Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 4 hours ago
48,168 skills
- serenity-skillmuxuuu/serenity-skillResearch technology and advanced-manufacturing investments using Serenity-inspired supply-chain bottleneck analysis. Use for theme scans, company thesis challenges, candidate comparisons, or learning this method. Prioritize A-shares unless another market is requested. Return research priorities, dated evidence, profit implications, and conditions that would change the judgment.ScienceNo warnings★ 4.1K↓ —
- gsd:eval-reviewdavepoon/buildwithclaudeRetroactively audit an executed AI phase's evaluation coverage — scores each eval dimension as COVERED/PARTIAL/MISSING and produces an actionable EVAL-REVIEW.md with remediation planEngineeringNo warnings★ 3.7K↓ —
- skill-content-repurposingZJU-REAL/Easel将一篇内容拆解改编到小红书、抖音、B站、微博等多平台，适配各平台原生格式和风格。 当用户说"一稿多发""改编到各平台""内容复用""多平台适配""这篇改成小红书/抖音""转成其他平台""一鱼多吃"时使用。 和 skill-cross-platform-diff 的区别：diff 做平台差异洞察分析（发现层）；本 SKILL 实际改写内容到各平台。 和 skill-cross-platform-publish 的区别：本 SKILL 只改写适配内容，cross-platform-publish 负责实际一键分发到多平台。OtherNo warnings★ 4.2K↓ —
- pulumi-debug-failed-operationpulumi/agent-skillsDebug a Pulumi update or preview that failed: read the failure Pulumi already recorded, find what caused it, and fix it. Load this skill when the user asks to debug, diagnose, or fix a failed update or preview, or points at a failing `pulumi up` or `pulumi preview`. Don't load it for authoring new infrastructure, migrations, or provider upgrades; those have their own skills.OfficialEngineeringNo warnings★ 78↓ —
- golang-stretchr-testifysamber/cc-skills-golangComprehensive guide to stretchr/testify for Golang testing. Covers assert, require, mock, and suite packages in depth. Use when writing tests with testify, creating mocks, setting up test suites, or choosing between assert and require. Covers testify assertions, mock expectations, argument matchers, call verification, suite lifecycle, and advanced patterns like Eventually, JSONEq, and custom matchers. Apply when the codebase imports github.com/stretchr/testify.TestingNo warnings★ 3.7K↓ —
- offensive-wifi-reconSnailSploit/Claude-RedWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each.LegalNo warnings★ 10K↓ —
- design-componentplugin87/ux-ui-agent-skillsDesign a UI component spec to the house quality bar (anatomy, variants, sizes, the 8 states, token mapping, and accessibility). Use when the user wants to design or document a component (button, input, tabs, toast, combobox, date picker, modal, etc.) at the spec level before or alongside code. For generating framework code, use design-code.DesignNo warnings★ 3.1K↓ —
- text-polisherZJU-REAL/Easel文本润色打磨：七轮聚焦扫描（清晰度/语气/价值感/证据/具体性/情感/风险） + 去 AI 感改写（砍填充短语、打破公式化结构、主动语态、变化节奏）。 当用户说"帮我改一下"、"润色"、"文案打磨"、"编辑文案"、 "去 AI 感"、"太像 AI 了"、"改自然"、"校对"、"文案优化"时使用。 合并了原 copy-editing（系统化编辑）和 stop-slop（去 AI 感）的能力。WritingNo warnings★ 4.2K↓ —
- ops-doctordavepoon/buildwithclaudeHealth check and auto-repair for the ops plugin. Diagnoses manifest errors, broken permissions, invalid configs, stale caches, and missing files — then spawns an agent to fix everything automatically.OtherNo warnings★ 3.7K↓ —
- prompt-improverjeremylongshore/tons-of-skills-marketplaceAnalyze and improve plugin prompts, skill definitions, and command instructions for clarity, safety, and effectiveness. Use when the user asks to "improve a prompt", "review a skill", "enhance instructions", "make this prompt better", "optimize this command", or "audit prompt quality".EngineeringNo warnings★ 2.9K↓ —
- sepia-refactorNanako0129/sepiaUse when a user explicitly requests Sepia refactor for minimal in-place prose revision.EngineeringNo warnings★ 3.6K↓ —
- ops-deploydavepoon/buildwithclaudeDeploy status across all projects. Shows ECS service versions, Vercel deployments, recent deploys, pending deploys, and CI/CD pipeline state.DevOpsNo warnings★ 3.7K↓ —
- image-to-codeplugin87/ux-ui-agent-skillsTurn a reference image, screenshot, or mockup into token-driven, accessible code. Infer the design system from the reference (palette, type scale, spacing, radius, layout archetype), map it to the 3-tier tokens, rebuild it, then verify with the kit's gates. Use when the user provides a design/screenshot and wants matching UI code.MediaNo warnings★ 3.1K↓ —
- complexa-targetNVIDIA/skillsAdd, edit, inspect, or validate Proteina-Complexa target definitions for protein binders, ligand binders, and AME motif scaffolding. Use for target registries, chain/residue selectors, hotspots, ligand fields, and incomplete motif inputs. Covers direct YAML edits and complexa target/validate target commands; running a campaign with an already registered target belongs to complexa-design.DesignNo warnings★ 3.8K↓ —
- brandkitplugin87/ux-ui-agent-skillsGenerate a complete, accessible brand design system from a brief, as primitive → semantic → component DTCG tokens (color, type, spacing, radius, shadow, motion), light + dark, plus a single theme.css, verified for WCAG. Use when the user wants a from-scratch brand/design foundation, a new palette + type system, or a themeable token kit for a product.DesignNo warnings★ 3.1K↓ —
- slack-automationdavepoon/buildwithclaudeAutomate Slack messaging, channel management, search, reactions, and threads via Rube MCP (Composio). Send messages, search conversations, manage channels/users, and react to messages programmatically.EngineeringNo warnings★ 3.7K↓ —
- checkdavepoon/buildwithclaudeRun CIAgent regression checks after changing an AI agent's code, prompts, or knowledge base in a repo that has agentci_spec.yaml, and interpret the results. Use after editing agent logic, before committing agent changes, or when the user asks whether the agent still works.WritingNo warnings★ 3.7K↓ —
- prototypeplugin87/ux-ui-agent-skillsMove an idea up the fidelity ladder (content-first → wireframe → low-fi → high-fi → code) with a validation plan at each level, plus user-journey mapping and usability-testing scripts. Use when the user wants to prototype, wireframe, map a user flow, or plan/run usability testing.TestingNo warnings★ 3.1K↓ —
- data-dashboardplugin87/ux-ui-agent-skillsBuild a dense, data-heavy screen - an analytics console or a trading terminal - with real charts drawn from tokens: candlestick, volume, depth, stacked area, waterfall, scatter, correlation matrix, donut, gauge, sparklines, heatmaps and order books. Use when the request is a dashboard, terminal, monitoring view, data console, or any screen whose job is to show many numbers at once. Covers the layout sequence, the SVG geometry, the accessibility contract per chart type, and the contrast traps that only appear in dark mode.DataNo warnings★ 3.1K↓ —
- gsd:importdavepoon/buildwithclaudeIngest external plans with conflict detection against project decisions before writing anything.WritingNo warnings★ 3.7K↓ —
- skill-quality-gateZJU-REAL/Easel发布前质量关卡：合规风险检测（敏感词、绝对化用语、平台规则） + 产物质量审核（完整性、可读性、平台适配度）。一次检查，两道把关。 当用户说"检查合规"、"质量检查"、"能不能发"、"有没有敏感词"、 "审核一下"、"发布前检查"、"质量够不够"时使用。 合并了原 skill-check-compliance 和 skill-review-deliverable 的能力。LegalNo warnings★ 4.2K↓ —
- doca-uromNVIDIA/skillsHost-side DOCA UROM library (doca_urom_*): offload an HPC / UCX / MPI application's remote memory operations (puts, gets, atomics, collectives) from the host CPU onto a BlueField DPU. Trigger on "MPI all-reduce burning host CPU", "push UCX traffic onto the BlueField", "first doca_urom call returns NOT_PERMITTED", or "host library and DPU service look out of sync", even without naming DOCA UROM. An offload needs both halves: this host library and the UROM Service on the DPU (doca-urom-svc), which owns deploying that container. Covers creating UROM Service contexts (doca_urom_service_*) and Worker contexts (doca_urom_worker_*) that run plugins on the DPU, discovering plugins via doca_urom_service_get_plugins_list, progressing completions, and DOCA_ERROR_* from doca_urom_* calls. Route elsewhere for UROM Service deployment on the DPU side, MPI / UCX collective algorithm design, and RDMA / RoCE / IB substrate bring-up.DevOpsNo warnings★ 3.8K↓ —
- sepia-recreateNanako0129/sepiaUse when a user explicitly requests Sepia recreate for a full rewrite.OtherNo warnings★ 3.6K↓ —
- atheristrailofbits/skillsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.EngineeringNo warnings★ 7.9K↓ —
variant-analysis
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.
Install
npx skills add trailofbits/skills --skill variant-analysis -a claude-code
Installs to .claude/skills/variant-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (18)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/reporting.md
- references/root-cause.md
- references/searching.md
- references/triage.md
- resources/codeql/cpp.ql
- resources/codeql/go.ql
- resources/codeql/java.ql
- resources/codeql/javascript.ql
- resources/codeql/python.ql
- +6 more