Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,100 skills from 2,196 repositories · updated 5 hours ago
44,137 skills
- code-maturity-assessortrailofbits/skillsSystematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.EngineeringNo warnings★ 7.8K↓ —
- wycheprooftrailofbits/skillsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.TestingNo warnings★ 7.8K↓ —
- kiro-steering-customgotalab/cc-sddCreate custom steering documents for specialized project contextsPlanningNo warnings★ 3.7K↓ —Also in 6 other repos
- trailmark-variant-neighborhoodtrailofbits/skillsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.SecurityNo warnings★ 7.8K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel subagent dispatch by dependency wave.PlanningNo warnings★ 3.7K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 7.8K↓ —
- cargo-fuzztrailofbits/skillsSets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-derived structured inputs, sanitizer options, cargo fuzz coverage, and reproducing a crash artifact. Use when fuzzing a Rust crate, writing a fuzz_target!, exercising unsafe blocks or FFI in Rust, or triaging a cargo fuzz crash.WritingNo warnings★ 7.8K↓ —
- guidelines-advisortrailofbits/skillsSmart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.TestingNo warnings★ 7.8K↓ —
- lindy-rate-limitsjeremylongshore/tons-of-skills-marketplaceManage Lindy AI credits, rate limits, and usage optimization. Use when hitting rate limits, optimizing credit consumption, or implementing usage controls. Trigger with phrases like "lindy rate limit", "lindy credits", "lindy quota", "lindy throttling", "lindy API limits".EngineeringNo warnings★ 2.9K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.PlanningNo warnings★ 3.7K↓ —
- kiro-spec-statusgotalab/cc-sddShow specification status and progressPlanningNo warnings★ 3.7K↓ —
- trailmark-review-gatetrailofbits/skillsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.EngineeringNo warnings★ 7.8K↓ —
- constant-time-testingtrailofbits/skillsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.TestingNo warnings★ 7.8K↓ —
- kiro-spec-designgotalab/cc-sddCreate comprehensive technical design for a specificationDesignNo warnings★ 3.7K↓ —
- second-opiniontrailofbits/skillsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.EngineeringNo warnings★ 7.8K↓ —
- ruzzytrailofbits/skillsSets up and runs Ruzzy, Trail of Bits' coverage-guided Ruby fuzzer and the only production-ready one for the language. Covers harness structure, fuzzing pure Ruby and the native C extensions in gems, and sanitizer builds. Use when fuzzing a Ruby library or gem, testing a Ruby C extension for memory safety, or asking how to fuzz Ruby at all.TestingNo warnings★ 7.8K↓ —
- kiro-spec-initgotalab/cc-sddInitialize a new specification with detailed project descriptionPlanningNo warnings★ 3.7K↓ —
- wiki-switchAr9av/obsidian-wikiList, create, or switch named Obsidian wiki vault profiles under the global config directory. Use when changing the active vault, checking which vault is active, or managing multi-vault profiles.ProductivityNo warnings★ 3.6K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —
- principle-minimize-reader-loadmichael-denyer/pstack-claudeApply when reviewing or shaping code that's hard to trace. Count layers between question and answer, and hidden state in the reader's head; collapse one-caller wrappers and shrink mutable scope.EngineeringNo warnings★ 3.5K↓ —
- clerk-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate your first authenticated request with Clerk. Use when making initial API calls, testing authentication, or verifying Clerk integration works correctly. Trigger with phrases like "clerk hello world", "first clerk request", "test clerk auth", "verify clerk setup".TestingNo warnings★ 2.9K↓ —
- miro-install-authjeremylongshore/tons-of-skills-marketplaceDesign and implement a production Miro REST authorization flow with least-privilege scopes, tenant-bound storage, token rotation, and an approval-gated installation handoff. Use when installing or repairing Miro authorization. Trigger with "set up Miro OAuth".DesignNo warnings★ 2.9K↓ —
- regression-hunttrailofbits/skillsUse when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.FinanceNo warnings★ 7.8K↓ —
- clade-hello-worldjeremylongshore/tons-of-skills-marketplaceSend your first message to Claude using the Anthropic SDK. Use when starting a new Claude integration, testing your setup, or learning the Messages API basics. Trigger with phrases like "anthropic hello world", "claude api example", "first claude call", "anthropic quick start".TestingNo warnings★ 2.9K↓ —
regression-hunt
trailofbits/skills
FinanceUpdated 3 days ago
From the author
Use when investigating regressions in PRs or commits, coordinating a regression campaign, or resuming saved progress.
Install
npx skills add trailofbits/skills --skill regression-hunt -a claude-code
Installs to .claude/skills/regression-hunt/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (2)
- SKILL.md
- agents/openai.yaml