Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,100 skills from 2,196 repositories · updated 8 hours ago
44,137 skills
- sharp-edgestrailofbits/skillsIdentifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.SecurityNo warnings★ 7.8K↓ —
- tao-launch-workflowNVIDIA/skillsThe mandatory pre-launch gate and four-verb execution contract for every TAO workflow or action. Invoke BEFORE launching anything side-effecting — AutoML, train, evaluate, inference, export, TensorRT engine generation, or DEFT/application workflows — on any execution platform. Covers platform selection, credentials, image confirmation, dataset intake, preflight, the launch review, job records, monitoring, and failure/retry classification. Trigger phrases include "train this model", "run AutoML", "launch on SLURM/docker/k8s/brev/virtualenv", "evaluate my checkpoint", "start a TAO job".ProductivityNo warnings★ 3.7K↓ —
- rust-reviewtrailofbits/skillsPerforms comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.EngineeringNo warnings★ 7.8K↓ —
- crisis-response-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build our social crisis protocol", "mentions are exploding — what do we do first", or "when do we pause the posting queue"; produces a 1-5 severity ladder with tunable Estimated trigger thresholds (mention-velocity multiples vs the 7-day listening baseline, sentiment flip, journalist/regulator contact, employee-conduct class), the first-mechanical-action rule — pause ALL scheduled posts AND paid amplification, with dated state markers dropped to the channels proposal protocol and reconciled post-incident — a pre-approved holding-statement library with committed update cadences, when-NOT-to-post rules, a spokesperson/approval matrix, and a post-crisis retro template; re-runs the social-quality-auditor pre-publish gate before un-pausing the queue. Not for email deliverability incidents (blocklist, spam-rate spikes) — use deliverability-qa; inside a launch window launch-day-conductor owns incident handling. 社媒危机预案/暂停队列/声明库/发言人矩阵PlanningNo warnings★ 3K↓ —
- i4h-workflow-createNVIDIA/skillsCreate a minimal blank Workflow scaffold with a Scene containing ground and light plus an idle run mode. Use for fast new Workflow scaffolding.ProductivityNo warnings★ 3.7K↓ —
- fathom-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Fathom API rate limits (60 requests/minute per user). Trigger with phrases like "fathom rate limit", "fathom 429", "fathom throttle".EngineeringNo warnings★ 2.9K↓ —
- groq-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate a minimal working Groq chat completion example. Use when starting a new Groq integration, testing your setup after installing the SDK, or learning the basic Groq API request/response pattern before building something larger. Trigger with phrases like "groq hello world", "groq example", "groq quick start", "simple groq code".TestingNo warnings★ 2.9K↓ —
- modern-cpptrailofbits/skillsGuides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::expected.SecurityNo warnings★ 7.8K↓ —
- genotoxictrailofbits/skillsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.TestingNo warnings★ 7.8K↓ —
- clade-sdk-patternsjeremylongshore/tons-of-skills-marketplaceProduction-ready Anthropic SDK patterns — client config, retries, timeouts, Use when working with sdk-patterns patterns. error handling, TypeScript types, and async patterns. Trigger with "anthropic sdk", "claude client setup", "anthropic typescript", "anthropic python patterns".EngineeringNo warnings★ 2.9K↓ —
- castai-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze CAST AI cost, available-savings, and realized-savings reports into a defensible optimization plan. Use when investigating spend, validating savings claims, applying private-price adjustments, or prioritizing workloads and clusters. Trigger with: "tune CAST AI costs", "verify CAST AI savings", "reduce Kubernetes spend with CAST AI".DevOpsNo warnings★ 2.9K↓ —
- castai-rate-limitsjeremylongshore/tons-of-skills-marketplaceBuild a CAST AI REST client that respects endpoint-specific throttling, bounded retries, and an explicit request budget. Use when a job receives 429 responses, polls CAST AI, or fans out across clusters and organizations. Trigger with: "handle CAST AI rate limits", "stop CAST AI 429s", "make CAST AI polling safe".PlanningNo warnings★ 2.9K↓ —
- skill-competitor-analysisZJU-REAL/Easel分析竞品账号的内容策略，拆解选题、格式、爆款规律和互动模式，输出差异化机会与行动建议。 当用户说"分析竞品""竞品账号""对标账号""拆解爆款""竞品在做什么""对手内容策略""竞争分析"时使用。 和 skill-content-gap-analysis 的区别：本 SKILL 拆解具体竞品账号的内容策略与爆款规律； content-gap-analysis 从赛道整体供需找"没人做好"的蓝海选题空白。OtherNo warnings★ 4.1K↓ —
- skill-cross-platform-diffZJU-REAL/Easel跨平台内容差异深度分析。分析同一话题/内容在不同平台（小红书、抖音、B站、知乎、 微博、公众号、X 等）的呈现差异：内容形式、受众偏好、话语体系、流量逻辑、变现路径。 帮创作者理解"同一个内容在不同平台应该怎么做"。当用户说"小红书和抖音有什么区别"、 "这个话题在B站怎么做"、"跨平台差异"、"不同平台"、"各平台怎么做"、"平台特点"时触发。 和 skill-content-repurposing 的区别：repurposing 做格式适配和内容改写， cross-platform-diff 做深度差异分析和策略洞察。OtherNo warnings★ 4.1K↓ —
- gh-clitrailofbits/skillsEnforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.EngineeringNo warnings★ 7.8K↓ —
- canva-debug-bundlejeremylongshore/tons-of-skills-marketplaceAssemble a minimal Canva Connect diagnostic bundle without credentials, customer content, raw payloads, or full headers. Use when preparing an incident handoff or provider escalation. Trigger with: "Canva debug bundle", "collect Canva evidence", "sanitize Canva diagnostics".EngineeringNo warnings★ 2.9K↓ —
- canva-install-authjeremylongshore/tons-of-skills-marketplaceImplement Canva Connect OAuth 2.0 Authorization Code with SHA-256 PKCE on a backend. Use when creating an integration, adding explicit scopes, handling callback state, or rotating single-use refresh tokens. Trigger with: "set up Canva OAuth", "Canva PKCE", "refresh Canva token".EngineeringNo warnings★ 2.9K↓ —
- attio-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a typed Attio REST client with tenant-aware tokens, endpoint-specific pagination, structured errors, bounded retries, and contract tests while distinguishing it from the Attio App SDK. Use when creating or refactoring Attio integration code. Trigger with "Attio SDK", "Attio client wrapper", or "typed Attio API".TestingNo warnings★ 2.9K↓ —
- c-reviewtrailofbits/skillsPerforms comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.EngineeringNo warnings★ 7.8K↓ —
- clerk-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Clerk SDK/CLI authentication. Use when setting up a new Clerk integration, configuring API keys, or initializing Clerk in your project. Trigger with phrases like "install clerk", "setup clerk", "clerk auth", "configure clerk API key", "add clerk to project".EngineeringNo warnings★ 2.9K↓ —
- clari-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild and validate a typed local Clari REST client with bounded retries, job polling, pagination, and redaction. Use when standardizing application code around public contracts. Trigger with: "build a Clari client", "wrap the Clari API", "type Clari responses".EngineeringNo warnings★ 2.9K↓ —
- apify-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Apify SDK, CLI, and API client authentication. Use when setting up a new Apify project, configuring API tokens, or initializing apify-client / Apify SDK in your codebase. Trigger with "install apify", "setup apify", "apify auth", "configure apify token".EngineeringNo warnings★ 2.9K↓ —
- skill-account-diagnosisZJU-REAL/Easel账号诊断/起号体检：读取已完善的画像 Profile + 近期内容数据，诊断垂直度、定位清晰度、限流降权信号、流量池阶段，给出病因→证据→处方式的起号意见与发布建议。当用户说账号诊断/起号体检/为什么没流量/是不是被限流了/账号定位诊断/起号建议/怎么起号时使用OtherNo warnings★ 4.1K↓ —
- skill-algorithm-updatesZJU-REAL/Easel追踪抖音、小红书、B站、微博、知乎和视频号的算法、推荐分发、审核与变现规则变化，并分析对创作者的影响。 当用户说“算法/推荐机制变了吗、流量规则更新、为什么流量下降、平台规则变化”时使用。 内容热点用 skill-trending-topics；泛行业资讯用 skill-news-intelligence；本 SKILL 只看平台机制。OtherNo warnings★ 4.1K↓ —
agentic-actions-auditor
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
Install
npx skills add trailofbits/skills --skill agentic-actions-auditor -a claude-code
Installs to .claude/skills/agentic-actions-auditor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (15)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/action-profiles.md
- references/cross-file-resolution.md
- references/foundations.md
- references/vector-a-env-var-intermediary.md
- references/vector-b-direct-expression-injection.md
- references/vector-c-cli-data-fetch.md
- references/vector-d-pr-target-checkout.md
- references/vector-e-error-log-injection.md
- references/vector-f-subshell-expansion.md
- +3 more