Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 16 hours ago
47,966 skills
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 9.9K↓ —
- security-reviewerforyourhealth111-pixel/Vibe-SkillsDedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.SecurityNo warnings★ 3.8K↓ —
- clerk-testingclerk/skillsE2E testing for Clerk apps. Use with Playwright or Cypress for auth flow tests.OfficialTestingNo warnings★ 89↓ —
- discord-automationdavepoon/buildwithclaudeAutomate Discord tasks via Rube MCP (Composio): messages, channels, roles, webhooks, reactions. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- cursor-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate your first project using Cursor AI features: Tab, Chat, Composer, and Inline Edit. Triggers on "cursor hello world", "first cursor project", "cursor getting started", "try cursor ai", "cursor basics", "cursor tutorial".WritingNo warnings★ 2.9K↓ —
- sharp-edgestrailofbits/skillsIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.SecurityNo warnings★ 7.9K↓ —
- miro-sdk-patternsjeremylongshore/tons-of-skills-marketplaceChoose and implement Miro Node client or raw REST adapter patterns with typed boundaries, pagination, tenant isolation, and explicit operator commands. Use when designing a Miro API adapter. Trigger with "review Miro SDK pattern".EngineeringNo warnings★ 2.9K↓ —
- neon-authUpdatedneondatabase/agent-skillsAdd authentication to a new app. Use for "add auth", "add login", Neon Auth (Managed Better Auth), identity routing, sign-up, sign-in, password reset, email OTP, magic links, organizations, phone OTP, OAuth, passkeys, MFA, trusted domains, invalid domain, and @neon/auth. No existing identity: default to Managed Better Auth. Keep working Better Auth, Clerk, Supabase Auth, or another IdP. User asked to migrate from Supabase Auth: Managed Better Auth. A required plugin outside Managed support: self-managed Better Auth on a Neon Function or the existing app host. Also use for auth APIs in @neon/neon-js.OfficialProductivityNo warnings★ 108↓ —Also in 1 other repo
- seabornforyourhealth111-pixel/Vibe-SkillsStatistical visualization. Scatter, box, violin, heatmaps, pair plots, regression, correlation matrices, KDE, faceted plots, for exploratory analysis and publication figures.OtherNo warnings★ 3.8K↓ —Also in 1 other repo
- golang-samber-rosamber/cc-skills-golangReactive streams and event-driven programming in Golang using samber/ro — ReactiveX implementation with 150+ type-safe operators, cold/hot observables, 5 subject types (Publish, Behavior, Replay, Async, Unicast), declarative pipelines via Pipe, 40+ plugins (HTTP, cron, fsnotify, JSON, logging), automatic backpressure, error propagation, and Go context integration. Apply when using or adopting samber/ro, when the codebase imports github.com/samber/ro, or when building asynchronous event-driven pipelines, real-time data processing, streams, or reactive architectures in Go. Not for finite slice transforms (→ See `samber/cc-skills-golang@golang-samber-lo` skill).PlanningNo warnings★ 3.7K↓ —
- docs-reviewforyourhealth111-pixel/Vibe-SkillsReview documentation changes for compliance with the Metabase writing style guide. Use when reviewing pull requests, files, or diffs containing documentation markdown files.EngineeringNo warnings★ 3.8K↓ —
- pulumi-componentpulumi/agent-skillsGuide for authoring Pulumi ComponentResource classes. Use when creating reusable infrastructure components, designing component interfaces, setting up multi-language support, or distributing component packages.OfficialDevOpsNo warnings★ 78↓ —
- owner-goalsthedotmack/claude-memMap what the owner wants from the prompts they typed themselves (prompts an agent wrote are left out), then sort it into focus areas, asks and rules, each with dated quotes, and save them to My Work (areas as My Focus suggestions, rules as My Rules suggestions). Use when asked for "owner goals", "my goals", "what do I want", "what am I asking for", "map my prompts", or to refresh Goals in My Work.OtherNo warnings★ 105.5K↓ —
- earth2studio-discoverNVIDIA/skillsFind Earth2Studio models, data sources, and examples for a weather/climate use case. Do NOT use for writing inference code, downloading data, or installation.WritingNo warnings★ 3.8K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- agent-creatorjeremylongshore/tons-of-skills-marketplaceCreate production-grade agent .md files aligned with the current Anthropic subagent contract. Also validates existing agents against the marketplace compliance rules. Use when building custom subagents, reviewing agent quality, or creating parallel agent architectures for orchestrator skills. Trigger with "/agent-creator", "create an agent", "build a subagent", or "validate my agent". Make sure to use this skill whenever creating agents/*.md files for plugins or standalone use.LegalNo warnings★ 2.9K↓ —
- neonUpdatedneondatabase/agent-skillsOverview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASE_URL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, a no-signup database, or pairing Neon with Upstash for cache, Redis, rate limiting, queues, or background jobs.OfficialDevOpsNo warnings★ 108↓ —Also in 1 other repo
- session-brainAr9av/obsidian-wikiBuild or refresh a browser-viewable topic graph over Claude session history using local clustering. Use for mapping or clustering sessions, recent or stale topic analysis, or rebuilding/showing the session graph. Unlike wiki-history-ingest, it indexes raw sessions and never writes to the vault.BrowserNo warnings★ 3.6K↓ —
- Agent Cost Reportthedotmack/claude-memBelievable agent cost report for any period, default the last 7 full days PT, not counting today. Measured tokens from Claude Code transcripts priced at OpenRouter list prices (ESTIMATED), measured provider spend when a sanctioned source exists, note-taker cost separate, Timing-style HTML/PDF plus report.json, line-items.csv, evidence.json.DataNo warnings★ 105.5K↓ —Also in 4 other repos
- creator-content-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "review this influencer content" or "check if this post meets brand guidelines"; runs the typed STAR pre-publish gate, scores Trust and Appeal on the deliverable, folds in the creator Suitability read, computes the profile-weighted SQS, checks the disclosure/claim/brand-safety and fraud/fake-engagement vetoes, and writes constructive revision feedback. Not for drafting the brief — use brief-generator; not for partnership terms — use contract-helper. 达人内容审核/发布前质检LegalNo warnings★ 3K↓ —
- ramp-common-errorsjeremylongshore/tons-of-skills-marketplaceAnalyze and resolve Ramp API failures using status, error_v2, x-trace-id, OAuth scope, and retry safety. Use when an integration returns 400, 401, 403, 404, 422, 429, 5xx, or 504. Trigger with "Ramp API error" or "Ramp forbidden".EngineeringNo warnings★ 2.9K↓ —
- wiki-history-ingestAr9av/obsidian-wikiRoute generic agent-history ingestion requests to the appropriate specialized history-ingest skill. Use when the user asks to ingest AI-agent history without directly selecting the underlying agent-specific skill.PlanningNo warnings★ 3.6K↓ —
- validate-pluginjeremylongshore/tons-of-skills-marketplaceValidate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard. Runs structural validation (plugin.json fields, file references, permissions) and content validation (SKILL.md grading, command/agent frontmatter). Use when building a new plugin, preparing for marketplace submission, or auditing existing plugins. Trigger with "validate this plugin", "check plugin structure", "grade my plugin", "/validate-plugin".PlanningNo warnings★ 2.9K↓ —
- hyperframesnexu-io/open-designCreate video compositions, animations, title cards, overlays, captions, voiceovers, audio-reactive visuals, and scene transitions in HyperFrames HTML. Use when asked to build any HTML-based video content, add captions or subtitles synced to audio, generate text-to-speech narration, create audio-reactive animation (beat sync, glow, pulse driven by music), add animated text highlighting (marker sweeps, hand-drawn circles, burst lines, scribble, sketchout), or add transitions between scenes (crossfades, wipes, reveals, shader transitions). Covers composition authoring, timing, media, and the full video production workflow. For CLI commands (init, lint, preview, render, transcribe, tts) see the hyperframes-cli skill.MediaNo warnings★ 105K↓ —Also in 1 other repo
nemoclaw-user-guide
NVIDIA/skills
EngineeringUpdated yesterday
From the author
Guides human users' AI agents to the NemoClaw docs MCP server and canonical Fern documentation in Markdown form. Use when users ask how to install, configure, operate, troubleshoot, secure, or learn NemoClaw with an AI coding assistant. Trigger keywords - nemoclaw docs, use nemoclaw with ai agent, nemoclaw mcp docs, nemoclaw install help, nemoclaw quickstart, nemoclaw markdown docs, llms.txt, agent skills.
Install
npx skills add NVIDIA/skills --skill nemoclaw-user-guide -a claude-code
Installs to .claude/skills/nemoclaw-user-guide/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (5)
- BENCHMARK.md
- SKILL.md
- evals/evals.json
- skill-card.md
- skill.oms.sig