Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,201 skills from 2,196 repositories · updated 5 minutes ago
44,240 skills
- audit-context-buildingtrailofbits/skillsUnderstand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.ProductivityNo warnings★ 7.8K↓ —
- constant-time-analysistrailofbits/skillsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.SecurityNo warnings★ 7.8K↓ —
- fuzzing-obstaclestrailofbits/skillsPatches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use when a fuzzer is stuck at validation, when coverage shows large regions behind a checksum, or when valid inputs are impractical to generate.OtherNo warnings★ 7.8K↓ —
- i4h-lerobot-vizNVIDIA/skillsServe and visually inspect a converted LeRobot dataset in the browser. Use for videos and state/action timelines; do not use for raw workflow HDF5 or incomplete conversion output.BrowserNo warnings★ 3.7K↓ —
- fuzzing-dictionarytrailofbits/skillsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.PlanningNo warnings★ 7.8K↓ —
- coverage-analysistrailofbits/skillsMeasures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.MarketingNo warnings★ 7.8K↓ —
- address-sanitizertrailofbits/skillsBuilds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.TestingNo warnings★ 7.8K↓ —
- vaexforyourhealth111-pixel/Vibe-SkillsUse this skill for processing and analyzing large tabular datasets (billions of rows) that exceed available RAM. Vaex excels at out-of-core DataFrame operations, lazy evaluation, fast aggregations, efficient visualization of big data, and machine learning on large datasets. Apply when users need to work with large CSV/HDF5/Arrow/Parquet files, perform fast statistics on massive datasets, create visualizations of big data, or build ML pipelines that do not fit in memory.DataNo warnings★ 3.8K↓ —Also in 1 other repo
- semgrep-rule-creatortrailofbits/skillsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.SecurityNo warnings★ 7.8K↓ —
- gsd:cleanupdavepoon/buildwithclaudeArchive accumulated phase directories from completed milestonesOtherNo warnings★ 3.7K↓ —
- ctf-cryptoljagiello/ctf-skillsProvides cryptography attack techniques for CTF challenges. Use when attacking encryption, hashing, signatures, ZKP, PRNG, or mathematical crypto problems involving RSA, AES, ECC, lattices, LWE, CVP, number theory, Coppersmith, Pollard, Wiener, padding oracle, GCM, key derivation, or stream/block cipher weaknesses.FinanceNo warnings★ 3.5K↓ —
- notion-automationdavepoon/buildwithclaudeAutomate Notion tasks via Rube MCP (Composio): pages, databases, blocks, comments, users. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- message-test-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "test our messaging before we scale it", "design a message-market-fit panel", or "run a 5-second comprehension test on our new tagline"; produces a message-test design spec — hypothesis, panel and recruit criteria, comprehension / 5-second / message-market-fit (Wynter-style) protocols, stimulus set drawn from the canon, success thresholds, and a stop/revise decision rule — for the TALE Evaluate phase so the message is validated before any paid scale. It designs the test; it never runs the experiment or adjudicates a claim. Not for running the panel or A/B experiment — use send-experiment-designer or ad-test-designer; not for analyzing the results — use performance-analyzer; not for authoring the message itself — use message-system-architect. 消息测试/理解度测试/面板设计/五秒测试/消息市场契合TestingNo warnings★ 3K↓ —
- harness-writingtrailofbits/skillsDesigns and improves fuzzing harnesses for C/C++ and Rust. Covers mapping raw bytes onto a target API, generating structured inputs, avoiding non-determinism and false crashes, and deciding what to fuzz together. Use when writing a first LLVMFuzzerTestOneInput or fuzz_target! harness, when a campaign finds nothing or reports crashes that will not reproduce, or when the target API needs structured rather than raw input.WritingNo warnings★ 7.8K↓ —
- audit-augmentationtrailofbits/skillsAugments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.EngineeringNo warnings★ 7.8K↓ —
- patching-bugstrailofbits/skillsUse when a known bug or falsifiable bug hypothesis in a local codebase needs a patch commit and reviewable proof report.EngineeringNo warnings★ 7.8K↓ —
- reproduce-bugtrailofbits/skillsUse when a named runtime or compiler bug in a local repository needs independent reproduction.OtherNo warnings★ 7.8K↓ —
- modern-pythontrailofbits/skillsConfigures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.EngineeringNo warnings★ 7.8K↓ —
- message-system-architectaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "author our durable brand message hierarchy", "build the brand message house that seeds the canon", or "define the main narrative, three pillars, and tagline for the whole brand"; produces the DURABLE brand message system — main narrative, three value pillars, per-persona proof points (each labeled Measured / User-provided / '[needs source]'), and the tagline/one-liner — that seeds the narrative-registry canon and from which every per-launch house derives. Not for a single launch's message house or PR-FAQ — use message-house-builder; not for claim adjudication — use offer-claims-registry; not for the change-narrative arc itself — use strategic-narrative-designer. 品牌消息屋/主叙事/三支柱/标语/持久叙事 canonPlanningNo warnings★ 3K↓ —
- report-regressionstrailofbits/skillsUse when assembling or refreshing an evidence-linked regression report from saved campaign decisions.MarketingNo warnings★ 7.8K↓ —
- canvas-designdavepoon/buildwithclaudeCreate beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.DesignNo warnings★ 3.7K↓ —
- validate-bugtrailofbits/skillsUse when a bug PoC package needs an independent rerun and judgment before patching.OtherNo warnings★ 7.8K↓ —
- newsletter-monetization-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "monetize my newsletter", "build a sponsorship rate card", or "model paid-subscription revenue"; produces a revenue model (paid tiers, ad/sponsorship inventory + CPM/flat rate card, referral/boost loops), a list-growth ↔ revenue projection, and honest-offer / disclosure checks for the SEND-D lever. Not for scoring the whole program or running D1 — use email-quality-auditor; not for the return math — use roi-calculator; not for the post-click page — use landing-optimizer. 邮件newsletter变现/赞助刊例/付费订阅测算MarketingNo warnings★ 3K↓ —
- daskforyourhealth111-pixel/Vibe-SkillsParallel/distributed computing. Scale pandas/NumPy beyond memory, parallel DataFrames/Arrays, multi-file processing, task graphs, for larger-than-RAM datasets and parallel workflows.DataNo warnings★ 3.8K↓ —Also in 1 other repo
reproducing-ci-locally
kajisho5/ffmpeg-skill
From the author
Run the CI gate on your machine so it agrees with the runner — deriving the exact command, paths, markers, and env from the workflow file instead of the Makefile, unblocking gate steps that short-circuit and hide the next failure, pinning the linter version CI resolves, building the interpreter/toolchain environment the runner builds, and confirming the run is green instead of explaining a red job away. Use when a check passes locally but fails in CI (or the reverse), when a lint/format job goes red on an untouched file, when setting up a local dev loop for an unfamiliar repo, or before pushing a branch you expect to merge.
Install
npx skills add kajisho5/ffmpeg-skill --skill reproducing-ci-locally -a claude-code
Installs to .claude/skills/reproducing-ci-locally/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Safety checks on SKILL.md
No warnings.
Why 90
Files (1)
- SKILL.md