Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,100 skills from 2,196 repositories · updated 11 hours ago
44,137 skills
- replay-regressiontrailofbits/skillsUse when independently verifying a supplied PoC against fresh live before/after deployments.DevOpsNo warnings★ 7.8K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.8K↓ —
- pulumi-debug-failed-operationpulumi/agent-skillsDebug a Pulumi update or preview that failed: read the failure Pulumi already recorded, find what caused it, and fix it. Load this skill when the user asks to debug, diagnose, or fix a failed update or preview, or points at a failing `pulumi up` or `pulumi preview`. Don't load it for authoring new infrastructure, migrations, or provider upgrades; those have their own skills.OfficialEngineeringNo warnings★ 78↓ —
- hunt-regressionstrailofbits/skillsUse when discovering possible regressions from a pinned change and its callers before reproduction.OtherNo warnings★ 7.8K↓ —
- provider-upgradepulumi/agent-skillsUpgrade any Pulumi provider to a newer version and reconcile the resulting diff. Use when users want to upgrade or update a provider (including editing package.json, requirements.txt, pyproject.toml, go.mod, or Pulumi.yaml to bump a provider SDK), check for breaking changes before or during an upgrade, fix resources that broke after a provider upgrade, or resolve unexpected replacements, creates, or deletes in a post-upgrade preview, including pulumi-gcp v10 errors such as a missing gcp.notebooks or gcp.iap.Brand type or a required secretDataWoVersion. Applies to all providers (aws, azure-native, gcp, kubernetes, aws-native, cloudflare, datadog, etc.) — not just Tier 1. Do NOT use for querying which stacks use what package versions; use skill `package-usage` for cross-stack audits. Do NOT use for general infrastructure tasks.OfficialDevOpsNo warnings★ 78↓ —
- atheristrailofbits/skillsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.EngineeringNo warnings★ 7.8K↓ —
- trailmark-structuraltrailofbits/skillsRuns full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.ProductivityNo warnings★ 7.8K↓ —
- pulumi-escpulumi/agent-skillsGuidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.OfficialDevOpsNo warnings★ 78↓ —
- pulumi-cdk-to-pulumipulumi/agent-skillsLoad this skill when a user wants to migrate, convert, port, translate, or move an AWS CDK application (including CDK stacks, constructs, or CloudFormation-synthesized templates) to Pulumi. Phrases such as "convert CDK to Pulumi", "migrate CDK app", "port CDK stacks", "replace CDK with Pulumi", "stop using CDK". Do NOT load for general CDK questions, CDK-only help, or CDK vs Pulumi comparisons where no migration is requested.OfficialDevOpsNo warnings★ 78↓ —
- fix-merge-conflictsmichael-denyer/pstack-claudeResolve merge conflicts non-interactively, validate build and tests, and finalize conflict resolutionTestingNo warnings★ 3.5K↓ —
- aflpptrailofbits/skillsSets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.OtherNo warnings★ 7.8K↓ —
- modern-cpptrailofbits/skillsGuides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::expected.SecurityNo warnings★ 7.8K↓ —
- prepare-regressiontrailofbits/skillsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.FinanceNo warnings★ 7.8K↓ —
- trailmarktrailofbits/skillsBuilds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.SecurityNo warnings★ 7.8K↓ —
- genotoxictrailofbits/skillsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.TestingNo warnings★ 7.8K↓ —
- gh-clitrailofbits/skillsEnforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.EngineeringNo warnings★ 7.8K↓ —
- running-e2e-testsjeremylongshore/tons-of-skills-marketplaceExecute end-to-end tests covering full user workflows across frontend and backend. Use when performing specialized testing. Trigger with phrases like "run end-to-end tests", "test user flows", or "execute E2E suite".TestingNo warnings★ 2.9K↓ —
- c-reviewtrailofbits/skillsPerforms comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.EngineeringNo warnings★ 7.8K↓ —
- pulumi-terraform-to-pulumipulumi/agent-skillsMigrate Terraform/OpenTofu projects to Pulumi, including translating HCL source code and/or importing Terraform state into a Pulumi stack. Use when a user wants to convert Terraform to Pulumi, migrate from HCL, or import tfstate into Pulumi. Do NOT trigger for general Terraform-vs-Pulumi comparisons or questions about using both tools side-by-side.OfficialDevOpsNo warnings★ 78↓ —
- package-usagepulumi/agent-skillsTrack which stacks across a Pulumi organization use a specific package and at what versions. Use for cross-stack audits, identifying outdated or unmaintained package versions across many stacks, finding affected stacks before publishing breaking changes to a component package, or planning coordinated upgrade rollouts. Do NOT use for upgrading a cloud provider package (pulumi-aws, pulumi-azure-native, pulumi-gcp, pulumi-kubernetes, etc.) in a single project — use skill `provider-upgrade` instead. Do NOT use for general infrastructure creation, resource provisioning, or how-to questions about a package.OfficialDevOpsNo warnings★ 78↓ —
- anti-ui-slopdavepoon/buildwithclaudeStop coding agents from shipping generic UI. Use UIZZE's 800,000+ real web and iOS screens to build product-specific interfaces, define a design contract, cover required states, and run a hard finish gate. Use for web or iOS UI design, implementation, redesign, critique, and pre-ship review in Codex, Claude Code, Cursor, Copilot, and other coding agents.DesignNo warnings★ 3.7K↓ —
- prisma-client-apiprisma/skillsPrisma Client API reference covering model queries, filters, operators, and client methods. Use when writing database queries, using CRUD operations, filtering data, or configuring Prisma Client. Triggers on "prisma query", "findMany", "create", "update", "delete", "$transaction".OfficialEngineeringNo warnings★ 76↓ —
- gsd:audit-fixdavepoon/buildwithclaudeAutonomous audit-to-fix pipeline — find issues, classify, fix, test, commitTestingNo warnings★ 3.7K↓ —
- tweetclawdavepoon/buildwithclaudeUse TweetClaw as an OpenClaw plugin for X/Twitter automation: search tweets, search tweet replies, post tweets/replies, export followers, look up users, handle media, monitor tweets, deliver webhooks, run giveaway draws, and manage approval-gated visible actions.OtherNo warnings★ 3.7K↓ —
verify-paperclip
paperclipai/paperclip
DevOpsUpdated 18 hours ago
From the author
Verify Paperclip from a source checkout, published npm install, or existing staging or production stack. Select the environment, data state, version, and platform; drive real UI or CLI journeys and capture evidence. Route deployment to the private Cloud skills.
Install
npx skills add paperclipai/paperclip --skill verify-paperclip -a claude-code
Installs to .claude/skills/verify-paperclip/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Runs bundled scriptsUses the networkLicence: MIT
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 90
Security85
Provenance95
Maintenance100
Licence100
Adoption77
Files (9)
- SKILL.md
- references/hosted-qa-accounts.md
- references/npm-install.md
- references/verification-targets.md
- scripts/doctor.py
- scripts/launch.py
- scripts/onboarding-smoke.mjs
- scripts/stop.py
- tests/test_ownership.py