Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 3 hours ago
48,168 skills
- property-based-testingtrailofbits/skillsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.TestingNo warnings★ 7.9K↓ —
- writing-lean-proofstrailofbits/skillsWrites and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications in Lean 4, defining new types or definitions in a Lean library, reviewing Lean proofs for readability and maintainability, refactoring long tactic proofs into lemmas, filling in sorry placeholders in a Lean development, setting up CI or linters for a Lean project, diagnosing slow proofs or maxHeartbeats timeouts, or writing custom tactics, macros, or linters.WritingNo warnings★ 7.9K↓ —
- trailmark-variant-neighborhoodtrailofbits/skillsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.SecurityNo warnings★ 7.9K↓ —
- groq-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Groq costs through model routing, token management, and usage monitoring. Use when analyzing Groq billing, reducing API costs, or implementing usage monitoring and budget alerts. Trigger with phrases like "groq cost", "groq billing", "reduce groq costs", "groq pricing", "groq expensive", "groq budget".EngineeringNo warnings★ 2.9K↓ —
- hyperliquid-readerhimself65/finance-skillsRead Hyperliquid (app.hyperliquid.xyz) perp and spot market data through opencli and Hyperliquid's public info API: mark, oracle, and mid prices, 24h change, funding rates (hourly and annualized APR), open interest, volume, the L2 order book, OHLCV candles, funding history, and cross-venue funding comparisons (Hyperliquid vs Binance vs Bybit) for funding arbitrage. Use this skill whenever the user mentions Hyperliquid (HL, HL DEX, hyperliquid.xyz) or asks about its perps, spot pairs such as PURR, funding, open interest, order book, or candles. Read-only market data: no account, order, or transfer operations.EngineeringNo warnings★ 3.5K↓ —
- inbox-placement-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "track where my emails are actually landing after I send", "read my seed-list inbox vs spam vs promotions results", "trend my Gmail Postmaster / Microsoft SNDS reputation", or "did placement drop after my last send"; produces a per-provider inbox/spam/promotions placement read, a domain/IP reputation trend from Postmaster + SNDS, a send-over-send delta with named regressions, and a reusable SEND-S placement snapshot on your own exported telemetry. Not for the pre-send SPF/DKIM/DMARC auth pre-flight — use deliverability-qa; not for computing the EQS or running the vetoes — use email-quality-auditor. 邮件收件箱落点监测/收件箱vs垃圾邮件/Postmaster声誉趋势TestingNo warnings★ 3K↓ —
- entry-point-analyzertrailofbits/skillsAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.SecurityNo warnings★ 7.9K↓ —
- social-contentZJU-REAL/Easel通用多平台社媒内容（单条/兜底）：钩子文案、正文、标签策略和互动引导，主打**涨粉/互动/内容运营**， 支持微博/抖音/B站/知乎/公众号/X 等；平台不确定或要多平台一次成稿时的默认选择。 当用户说"写条微博""发个帖子""社媒文案""发什么内容""帮我写个帖""涨粉内容""互动内容"时使用。 边界：**小红书整套笔记/图文/种草**找 xhs-note-creator；**带货转化/卖点/详情页**找 copywriting； **严格套 PAS/AIDA 框架排版**找 post-formatter。MarketingNo warnings★ 4.2K↓ —
- plugin-auditorjeremylongshore/tons-of-skills-marketplaceAudit automatically audits AI assistant code plugins for security vulnerabilities, best practices, AI assistant.md compliance, and quality standards when user mentions audit plugin, security review, or best practices check. specific to AI assistant-code-plugins repositor... Use when assessing security or running audits. Trigger with phrases like 'security scan', 'audit', or 'vulnerability'.SecurityNo warnings★ 2.9K↓ —
- golang-pkg-go-devsamber/cc-skills-golangGolang package and module lookup via `godig`, a pkg.go.dev API client (CLI + MCP server). Use for any Go/Golang library's documentation, API signatures, symbols, usage examples, which versions exist, licenses, whether a dependency has CVEs, or who imports a package — prefer this over Context7 for any Go package or module. Read-only, no auth. Not for upgrading dependencies (→ See `samber/cc-skills-golang@golang-dependency-management` skill), choosing a library (→ See `samber/cc-skills-golang@golang-popular-libraries` skill), or local symbols and an already-used dependency's resolved source, call sites, and generic instantiations (→ See `samber/cc-skills-golang@golang-gopls` skill).EngineeringNo warnings★ 3.7K↓ —
- principle-minimize-reader-loadmichael-denyer/pstack-claudeApply when reviewing or shaping code that's hard to trace. Count layers between question and answer, and hidden state in the reader's head; collapse one-caller wrappers and shrink mutable scope.EngineeringNo warnings★ 3.7K↓ —
- guidelines-advisortrailofbits/skillsSmart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.TestingNo warnings★ 7.9K↓ —
- changelog-videoheygen-com/hyperframesTurn a weekly changelog .md into a finished branded changelog video (square 1080, ~45-60s, Annie VO, animated brand background, mock-UI visualizations, lowkey captions). Use when the user provides a changelog/digest markdown and wants the weekly video, or says "changelog video". Self-contained — fonts, background, lexicon, and scripts ship in this skill.OfficialMediaNo warnings★ 76.3K↓ —Also in 1 other repo
- tao-train-reidNVIDIA/skillsPerson re-identification (ReID). Learns discriminative embeddings to match the same person across different camera views, based on metric learning. Use when training, evaluating, exporting, or running inference for a TAO person re-identification model. Trigger phrases include "train ReID", "person re-identification", "cross-camera person matching", "ReID embeddings", "person re-id".OtherNo warnings★ 3.8K↓ —
- trend-spotteraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "find trending topics", "what trends should my brand jump on", or "time a campaign around a cultural moment"; produces a ranked trend report with brand-fit scores, format calls (rising/peak/declining), a cultural calendar, and go/skip recommendations. Not for finding the creators to run those trends — use influencer-discovery; not for building the brand posting calendar from a go verdict — use social-calendar-builder. 热点趋势洞察/借势营销MarketingNo warnings★ 3K↓ —
- navan-rate-limitsjeremylongshore/tons-of-skills-marketplaceConfigure Navan integration concurrency and retry controls from the tenant contract and observed responses. Use when controlling throughput or throttling. Trigger with "Navan rate limit", "throttle Navan sync", or "Navan backpressure".LegalNo warnings★ 2.9K↓ —
- tao-train-bevfusionNVIDIA/skillsBEVFusion for multi-sensor 3D object detection. Fuses LiDAR point clouds and camera images in bird's-eye-view (BEV) space, used in autonomous driving for robust 3D perception. Use when training, evaluating, or running inference for a TAO BEVFusion model. Trigger phrases include "train BEVFusion", "LiDAR + camera fusion", "BEV 3D detection", "multi-sensor 3D perception".OtherNo warnings★ 3.8K↓ —
- ib-check-deckanthropics/financial-servicesInvestment banking presentation quality checker. Reviews a pitch deck or client-ready presentation for (1) number consistency across slides, (2) data-narrative alignment, (3) language polish against IB standards, (4) visual and formatting QC. Use whenever the user asks to review, check, QC, proof, or do a final pass on a deck, pitch, or client materials — including requests like "check my numbers", "reconcile figures across slides", "is this client-ready", or "what am I missing before I send this out".OfficialDocumentsNo warnings★ 40.9K↓ —Also in 1 other repo
- press-media-relationsaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a media list for my launch", "write a launch press release", or "pitch press under embargo"; produces a three-tier media and analyst list (Tier 1 exclusive candidates, Tier 2 vertical press, Tier 3 communities and newsletters), an embargo pitch timing skeleton keyed to the launch-registry date, a press-release draft in standard structure with no fabricated quotes or numbers, and an analyst briefing outline. Not for press-kit assets — use launch-asset-packager; not for follow-up sequence mechanics — use outreach-manager; not for post-launch news-echo monitoring — use launch-monitor. 媒体名单/禁运期pitch/新闻稿/分析师简报WritingNo warnings★ 3K↓ —
- throttling-apisjeremylongshore/tons-of-skills-marketplaceImplement API throttling policies to protect backend services from overload. Use when controlling API request rates. Trigger with phrases like "throttle API", "control request rate", or "add throttling".EngineeringNo warnings★ 2.9K↓ —
- reactivation-specialistaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a win-back campaign", "re-engage lapsed subscribers", "run a re-permission / re-consent sweep", or "sunset my dead list"; produces a closed-loop reactivation program — a lapsed-cohort definition, a staged offer ladder, a re-consent (re-permission) capture step, and a sunset-confirm / suppression rule. Owns none of the SEND-N sub-item notes: engagement-decay / sunset is email-sequence-designer's and preference-center / frequency options is preference-frequency-manager's — this skill references those notes, it does not re-emit them. Not for the general lifecycle flows (welcome/cart/post-purchase) — use email-sequence-designer; not for the preference-center / opt-down ladder — use preference-frequency-manager; not for the consent record itself — use consent-registry; not for computing EQS or the N1 veto — use email-quality-auditor. 流失召回/重新授权/沉默用户清理PlanningNo warnings★ 3K↓ —
- hex-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate a minimal working Hex example. Use when starting a new Hex integration, testing your setup, or learning basic Hex API patterns. Trigger with phrases like "hex hello world", "hex example", "hex quick start", "simple hex code".TestingNo warnings★ 2.9K↓ —
- single-cell-rna-qcanthropics/knowledge-work-pluginsPerforms quality control on single-cell RNA-seq data (.h5ad or .h5 files) using scverse best practices with MAD-based filtering and comprehensive visualizations. Use when users request QC analysis, filtering low-quality cells, assessing data quality, or following scverse/scanpy best practices for single-cell analysis.OfficialOtherNo warnings★ 34.1K↓ —
- fix-cimichael-denyer/pstack-claudeFind failing PR checks, inspect logs or external check links, and apply focused fixesOtherNo warnings★ 3.7K↓ —
constant-time-analysis
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
Install
npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
Installs to .claude/skills/constant-time-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (12)
- README.md
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/compiled.md
- references/javascript.md
- references/kotlin.md
- references/php.md
- references/python.md
- references/ruby.md
- references/swift.md
- references/vm-compiled.md