Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 12 hours ago
48,168 skills
- kiro-spec-designgotalab/cc-sddGenerate comprehensive technical design translating requirements (WHAT) into architecture (HOW) with discovery process. Use when creating architecture from requirements.DesignNo warnings★ 3.7K↓ —
- kiro-spec-requirementsgotalab/cc-sddGenerate comprehensive requirements for a specificationPlanningNo warnings★ 3.7K↓ —
- kiro-spec-requirementsgotalab/cc-sddGenerate comprehensive requirements for a specificationPlanningNo warnings★ 3.7K↓ —Also in 5 other repos
- doca-argpNVIDIA/skillsUse this skill for hands-on DOCA Arg Parser CLI work on a shipped sample or new DOCA-using app — adding / removing / renaming flags; wiring `doca_argp_init` → register params → `doca_argp_start` → `doca_argp_destroy` in order; picking a parameter type from the full public enum (`DOCA_ARGP_TYPE_STRING`, `_INT`, `_BOOLEAN`, `_DEVICE`, `_DEVICE_REP`, `_DOUBLE` — six values, not three); preserving the built-in DOCA flags (`-h` `-v` `-l` `--sdk-log-level` `--log-filter` `-j`/`--json`, NOT `--json-config`); `--device` is per-program; or debugging `DOCA_ERROR_BAD_STATE` / `INVALID_VALUE` / `NOT_SUPPORTED` / `IO_FAILED` from `doca_argp_*`. Trigger on implicit phrasings: "add a custom flag to a DOCA sample", "should I use getopt here", "BAD_STATE registering a new param", "my JSON config key is rejected", or "my sample's --json is ignored". Refuse and route elsewhere for variadic-flag / subcommand / shell-completion features, DOCA Core context, or DOCA Log internals.EngineeringNo warnings★ 3.8K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
- seo-pagenowork-studio/notfair-pluginSingle-page SEO audit: content quality under Google's E-E-A-T framework and Helpful Content guidelines, on-page factors, search intent, technical signals and readability. Pulls GSC data for the page, crawls the live HTML, checks metadata, schema, internal linking and depth, and produces a scored report with fixes. Use whenever the user wants to analyze a specific page or URL, not the whole site. Trigger on: "analyze this page", "audit this URL", "how is this page doing", "evaluate my blog post", "check this landing page", "page SEO", "content quality check", "is this page good enough", "review this page's SEO", "what's wrong with this page", "how can I improve this page", "page analysis", "single page audit", "content audit for [URL]", or any request naming a specific URL/page for SEO evaluation. If the user provides a specific URL (not just a domain), this is likely the right skill; use /seo-analysis for full-site audits instead.MarketingNo warnings★ 4.1K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —Also in 5 other repos
- kiro-implgotalab/cc-sddImplement approved tasks using TDD with subagent dispatch. Runs all pending tasks autonomously or selected tasks manually.TestingNo warnings★ 3.7K↓ —
- nemo-mbridge-resiliencyNVIDIA/skillsResiliency features in Megatron Bridge including fault tolerance, straggler detection, in-process restart, preemption, and re-run state machine.OtherNo warnings★ 3.8K↓ —
- canva-hello-worldjeremylongshore/tons-of-skills-marketplaceVerify a Canva Connect integration with a minimal read-only identity request and a redacted receipt. Use when proving OAuth, endpoint reachability, and response shape before any design or asset mutation. Trigger with: "test Canva connection", "Canva hello world", "verify Canva auth".TestingNo warnings★ 2.9K↓ —
- apify-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Apify API rate limits with proper backoff and request queuing. Use when hitting 429 errors, optimizing API request throughput, or implementing rate-aware client wrappers. Trigger with "apify rate limit", "apify throttling", "apify 429", "apify retry", "apify backoff", "too many requests apify".EngineeringNo warnings★ 2.9K↓ —
- in-your-own-wordsmichael-denyer/pstack-claudeRestate in your own words what you think the user's goals are and what problem they're trying to solve. Use for /in-your-own-words.OtherNo warnings★ 3.7K↓ —
- clade-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Anthropic rate limits — understand tiers, implement backoff, Use when working with rate-limits patterns. optimize throughput, and monitor usage. Trigger with "anthropic rate limit", "claude 429", "anthropic throttling", "anthropic usage limits", "claude tokens per minute".OtherNo warnings★ 2.9K↓ —
- brevo-automationdavepoon/buildwithclaudeAutomate Brevo (Sendinblue) tasks via Rube MCP (Composio): manage email campaigns, create/edit templates, track senders, and monitor campaign performance. Always search tools first for current schemas.MarketingNo warnings★ 3.7K↓ —
- impl-validatorAr9av/obsidian-wikiIndependently check whether an implementation matches its stated goal and return PASS/WARN/FAIL with actionable issues. Use for second-opinion validation of an implementation or generated output.OtherNo warnings★ 3.6K↓ —
- receiving-code-reviewforyourhealth111-pixel/Vibe-SkillsReview-feedback handling route for CodeRabbit, GitHub, PR, or human reviewer comments. Use before implementing suggestions to verify each finding. Do not use for a fresh code review, security audit, TDD, or final completion evidence.EngineeringNo warnings★ 3.8K↓ —
- doca-bf4-deploymentNVIDIA/skillsWARNING: guides IRREVERSIBLE BlueField-4 hardware operations (PLDM firmware burns, ISO reflashes, power cycles, BMC factory resets); every mutating step is governed by doca-hardware-safety (window, rollback). BlueField-4 only: BlueField-3 bring-up is doca-bf3-deployment. Use this skill for BlueField-4 (BF4) day-1 platform bring-up from the BMC: installing the BlueField/DOCA bundle ISO onto the DPU (Grace, the Arm complex) over UEFI HTTP Boot, PXE, or Redfish Virtual Media; the PLDM platform-firmware update via the Redfish UpdateService and pldmtool; and a Grace Ubuntu image with optional cloud-init. Trigger on BlueField-4/BF4 bring-up phrasings even without "BF4": {bring up my new BlueField-4}, {the BlueField ISO will not boot over HTTP from the BMC}, {attach BF4 virtual media via Redfish}, {BF4 firmware Task stuck at Running}, {prepare a BlueField-4 host: platform support, version alignment, safest first smoke test}. Route application launch and library APIs to other skills.DevOpsNo warnings★ 3.8K↓ —
- figma-sdk-patternsjeremylongshore/tons-of-skills-marketplaceProduction-ready patterns for the Figma REST API and Plugin API. Use when building reusable Figma client wrappers, extracting design tokens, traversing node trees, or creating typed API helpers. Trigger with phrases like "figma patterns", "figma best practices", "figma client wrapper", "figma typed API".DesignNo warnings★ 2.9K↓ —
- wiki-narrateAr9av/obsidian-wikiTurn a wiki topic into a cited Markdown briefing, plain-language explanation, or progressive lecture. Use this skill for topic-based briefing, explanation, and lecture requests that must stay within the evidence compiled in an Obsidian vault.ProductivityNo warnings★ 3.6K↓ —
- doca-flow-tuneNVIDIA/skillsUse this skill when the user is tuning a live or captured `doca-flow` pipeline with `doca_flow_tune` — snapshotting pipe / counter / KPI state, picking a tuning axis (rule placement, resource hints / table sizing, HW-offload mode) and a matching measurement (rule-install rate, lookup latency, hardware-counter delta), running offline or online (read-only or state-changing) modes, reading the dumper CSV / analyze JSON / visualize mermaid, or applying a recommendation back into the Flow program. Trigger even when the user does not explicitly mention "doca_flow_tune" — typical implicit phrasings include "Flow rule-install rate is low on BlueField", "table sizing looks wrong for this pipe", "tune visualize step is empty", "before/after counters don't move", or "which doca-flow knob does this recommendation hit". Refuse and route elsewhere for writing the doca-flow application, DOCA install, or streaming Flow telemetry — those belong to other skills.DataNo warnings★ 3.8K↓ —
- tao-train-rtdetrNVIDIA/skillsRT-DETR (Real-Time DEtection TRansformer) for 2D object detection. Designed for real-time inference with competitive accuracy and supports distillation and quantization for deployment optimization. Use when training, evaluating, distilling, quantizing, exporting, or running inference for a TAO RT-DETR model. Trigger phrases include "train RT-DETR", "real-time DETR", "low-latency object detection", "RT-DETR distillation / quantization".DevOpsNo warnings★ 3.8K↓ —
- speckit-specifyforyourhealth111-pixel/Vibe-SkillsCreate or update feature specifications from natural language descriptions. Use when starting new features or refining requirements. Generates spec.md with user stories, functional requirements, and acceptance criteria following spec-driven development methodology.PlanningNo warnings★ 3.8K↓ —
- skill-content-calendarZJU-REAL/Easel生成月度社媒内容排期表：逐条选题+角度+视觉方向，覆盖小红书/抖音/B站/微博。 当用户说"内容排期""月度日历""发布计划""内容日历""排期表""这个月发什么""内容节奏表"时使用。 消费 skill-content-strategy 定义的支柱与 shared 频率基线，只出具体排期不重复定义支柱理论。ProductivityNo warnings★ 4.2K↓ —
- think-harderforyourhealth111-pixel/Vibe-Skills4-phase structured analysis wrapper for vibe pre-routing (compatible with claude-code-settings think-harder semantics).EngineeringNo warnings★ 3.8K↓ —
cosmos-vulnerability-scanner
trailofbits/skills
SecurityUpdated 3 days ago
From the author
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.
Install
npx skills add trailofbits/skills --skill cosmos-vulnerability-scanner -a claude-code
Installs to .claude/skills/cosmos-vulnerability-scanner/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (11)
- CHANGELOG.md
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- resources/ADVANCED_VULNERABILITY_PATTERNS.md
- resources/COSMWASM_VULNERABILITY_PATTERNS.md
- resources/DISCOVERY.md
- resources/EVM_VULNERABILITY_PATTERNS.md
- resources/IBC_VULNERABILITY_PATTERNS.md
- resources/STATE_VULNERABILITY_PATTERNS.md
- resources/VULNERABILITY_PATTERNS.md