Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 25 minutes ago
48,168 skills
- howbacknotprop/pstackUse for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Use why for motivation.PlanningNo warnings★ 3.3K↓ —
- provider-resourceshashicorp/agent-skillsImplement Terraform Provider resources and data sources using the Plugin Framework: CRUD operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually consistent APIs, import support, resource design principles, and required acceptance test coverage. Use when adding or changing a resource or data source, deciding whether an API concept should be a resource, wiring a resource to the provider's configured client, handling drift or resource-not-found, or reviewing a resource implementation before submission.OfficialTestingNo warnings★ 910↓ —
- mindmapZJU-REAL/Easel思维导图：把 Markdown 大纲（标题层级 + 列表）渲染成可交互思维导图 HTML，可选导出 PNG。适合知识结构、内容框架、SWOT、脑图梳理。当用户说 思维导图、脑图、mindmap、知识导图、大纲图、把要点做成脑图、内容结构图、SWOT图、树状图 时使用。基于 shared/scripts/mindmap.py（markmap 自包含 HTML + Chromium 渲染 PNG）。与 chart-visualization/infographic 区别：那些做数据图表/信息图，本 SKILL 专做层级大纲思维导图。OtherNo warnings★ 4.2K↓ —
- negotiatejeremylongshore/tons-of-skills-marketplaceUse when preparing clause-linked contract counterproposals, fallback positions, or a negotiation email draft from supplied terms and commercial priorities. Trigger with /negotiate or generate counter-proposals for this contract.LegalNo warnings★ 2.9K↓ —
- gateplugin87/ux-ui-agent-skillsRun the one-command quality gate and report the real N/N result. Use before claiming any build/review is done.EngineeringNo warnings★ 3.1K↓ —
- golang-code-stylesamber/cc-skills-golangGolang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See `samber/cc-skills-golang@golang-naming` skill), linter configuration (→ See `samber/cc-skills-golang@golang-lint` skill), or doc comments (→ See `samber/cc-skills-golang@golang-documentation` skill).EngineeringNo warnings★ 3.7K↓ —
- aurakitdavepoon/buildwithclaudeSonnet Amplified fullstack engine. 34 modes, SEC-01~15 OWASP security, 13 runtime hooks, 75% token reduction. Install: npx @smorky85/aurakitSecurityNo warnings★ 3.7K↓ —
- solve-challengeljagiello/ctf-skillsSolves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.PlanningNo warnings★ 3.6K↓ —
- earnings-previewhimself65/finance-skillsBuild a pre-earnings briefing for a stock from Yahoo Finance data (yfinance): the upcoming report date and timing, consensus EPS and revenue estimates with their range, the beat/miss track record, analyst ratings and price targets, and what to watch in the print. Use this skill whenever the user is preparing for an upcoming earnings report or asks what the street expects — consensus or whisper numbers, EPS expectations, whether a company will beat, an earnings setup, or an earnings-season preview — and whenever a ticker comes up in the context of upcoming earnings, even without the word "preview". For results that are already out, use earnings-recap.FinanceNo warnings★ 3.5K↓ —
- architecturedavepoon/buildwithclaudeArchitecture design skill with ADR records, system design checklists, scalability assessment, and architecture patternsPlanningNo warnings★ 3.7K↓ —
- brodavepoon/buildwithclaudeRe-explain the previous assistant message, or any text typed after the command, in a much simpler way. For when a reply made you go 'bro what'. Use /bro for a plain-language version of the last answer, or /bro <text> to simplify a pasted paragraph, error, email, or doc.ProductivityNo warnings★ 3.7K↓ —
- hex-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect Hex debug evidence for support tickets and troubleshooting. Use when encountering persistent issues, preparing support tickets, or collecting diagnostic information for Hex problems. Trigger with phrases like "hex debug", "hex support bundle", "collect hex logs", "hex diagnostic".EngineeringNo warnings★ 2.9K↓ —
- gsd:importdavepoon/buildwithclaudeIngest external plans with conflict detection against project decisions before writing anything.WritingNo warnings★ 3.7K↓ —
- terraform-testhashicorp/agent-skillsComprehensive guide for writing and running Terraform tests. Use when creating test files (.tftest.hcl), writing test scenarios with run blocks, validating infrastructure behavior with assertions, mocking providers and data sources, testing module outputs and resource configurations, or troubleshooting Terraform test syntax and execution.OfficialTestingNo warnings★ 910↓ —
- aflpptrailofbits/skillsSets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.OtherNo warnings★ 7.9K↓ —
- fuzzing-dictionarytrailofbits/skillsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.PlanningNo warnings★ 7.9K↓ —
- thought-partnerjeremylongshore/tons-of-skills-marketplaceCollaborative thinking partner for exploring ideas, challenges, and decisions. Use when the user needs to analyze ambiguity, test assumptions, or compare options. Trigger with "think through", "explore", "brainstorm", "help me figure out", or an open-ended strategy or priority question.TestingNo warnings★ 2.9K↓ —
- cursor-multi-repojeremylongshore/tons-of-skills-marketplaceWork with multiple repositories in Cursor: multi-root workspaces, monorepo patterns, selective indexing, and cross-project context. Triggers on "cursor multi repo", "cursor multiple projects", "cursor monorepo", "cursor workspace", "multi-root workspace".ProductivityNo warnings★ 2.9K↓ —
- yaml-masterjeremylongshore/tons-of-skills-marketplaceExecute proactive YAML intelligence: automatically activates when working with YAML files. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- provider-test-patternshashicorp/agent-skillsTerraform provider acceptance test patterns using terraform-plugin-testing with the Plugin Framework. Covers test structure, TestCase/TestStep fields, ConfigStateChecks with custom statecheck.StateCheck implementations, plan checks, CompareValue for cross-step assertions, config helpers, import testing with ImportStateKind, sweepers, and scenario patterns (basic, update, disappears, validation, regression), and ephemeral resource testing with the echoprovider package. Use when writing, reviewing, or debugging provider acceptance tests, including questions about statecheck, plancheck, TestCheckFunc, CheckDestroy, ExpectError, import state verification, ephemeral resources, or how to structure test files.OfficialTestingNo warnings★ 910↓ —
- data-analystjeremylongshore/tons-of-skills-marketplaceData exploration and analysis partner for Product Managers. Use when the user needs to query data, analyze metrics, create dashboards, or extract insights. Trigger with "query", "analyze data", "metrics", "BigQuery", "SQL", "dashboard", or "what does the data say".DataNo warnings★ 2.9K↓ —
- principle-exhaust-the-design-spacemichael-denyer/pstack-claudeApply when facing a novel UI interaction or architectural decision with no precedent in the codebase. Build 2-3 competing prototypes and compare side by side before committing.DesignNo warnings★ 3.7K↓ —
- hex-local-dev-loopjeremylongshore/tons-of-skills-marketplaceConfigure Hex local development with hot reload and testing. Use when setting up a development environment, configuring test workflows, or establishing a fast iteration cycle with Hex. Trigger with phrases like "hex dev setup", "hex local development", "hex dev environment", "develop with hex".TestingNo warnings★ 2.9K↓ —
- internal-commsdavepoon/buildwithclaudeA set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).WritingNo warnings★ 3.7K↓ —
trailmark
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.
Install
npx skills add trailofbits/skills --skill trailmark -a claude-code
Installs to .claude/skills/trailmark/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (5)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/preanalysis-passes.md
- references/query-patterns.md