lifecycle management.OfficialMediaNo warnings★ 89↓ —
- tao-train-grounding-dinoNVIDIA/skillsGrounding DINO for open-set object detection. Combines DINO-style detection with a BERT text encoder for language-guided detection — detects objects described by text prompts without a fixed class vocabulary. Use when training, evaluating, exporting, quantizing, or running inference for a TAO Grounding DINO model. Trigger phrases include "train Grounding DINO", "open-vocabulary detection", "text-prompted detector", "language-guided object detection".OtherNo warnings★ 3.8K↓ —
- clerkclerk/skillsClerk authentication router. Use when user asks about Clerk CLI operations, adding authentication, setting up Clerk, custom sign-in flows, Swift or native iOS auth, native Android auth, Next.js patterns, React patterns, Vue patterns, Nuxt patterns, Astro patterns, TanStack Start patterns, Expo patterns, React Router patterns, Chrome Extension patterns, organizations, billing, subscriptions, payments, pricing, plans, seat-based pricing, feature entitlements, syncing users, testing, impersonating a user, or testing webhooks locally. Automatically routes to the specific skill based on their task.OfficialTestingNo warnings★ 89↓ —
- gsd:new-workspacedavepoon/buildwithclaudeCreate an isolated workspace with repo copies and independent .planning/PlanningNo warnings★ 3.7K↓ —
offensive-ssti
SnailSploit/Claude-Red
TestingUpdated Oct 12, 2026
From the author
Dense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-ssti -a claude-code
Installs to .claude/skills/offensive-ssti/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md