Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 10 hours ago
48,168 skills
- etf-premiumhimself65/finance-skillsCalculate an ETF's premium or discount to NAV from Yahoo Finance data (yfinance), compare or screen ETFs by premium, explain why a gap exists, and decompose a sudden ETF move into NAV-driven vs structural components (dealer gamma exposure, blocked AP arbitrage, sentiment). Use this skill whenever the user asks whether an ETF trades above or below NAV, compares ETF premiums or discounts, screens for the biggest ones, asks about ETF arbitrage or premium convergence, or wants to know why an ETF jumped or diverged from its holdings — including gamma squeezes, dealer gamma exposure (GEX), and blocked creation/redemption. Especially relevant for leveraged, inverse, international, bond, commodity, and crypto ETFs (IBIT, BITO, HYG, KWEB).FinanceNo warnings★ 3.5K↓ —
- ops-deploydavepoon/buildwithclaudeDeploy status across all projects. Shows ECS service versions, Vercel deployments, recent deploys, pending deploys, and CI/CD pipeline state.DevOpsNo warnings★ 3.7K↓ —
- neon-postgres-egress-optimizerneondatabase/agent-skillsDiagnose and fix excessive Postgres egress (network data transfer) in a codebase. Use when a user mentions high database bills, unexpected data transfer costs, network transfer charges, egress spikes, "why is my Neon bill so high", "database costs jumped", SELECT * optimization, query overfetching, reduce Neon costs, optimize database usage, or wants to reduce data sent from their database to their application. Also use when reviewing query patterns for cost efficiency, even if the user doesn't explicitly mention egress or data transfer.OfficialDataNo warnings★ 108↓ —Also in 1 other repo
- ctf-ai-mlljagiello/ctf-skillsProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.OtherNo warnings★ 3.6K↓ —
- hex-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Hex rate limiting, backoff, and idempotency patterns. Use when handling rate limit errors, implementing retry logic, or optimizing API request throughput for Hex. Trigger with phrases like "hex rate limit", "hex throttling", "hex 429", "hex retry", "hex backoff".EngineeringNo warnings★ 2.9K↓ —
- clari-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild and validate a typed local Clari REST client with bounded retries, job polling, pagination, and redaction. Use when standardizing application code around public contracts. Trigger with: "build a Clari client", "wrap the Clari API", "type Clari responses".EngineeringNo warnings★ 2.9K↓ —
- clari-debug-bundlejeremylongshore/tons-of-skills-marketplaceAnalyze a Clari incident and collect a minimal support bundle with job timelines, contract fingerprints, and secret-safe evidence. Use when escalating a provider or pipeline failure. Trigger with: "collect Clari diagnostics", "build a Clari support bundle", "redact a Clari incident".EngineeringNo warnings★ 2.9K↓ —
- complexa-targetNVIDIA/skillsAdd, edit, inspect, or validate Proteina-Complexa target definitions for protein binders, ligand binders, and AME motif scaffolding. Use for target registries, chain/residue selectors, hotspots, ligand fields, and incomplete motif inputs. Covers direct YAML edits and complexa target/validate target commands; running a campaign with an already registered target belongs to complexa-design.DesignNo warnings★ 3.8K↓ —
- hex-common-errorsjeremylongshore/tons-of-skills-marketplaceDiagnose and fix Hex common errors and exceptions. Use when encountering Hex errors, debugging failed requests, or troubleshooting integration issues. Trigger with phrases like "hex error", "fix hex", "hex not working", "debug hex".EngineeringNo warnings★ 2.9K↓ —
- skill-content-strategyZJU-REAL/Easel制定全面的内容策略方案：内容支柱架构、受众路径规划、90 天节奏原则、分发渠道策略、KPI 体系，输出可执行的策略文档。 当用户说"内容策略""策略方案""内容规划""怎么做内容""内容支柱""增长策略""涨粉策略"时使用。 元策略层，只出框架不出具体排期表（排期用 skill-content-calendar）。ProductivityNo warnings★ 4.2K↓ —
- skill-strategy-advisorZJU-REAL/Easel基于现有内容数据和画像迭代优化内容策略。分析过去一段时间的内容表现、画像信息、 行业趋势，给出下一阶段的内容方向调整、新赛道建议、内容形式优化、发布节奏调整、 画像微调等策略建议。当用户说"下一步怎么做"、"策略建议"、"怎么调整"、"内容方向"、 "下个月策略"、"优化建议"、"迭代方向"时触发。 和 skill-content-strategy 的区别：content-strategy 从零制定策略， strategy-advisor 基于现有数据做迭代优化。OtherNo warnings★ 4.2K↓ —
- code-slice-heroheygen-com/hyperframesA tiled headline surface flips cell by cell under a sweeping depth field to reveal the rear headline. HyperFrames block, 1920×1080, 8s, 18 variables.OfficialEngineeringNo warnings★ 76.3K↓ —
- golang-graphqlsamber/cc-skills-golangImplements GraphQL APIs in Golang using gqlgen or graphql-go. Apply when building GraphQL servers, designing schemas, writing resolvers, handling subscriptions, or integrating GraphQL with existing Go HTTP services. Also apply when the codebase imports `github.com/99designs/gqlgen` or `github.com/graph-gophers/graphql-go`.WritingNo warnings★ 3.7K↓ —
- thought-partnerjeremylongshore/tons-of-skills-marketplaceCollaborative thinking partner for exploring ideas, challenges, and decisions. Use when the user needs to analyze ambiguity, test assumptions, or compare options. Trigger with "think through", "explore", "brainstorm", "help me figure out", or an open-ended strategy or priority question.TestingNo warnings★ 2.9K↓ —
- castai-rate-limitsjeremylongshore/tons-of-skills-marketplaceBuild a CAST AI REST client that respects endpoint-specific throttling, bounded retries, and an explicit request budget. Use when a job receives 429 responses, polls CAST AI, or fans out across clusters and organizations. Trigger with: "handle CAST AI rate limits", "stop CAST AI 429s", "make CAST AI polling safe".PlanningNo warnings★ 2.9K↓ —
- nvshmem-enable-tmaNVIDIA/skillsPrepare or review NVSHMEM CUDA kernels for TMA SMEM registration and direct-SMEM transfers. Do not use for unrelated CUDA tuning.EngineeringNo warnings★ 3.8K↓ —
- skill-brand-onboardingZJU-REAL/Easel创作者/品牌入驻：通过结构化访谈收集视觉风格、内容调性、受众画像和运营目标，生成完整的账号画像档案。 当用户说"账号入驻""建档案""新账号建立画像""品牌入驻""从零建号""完善账号信息""onboarding"时使用。 产出覆盖多维度的完整账号档案；只建声音画像用 skill-voice-builder，只建受众画像用 skill-audience-profiler。OtherNo warnings★ 4.2K↓ —
- castai-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze CAST AI cost, available-savings, and realized-savings reports into a defensible optimization plan. Use when investigating spend, validating savings claims, applying private-price adjustments, or prioritizing workloads and clusters. Trigger with: "tune CAST AI costs", "verify CAST AI savings", "reduce Kubernetes spend with CAST AI".DevOpsNo warnings★ 2.9K↓ —
- i4h-workflowNVIDIA/skillsOrient users to the i4h workflow runtime and route them to the correct stage skill. Use for architecture, support, or where-to-start questions; do not execute a known stage.ProductivityNo warnings★ 3.8K↓ —
- image-to-codeplugin87/ux-ui-agent-skillsTurn a reference image, screenshot, or mockup into token-driven, accessible code. Infer the design system from the reference (palette, type scale, spacing, radius, layout archetype), map it to the 3-tier tokens, rebuild it, then verify with the kit's gates. Use when the user provides a design/screenshot and wants matching UI code.MediaNo warnings★ 3.1K↓ —
- prototypeplugin87/ux-ui-agent-skillsMove an idea up the fidelity ladder (content-first → wireframe → low-fi → high-fi → code) with a validation plan at each level, plus user-journey mapping and usability-testing scripts. Use when the user wants to prototype, wireframe, map a user flow, or plan/run usability testing.TestingNo warnings★ 3.1K↓ —
- principle-explain-the-numberbacknotprop/pstackApply before you measure, and before you trust, report, or act on a number you measured: a speedup, a regression, a throughput, a latency, or an eval result. Find what limits it, and rule out that it measured something other than the work you think.OtherNo warnings★ 3.3K↓ —
- doca-bf3-deploymentNVIDIA/skillsUse this skill for BlueField-3 (BF3) day-1 platform bring-up via the classic RShim/BFB path: pushing a BlueField bundle (BFB) to the DPU over RShim with bfb-install from the host, the host-to-DPU TMFIFO management channel (tmfifo_net0, the 192.168.100.x convention), RShim daemon state and console-over-rshim, DPU mode selection (DPU/embedded-function vs separated-host/NIC mode) via mlxconfig, post-BFB recovery, a six-state BlueField-state classifier, and verifying the install (cat /etc/mlnx-release plus version checks). Trigger even when the user does not say "BF3" — typical phrasings include {push a BFB to my BlueField-3}, {bfb-install exited 0 but the DPU never came back}, {ping 192.168.100.2 works but ssh fails}, or {is DOCA on the host or the Arm side?}. BFB reflash, mlxconfig set, mode changes, and firmware burns are destructive: require explicit target-bound confirmation and load doca-hardware-safety. App launch, container deploy, env install, and the BF4 BMC-Redfish path route elsewhere.DevOpsNo warnings★ 3.8K↓ —
- poteto-helpbacknotprop/pstackGuides users through pstack setup, /poteto-mode, and picking the skill, playbook, or principle for a task. Type /poteto-help with a question.ProductivityNo warnings★ 3.3K↓ —
trailmark
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Builds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.
Install
npx skills add trailofbits/skills --skill trailmark -a claude-code
Installs to .claude/skills/trailmark/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (5)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/preanalysis-passes.md
- references/query-patterns.md