Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 7 hours ago
48,168 skills
- remotion-to-hyperframesUpdatedheygen-com/hyperframesBring existing video code or footage into HyperFrames and verify it frame by frame against the original - Remotion first, also Motion Canvas, Lottie, Three.js, p5.js, canvas or plain HTML/CSS animation, or renders from Manim, After Effects or Blender. Use to port, convert, migrate or reuse work made with another tool.OfficialDesignNo warnings★ 76.3K↓ —
- cohere-hello-worldjeremylongshore/tons-of-skills-marketplaceRun bounded Cohere v2 Chat, Embed, or Rerank requests with current model discovery and explicit validation. Use when proving a new Cohere setup. Trigger with "Cohere hello world", "Cohere quickstart", or "test Cohere API".TestingNo warnings★ 2.9K↓ —
- dropbox-automationdavepoon/buildwithclaudeAutomate Dropbox file management, sharing, search, uploads, downloads, and folder operations via Rube MCP (Composio). Always search tools first for current schemas.OtherNo warnings★ 3.7K↓ —
- constant-time-testingtrailofbits/skillsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.TestingNo warnings★ 7.9K↓ —
- jetson-video-recipeNVIDIA/skillsUse when turning a Jetson encoder use case into one surface-neutral recipe with native Video Codec SDK and PyNvVideoCodec projections.MediaNo warnings★ 3.8K↓ —
- gsd:audit-uatdavepoon/buildwithclaudeCross-phase audit of all outstanding UAT and verification itemsOtherNo warnings★ 3.7K↓ —
- golang-samber-hotsamber/cc-skills-golangIn-memory caching in Golang using samber/hot — eviction algorithms (LRU, LFU, TinyLFU, W-TinyLFU, S3FIFO, ARC, TwoQueue, SIEVE, FIFO), TTL, cache loaders, sharding, stale-while-revalidate, missing key caching, and Prometheus metrics. Apply when using or adopting samber/hot, when the codebase imports github.com/samber/hot, or when the project repeatedly loads the same medium-to-low cardinality resources at high frequency and needs to reduce latency or backend pressure.ProductivityNo warnings★ 3.7K↓ —
- exploitsdavepoon/buildwithclaudeAnalyze exploit intelligence for a vulnerability against the current repositorySecurityNo warnings★ 3.7K↓ —
- doca-bf4-deploymentNVIDIA/skillsWARNING: guides IRREVERSIBLE BlueField-4 hardware operations (PLDM firmware burns, ISO reflashes, power cycles, BMC factory resets); every mutating step is governed by doca-hardware-safety (window, rollback). BlueField-4 only: BlueField-3 bring-up is doca-bf3-deployment. Use this skill for BlueField-4 (BF4) day-1 platform bring-up from the BMC: installing the BlueField/DOCA bundle ISO onto the DPU (Grace, the Arm complex) over UEFI HTTP Boot, PXE, or Redfish Virtual Media; the PLDM platform-firmware update via the Redfish UpdateService and pldmtool; and a Grace Ubuntu image with optional cloud-init. Trigger on BlueField-4/BF4 bring-up phrasings even without "BF4": {bring up my new BlueField-4}, {the BlueField ISO will not boot over HTTP from the BMC}, {attach BF4 virtual media via Redfish}, {BF4 firmware Task stuck at Running}, {prepare a BlueField-4 host: platform support, version alignment, safest first smoke test}. Route application launch and library APIs to other skills.DevOpsNo warnings★ 3.8K↓ —
- wycheprooftrailofbits/skillsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.TestingNo warnings★ 7.9K↓ —
- ops-doctordavepoon/buildwithclaudeHealth check and auto-repair for the ops plugin. Diagnoses manifest errors, broken permissions, invalid configs, stale caches, and missing files — then spawns an agent to fix everything automatically.OtherNo warnings★ 3.7K↓ —
- golang-code-stylesamber/cc-skills-golangGolang code style conventions — line length and breaking, variable declarations, control flow clarity, when comments help vs hurt. Use when writing or reviewing Go code, asking about style or clarity, or establishing project coding standards. Not for naming conventions (→ See `samber/cc-skills-golang@golang-naming` skill), linter configuration (→ See `samber/cc-skills-golang@golang-lint` skill), or doc comments (→ See `samber/cc-skills-golang@golang-documentation` skill).EngineeringNo warnings★ 3.7K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 10K↓ —
- programmatic-seonowork-studio/notfair-pluginProgrammatic SEO planning and audit: building or evaluating large sets of template-generated pages that target long-tail query patterns (e.g. "[service] in [city]", "[product] vs [product]", "[tool] for [use-case]"). Covers data-source and template design, thin/duplicate-content and doorway-page risks, per-page uniqueness and value thresholds, internal linking and hubs, indexation management (publish vs. noindex), and scaling without a manual action. Use whenever the user wants to generate many pages from a template/dataset, build location/comparison/use-case pages at scale, or asks why generated pages aren't indexing. Trigger on: "programmatic SEO", "pSEO", "generate pages at scale", "templated pages", "location pages at scale", "comparison pages", "[city] pages", "my generated pages aren't indexed", "doorway pages", "scale content". For one-off content use /content-writer; for keyword discovery use /keyword-research.MarketingNo warnings★ 4.1K↓ —
- feature-specdavepoon/buildwithclaudeCreates a complete product feature specification with acceptance criteria, scope, dependencies, and risks. Delegates to the Prometeo (PM) agent.PlanningNo warnings★ 3.7K↓ —
- paid-ads-linkedinnowork-studio/notfair-pluginAudit, diagnose, plan, and safely operate connected LinkedIn Ads accounts through the NotFair MCP, with an export-based fallback. Use for LinkedIn advertising, sponsored content, lead-generation forms, job-title or company targeting, campaign groups, creatives, conversions, lead quality, budgets, bids, or approved LinkedIn campaign changes.MarketingNo warnings★ 4.1K↓ —
- in-your-own-wordsmichael-denyer/pstack-claudeRestate in your own words what you think the user's goals are and what problem they're trying to solve. Use for /in-your-own-words.OtherNo warnings★ 3.7K↓ —
- jira-automationdavepoon/buildwithclaudeAutomate Jira tasks via Rube MCP (Composio): issues, projects, sprints, boards, comments, users. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- doca-mgmtNVIDIA/skillsUse this skill when the user is doing hands-on DOCA Management programming against BlueField / ConnectX devices — standing up a management or representor context (doca_mgmt_dev_ctx / doca_mgmt_dev_rep_ctx), querying device caps (data-direct, caps-general), toggling congestion-control global status, modifying diagnostics-data, setting ICM quotas, or issuing a raw firmware command via doca_mgmt_raw_cmd with the right scope (CONFIGURATION / DEBUG_READ_ONLY / DEBUG_WRITE / DEBUG_WRITE_FULL). Trigger even when the user does not say "DOCA Management" — typical implicit phrasings include "fleet tool that walks every BlueField and reads device state", "toggle data-direct on a VF", "set an ICM quota per representor", "send a raw firmware command from C", "DOCA_ERROR_IO_FAILED from raw_cmd", or "fwctl ioctl is failing". Refuse and route elsewhere for mlxconfig direct operation, BFB / firmware reflash, streaming telemetry, doca_caps CLI snapshots, or DOCA install itself — those belong to other skills.EngineeringNo warnings★ 3.8K↓ —
- ctf-ai-mlljagiello/ctf-skillsProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.OtherNo warnings★ 3.6K↓ —
- skill-publish-checklistZJU-REAL/Easel发布前完整性检查：逐项检查标题、封面、标签、格式、合规标记、链接、CTA 是否齐全， 确保内容没有遗漏就能发布。当用户说"检查一下能不能发"、"发布前检查"、"checklist"、 "查漏补缺"、"发之前看一眼"、"发布清单"、"漏了什么没"、"能发了吗"时触发。 和 skill-quality-gate 的区别：quality-gate 做深度合规审核和质量评分， publish-checklist 只做"有没有漏东西"的快速完整性检查。OtherNo warnings★ 4.2K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.9K↓ —
- skill-profile-builderZJU-REAL/Easel首次使用引导：从社媒链接分析、从零生成账号画像 Profile。收集社媒链接+运营意图，分析已发内容与收藏喜好，生成 6 维 Profile。当用户说 创建画像/第一次用/帮我建个人设/分析我的账号建画像/从链接生成画像 时使用。与 skill-profile-manager 的区别：本 SKILL 专做首次从零分析生成；已有画像的编辑/记忆更新/导出/对比/切换找 profile-manager。OtherNo warnings★ 4.2K↓ —
html-plan
plannotator/effective-html
PlanningUpdated 23 hours ago
From the author
Direct-invocation specialist for clear, self-contained HTML plans that preserve source material while improving hierarchy, sequence, ownership, dependencies, and reviewability. Use when the user explicitly invokes html-plan or the broad html skill routes a plan request here. Do not activate independently from a general request.
Install
npx skills add plannotator/effective-html --skill html-plan -a claude-code
Installs to .claude/skills/html-plan/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (2)
- SKILL.md
- agents/openai.yaml