Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,966 skills from 2,309 repositories · updated 15 hours ago
47,966 skills
- figma-hello-worldjeremylongshore/tons-of-skills-marketplaceMake your first Figma REST API call to fetch a file and inspect its node tree. Use when starting a new Figma integration, testing API connectivity, or learning the Figma document structure. Trigger with phrases like "figma hello world", "figma first call", "figma quick start", "fetch figma file".DesignNo warnings★ 2.9K↓ —
- paperclippaperclipai/paperclipUse for Paperclip-managed tasks and heartbeats: reading task context, delivering task documents or files, updating completion or blockers, coordinating or delegating work, and following company governance. Includes control plane API operations for assignments, comments, approvals, and routines.PlanningNo warnings★ 108.9K↓ —
- hex-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Hex rate limiting, backoff, and idempotency patterns. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Hex. Trigger with phrases like "hex rate limit", "hex throttling", "hex 429", "hex retry", "hex backoff".EngineeringNo warnings★ 2.9K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 9.9K↓ —
- pulumi-debug-failed-operationpulumi/agent-skillsDebug a Pulumi update or preview that failed: read the failure Pulumi already recorded, find what caused it, and fix it. Load this skill when the user asks to debug, diagnose, or fix a failed update or preview, or points at a failing `pulumi up` or `pulumi preview`. Don't load it for authoring new infrastructure, migrations, or provider upgrades; those have their own skills.OfficialEngineeringNo warnings★ 78↓ —
- ultracostdavepoon/buildwithclaudeQuality-first per-stage model routing AND a pre-flight cost gate for Claude Code dynamic workflows. Use when authoring or running ultracode / dynamic-workflow scripts, spawning subagents, or writing agent() stages — pin the right model and effort on every stage, then estimate cost and confirm with the user before launching. Verify scripts with /ultracost:check.WritingNo warnings★ 3.7K↓ —
- gsd:graphifydavepoon/buildwithclaudeBuild, query, and inspect the project knowledge graph in .planning/graphs/PlanningNo warnings★ 3.7K↓ —
- press-media-relationsaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a media list for my launch", "write a launch press release", or "pitch press under embargo"; produces a three-tier media and analyst list (Tier 1 exclusive candidates, Tier 2 vertical press, Tier 3 communities and newsletters), an embargo pitch timing skeleton keyed to the launch-registry date, a press-release draft in standard structure with no fabricated quotes or numbers, and an analyst briefing outline. Not for press-kit assets — use launch-asset-packager; not for follow-up sequence mechanics — use outreach-manager; not for post-launch news-echo monitoring — use launch-monitor. 媒体名单/禁运期pitch/新闻稿/分析师简报WritingNo warnings★ 3K↓ —
- serp-markup-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "optimize meta tags", "write title tags / meta descriptions", "add Open Graph or Twitter cards", or "generate schema / JSON-LD" for FAQ, HowTo, Article, Product, or LocalBusiness rich-result candidates. Produces title/description options, an OG+Twitter block, and validated JSON-LD for the document head. Not for body copy — use content-writer; not for crawl/index technical issues — use technical-seo-checker. 标题优化/元描述/Schema标记/结构化数据BrowserNo warnings★ 3K↓ —
- doca-dtsNewNVIDIA/skillsDeploy and configure the NVIDIA DOCA Telemetry Service (DTS) as it is actually run: (A) BlueField (built-in static pod), (B) Host (docker) on x86_64 / aarch64, or (C) DPF (DPUService / helm chart) — plus the shared configuration layer (`dts_config.ini`, providers, exporters, level labels) that all three share. The user's DEPLOYMENT TYPE decides everything; pick it first. Trigger even without "DTS" for "prometheus on the DPU shows nothing on 9100", "telemetry container exits right after start", "add ethtool counters to the telemetry DPUService", "how do I upgrade the built-in telemetry on BlueField", or "level labels per rack/pod". Refuse and route elsewhere for installing DOCA itself, the `doca_telemetry` / `doca_telemetry_exporter` library API, installing the DPF cluster, Grafana / Prometheus server setup or dashboard / PromQL authoring, and BFB / BSP imaging — those belong to other skills or to external products.DevOpsNo warnings★ 3.8K↓ —
- building-python-mcp-serverskajisho5/ffmpeg-skillBuilds robust Python MCP (Model Context Protocol) servers with FastMCP — tool design, error contracts, event-loop-safe blocking work, subprocess/CLI wrapping, single-file vs packaged distribution, global-state-free testing, and prompt-injection awareness. Use when writing an MCP server, exposing a tool or CLI to an LLM client, debugging tool registration/packaging, or testing MCP tools.EngineeringNo warnings★ 4.1K↓ —
- mode-creatorUpdatedthedotmack/claude-memInteractively create, install, activate, and verify custom claude-mem modes, including domain-specific observation types, concept tags, optional Telegram alerts, bot setup, worker restart, and startup-context verification. Use this whenever someone asks to customize what claude-mem remembers, create or change a mode, track domain-specific notes, add observation types or tags, or send Telegram notifications for particular memories—even if they do not use the word "mode."PlanningNo warnings★ 105.5K↓ —
- launch-window-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "pick a launch date", "plan the launch window", or "set the embargo and lift time"; produces a candidate-window comparison table (conflict / tailwind / risk per window) built from industry-event cycles and the competitor launch calendar, a launch-week vs rolling-release format call, store-review buffer padding (labeled Estimated), and an embargo window definition (lift moment + timezone) submitted to the launch registry as a candidate. Not for judging the cultural moment itself — use trend-spotter; not for launch-day execution — use launch-day-conductor. 发布择时/发布窗口/竞品日历/禁运期窗口/审核缓冲PlanningNo warnings★ 3K↓ —
- vercel-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Vercel costs through plan selection, function efficiency, and usage monitoring. Use when analyzing Vercel billing, reducing function execution costs, or implementing spend management and budget alerts. Trigger with phrases like "vercel cost", "vercel billing", "reduce vercel costs", "vercel pricing", "vercel expensive", "vercel budget".PlanningNo warnings★ 2.9K↓ —
- thought-partnerjeremylongshore/tons-of-skills-marketplaceCollaborative thinking partner for exploring ideas, challenges, and decisions. Use when the user needs to analyze ambiguity, test assumptions, or compare options. Trigger with "think through", "explore", "brainstorm", "help me figure out", or an open-ended strategy or priority question.TestingNo warnings★ 2.9K↓ —
- flyio-install-authjeremylongshore/tons-of-skills-marketplaceInstall or upgrade flyctl and establish least-privilege Fly.io authentication with expiry and rotation evidence. Use when onboarding an operator or automation identity. Trigger with: "install flyctl", "create Fly deploy token", "test Fly API auth".TestingNo warnings★ 2.9K↓ —
- flyio-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a typed local adapter for the Fly.io Machines REST API with scoped auth, state waits, limits, reconciliation, and contract tests. Use when code must manage Machines or volumes. Trigger with: "wrap Machines API", "build Fly API client", "type Fly Machine states".TestingNo warnings★ 2.9K↓ —
- groq-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Groq costs through model routing, token management, and usage monitoring. Use when analyzing Groq billing, reducing API costs, or implementing usage monitoring and budget alerts. Trigger with phrases like "groq cost", "groq billing", "reduce groq costs", "groq pricing", "groq expensive", "groq budget".EngineeringNo warnings★ 2.9K↓ —
- nvshmem-get-startedNVIDIA/skillsUse when NVSHMEM beginners want a tutorial-style overview on assessment, mental models, first C/C++ or Python NVSHMEM programs, compilation, launching, and next steps.EngineeringNo warnings★ 3.8K↓ —
- artifact-creatorjeremylongshore/tons-of-skills-marketplaceCreate or revise Agent Skills, host plugins and subagents, MCP servers and client configurations, hooks, and marketplace catalogs against their actual specifications. Use when building reusable agent capabilities or consolidating creator tooling without inventing a universal host format. Trigger with "create an agent skill", "build a plugin", "create an MCP server", "add a subagent", or "scaffold an agent integration".PlanningNo warnings★ 2.9K↓ —
- sentry-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Sentry costs, reduce event volume, and manage quota spend. Use when analyzing Sentry billing, reducing error/transaction volume, configuring sampling rates, or preventing overage charges. Trigger: "reduce sentry costs", "sentry billing optimization", "sentry quota management", "optimize sentry spend", "sentry sampling".OtherNo warnings★ 2.9K↓ —
- content-amplifieraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "amplify influencer content with paid media", "set up whitelisting or Spark Ads", "decide which posts to boost", "repurpose influencer content", "turn one video into multiple ads", or "build a UGC asset library"; produces (paid mode) a content-selection scorecard, a paid amplification strategy (whitelisting/boosting/dark posts), audience targeting, and a budget+optimization plan, or (repurpose mode) a rights-tracked content inventory, a 1-video-to-10+-asset repurposing map, per-format transformation specs, and a 30-day distribution plan. Not for gating whether a deliverable is publishable or FTC-compliant — use creator-content-auditor; not for the always-on brand posting calendar — use social-calendar-builder; not for drafting a net-new idea into platform-native packages — use social-creative-builder. 复用达人内容 / 内容放量.MediaNo warnings★ 3K↓ —
- i4h-workflow-setupNVIDIA/skillsPreflight and set up the root-level workflow runtime. Use for installation, missing component environments, or third-party failures; do not use for rollout validation.ProductivityNo warnings★ 3.8K↓ —
- speak-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Speak API costs through usage monitoring, tier selection, and efficient audio processing. Use when implementing cost tuning, or managing Speak language learning platform operations. Trigger with phrases like "speak cost tuning", "speak cost tuning".MediaNo warnings★ 2.9K↓ —
offensive-exploit-development
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.
The frontmatter could not be read (no frontmatter); the folder name is shown instead.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-exploit-development -a claude-code
Installs to .claude/skills/offensive-exploit-development/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md