Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,700 skills from 2,243 repositories · updated 9 hours ago
45,648 skills
- exploits-searchdavepoon/buildwithclaudeSearch for exploits across all vulnerabilities with filtering by ecosystem, severity, source, and EPSSSecurityNo warnings★ 3.7K↓ —
- internal-commsdavepoon/buildwithclaudeA set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).WritingNo warnings★ 3.7K↓ —
- doca-pccNVIDIA/skillsUse this skill when the user is doing hands-on host-side DOCA PCC work to load a CUSTOM Programmable Congestion Control algorithm onto a BlueField DPU — creating per-port `doca_pcc` contexts, loading a `dpacc`-compiled `doca_pcc_app` onto the `doca_dev` for the RoCE-bearing port, parameterizing it, walking triple-axis capability discovery (DOCA cap-query + DPA-capable BlueField + firmware custom-PCC slot enabled), or debugging `DOCA_ERROR_*` from `doca_pcc_*`. Trigger even without explicit "DOCA PCC" phrasing — implicit forms include "loading my own congestion control onto a BF port", "DOCA_ERROR_NOT_PERMITTED on algorithm load", "DOCA_ERROR_DRIVER when I attach my custom algorithm", "my custom rate-update isn't affecting RoCE traffic", or "load succeeds but no on-wire change". Refuse and route elsewhere for DPA-side algorithm-body design, the `pcc_counters` CLI, default factory PCC in ConnectX firmware, or setting up the RDMA / RoCE traffic — those belong to other skills.DesignNo warnings★ 3.8K↓ —
- auth-patternsdavepoon/buildwithclaudeThis skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected routes", "session management", "JWT", "login flow", or needs guidance on implementing authentication and authorization in Next.js applications.OtherNo warnings★ 3.7K↓ —
- ci-pipeline-synthesizerkajisho5/ffmpeg-skillGenerate GitHub Actions CI/CD pipeline configurations for automated building and testing of library and package projects. Use when creating or updating CI workflows for npm packages, Python packages, Go modules, Rust crates, or other library projects that need automated build and test pipelines. Includes templates for common package ecosystems with best practices for dependency caching, matrix testing, and artifact publishing.TestingNo warnings★ 3.1K↓ —
- golang-observabilitysamber/cc-skills-golangGolang everyday observability — the always-on signals in production. Covers structured logging with slog, Prometheus metrics, OpenTelemetry distributed tracing, continuous profiling with pprof/Pyroscope, server-side RUM event tracking, alerting, and Grafana dashboards. Apply when instrumenting Go services for production monitoring, setting up metrics or alerting, adding OpenTelemetry tracing, correlating logs with traces, migrating legacy loggers (zap/logrus/zerolog) to slog, adding observability to new features, or implementing GDPR/CCPA-compliant tracking with Customer Data Platforms (CDP). Not for temporary deep-dive performance investigation (→ See `samber/cc-skills-golang@golang-benchmark` and `samber/cc-skills-golang@golang-performance` skills).DevOpsNo warnings★ 3.7K↓ —
- clerk-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Clerk SDK/CLI authentication. Use when setting up a new Clerk integration, configuring API keys, or initializing Clerk in your project. Trigger with phrases like "install clerk", "setup clerk", "clerk auth", "configure clerk API key", "add clerk to project".EngineeringNo warnings★ 2.9K↓ —
- i4h-workflow-setupNVIDIA/skillsPreflight and set up the root-level workflow runtime. Use for installation, missing component environments, or third-party failures; do not use for rollout validation.ProductivityNo warnings★ 3.8K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 9.6K↓ —
- dwarf-experttrailofbits/skillsAnalyzes DWARF debug information in compiled binaries. Use when inspecting .debug_* sections, DIE trees, or DW_TAG_/DW_AT_ entries with dwarfdump/llvm-dwarfdump or readelf, verifying debug info with llvm-dwarfdump --verify, answering DWARF standard questions, or writing code that parses DWARF (libdwarf, pyelftools, gimli).WritingNo warnings★ 7.8K↓ —
- doca-bf3-deploymentNVIDIA/skillsUse this skill for BlueField-3 (BF3) day-1 platform bring-up via the classic RShim/BFB path: pushing a BlueField bundle (BFB) to the DPU over RShim with bfb-install from the host, the host-to-DPU TMFIFO management channel (tmfifo_net0, the 192.168.100.x convention), RShim daemon state and console-over-rshim, DPU mode selection (DPU/embedded-function vs separated-host/NIC mode) via mlxconfig, post-BFB recovery, a six-state BlueField-state classifier, and verifying the install (cat /etc/mlnx-release plus version checks). Trigger even when the user does not say "BF3" — typical phrasings include {push a BFB to my BlueField-3}, {bfb-install exited 0 but the DPU never came back}, {ping 192.168.100.2 works but ssh fails}, or {is DOCA on the host or the Arm side?}. BFB reflash, mlxconfig set, mode changes, and firmware burns are destructive: require explicit target-bound confirmation and load doca-hardware-safety. App launch, container deploy, env install, and the BF4 BMC-Redfish path route elsewhere.DevOpsNo warnings★ 3.8K↓ —
- castai-rate-limitsjeremylongshore/tons-of-skills-marketplaceBuild a CAST AI REST client that respects endpoint-specific throttling, bounded retries, and an explicit request budget. Use when a job receives 429 responses, polls CAST AI, or fans out across clusters and organizations. Trigger with: "handle CAST AI rate limits", "stop CAST AI 429s", "make CAST AI polling safe".PlanningNo warnings★ 2.9K↓ —
- substrate-vulnerability-scannertrailofbits/skillsScans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.SecurityNo warnings★ 7.8K↓ —
- documentation-lookupforyourhealth111-pixel/Vibe-SkillsUse when the user needs current library, framework, or API documentation and version-specific code examples.PlanningNo warnings★ 3.8K↓ —
- token-integration-analyzertrailofbits/skillsToken integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner privileges, performs on-chain scarcity analysis, and evaluates how protocols handle non-standard tokens. Use when integrating or accepting arbitrary ERC20/ERC721 tokens, auditing a token implementation for standards conformity, or assessing risk from weird tokens such as fee-on-transfer, rebasing, missing return values, or blocklists.LegalNo warnings★ 7.8K↓ —
- castai-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze CAST AI cost, available-savings, and realized-savings reports into a defensible optimization plan. Use when investigating spend, validating savings claims, applying private-price adjustments, or prioritizing workloads and clusters. Trigger with: "tune CAST AI costs", "verify CAST AI savings", "reduce Kubernetes spend with CAST AI".DevOpsNo warnings★ 2.9K↓ —
- gsd:list-phase-assumptionsdavepoon/buildwithclaudeSurface Claude's assumptions about a phase approach before planningPlanningNo warnings★ 3.7K↓ —
- skill-ugc-discoveryZJU-REAL/Easel发现用户生成内容（UGC）。搜索与创作者品牌/账号相关的粉丝内容、测评、提及和社区讨论， 输出高价值 UGC 列表与互动建议。当用户说"谁提到了我"、"粉丝内容"、"品牌提及"、 "UGC 发现"、"用户口碑"、"测评搜索"、"社区讨论"时触发。OtherNo warnings★ 4.1K↓ —
- jetson-init-sourceNVIDIA/skillsSet up the BSP source workspace: Linux_for_Tegra overlay tracker, bsp_sources, Crosstool-NG toolchain. Use after jetson-init-image; not for fetching inputs.MediaNo warnings★ 3.8K↓ —
- testing-handbook-generatortrailofbits/skillsGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.TestingNo warnings★ 7.8K↓ —
- serply-web-searchdavepoon/buildwithclaudeSearch Google, Bing, Google News and Google Scholar, and read public pages, through the Serply MCP server. Use when you need current information beyond training data, recent news coverage, or academic papers, with source URLs. Remote server at https://api.serply.io/mcp with an API key from https://serply.io sent in the X-Api-Key header.EngineeringNo warnings★ 3.7K↓ —
- review-workcode-yeongyu/oh-my-openagentPost-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.EngineeringNo warnings★ 70.4K↓ —
- jetson-download-bspNVIDIA/skillsDownload NVIDIA Jetson Linux BSP artifacts (BSP tarball, sample rootfs, public_sources, x-tools, guides) for the active target. Use for Auto Setup; not for extraction or profile edits.WritingNo warnings★ 3.8K↓ —
- ultracostdavepoon/buildwithclaudeQuality-first per-stage model routing AND a pre-flight cost gate for Claude Code dynamic workflows. Use when authoring or running ultracode / dynamic-workflow scripts, spawning subagents, or writing agent() stages — pin the right model and effort on every stage, then estimate cost and confirm with the user before launching. Verify scripts with /ultracost:check.WritingNo warnings★ 3.7K↓ —
cross-repo-request
davepoon/buildwithclaude
DesignUpdated 2 days ago
From the author
Use when work in this repo depends on a change in a different repo that has its own running Claude session (frontend needing a backend endpoint, backend needing a client change, a shared package bump). Covers finding the peer session, what to put in the request so it needs no follow-ups, and how to handle the reply.
Install
npx skills add davepoon/buildwithclaude --skill cross-repo-request -a claude-code
Installs to .claude/skills/cross-repo-request/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md