Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 11 hours ago
48,168 skills
- offensive-krack-fragattacksSnailSploit/Claude-RedKRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.SecurityNo warnings★ 10K↓ —
- offensive-advanced-redteamSnailSploit/Claude-RedComprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.DevOpsNo warnings★ 10K↓ —
- offensive-wifi-reconSnailSploit/Claude-RedWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each.LegalNo warnings★ 10K↓ —
- nvshmem-enable-tmaNVIDIA/skillsPrepare or review NVSHMEM CUDA kernels for TMA SMEM registration and direct-SMEM transfers. Do not use for unrelated CUDA tuning.EngineeringNo warnings★ 3.8K↓ —
- agentic-actions-auditortrailofbits/skillsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.SecurityNo warnings★ 7.9K↓ —
- doca-bf3-deploymentNVIDIA/skillsUse this skill for BlueField-3 (BF3) day-1 platform bring-up via the classic RShim/BFB path: pushing a BlueField bundle (BFB) to the DPU over RShim with bfb-install from the host, the host-to-DPU TMFIFO management channel (tmfifo_net0, the 192.168.100.x convention), RShim daemon state and console-over-rshim, DPU mode selection (DPU/embedded-function vs separated-host/NIC mode) via mlxconfig, post-BFB recovery, a six-state BlueField-state classifier, and verifying the install (cat /etc/mlnx-release plus version checks). Trigger even when the user does not say "BF3" — typical phrasings include {push a BFB to my BlueField-3}, {bfb-install exited 0 but the DPU never came back}, {ping 192.168.100.2 works but ssh fails}, or {is DOCA on the host or the Arm side?}. BFB reflash, mlxconfig set, mode changes, and firmware burns are destructive: require explicit target-bound confirmation and load doca-hardware-safety. App launch, container deploy, env install, and the BF4 BMC-Redfish path route elsewhere.DevOpsNo warnings★ 3.8K↓ —
- golang-lintsamber/cc-skills-golangLinting best practices and golangci-lint configuration for Golang projects — running linters, configuring .golangci.yml, suppressing warnings with nolint directives, interpreting lint output, and selecting linters. Use when configuring golangci-lint, asking about lint warnings or nolint suppressions, setting up code quality tooling, or choosing linters. Also use when the user mentions golangci-lint, go vet, staticcheck, or revive. Not for wiring a lint step into a GitHub Actions pipeline (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).DevOpsNo warnings★ 3.7K↓ —
- clerk-webhooksclerk/skillsClerk webhooks for real-time events and data syncing. Verify with verifyWebhook from the framework-specific package. Handle user, session, organization, billing, and payment events. Build event-driven features like database sync, notifications, and integrations.OfficialDataNo warnings★ 89↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 97.8K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- benchmark-checklistbacknotprop/pstackVet a perf measurement (limiter, tuning, limits, errors, repeatability, relevance, and whether the work happened) before you report or act on it. Use when you run a benchmark or report a speedup or regression you measured.OtherNo warnings★ 3.3K↓ —
- tao-train-ocrnetNVIDIA/skillsOCRNet for scene text recognition. Recognizes text content from cropped text-region images and supports CTC and attention-based decoders. Use when training, evaluating, exporting, pruning, quantizing, retraining, or running inference for a TAO OCRNet model. Trigger phrases include "train OCRNet", "scene text recognition", "OCR cropped text", "CTC / attention text decoder".OtherNo warnings★ 3.8K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- principle-guard-the-context-windowbacknotprop/pstackApply when context is filling up: large outputs, long files, repeated reads, fan-out planning. Route bulk to subagents; keep summaries in the main thread, not raw payloads.ProductivityNo warnings★ 3.3K↓ —Also in 1 other repo
- jetson-init-sourceNVIDIA/skillsSet up the BSP source workspace: Linux_for_Tegra overlay tracker, bsp_sources, Crosstool-NG toolchain. Use after jetson-init-image; not for fetching inputs.MediaNo warnings★ 3.8K↓ —
- security-researchcode-yeongyu/oh-my-openagentTeam Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.SecurityNo warnings★ 70.5K↓ —
- clerk-orgsclerk/skillsClerk Organizations for B2B and multi-tenant apps - org switching, roles and permissions, verified domains, and enterprise SSO. Use for team workspaces, RBAC, org-scoped routing, member management. Also load this when a project treats teams, workspaces, tenants, or companies as its customers - shared accounts, inviting teammates, per-seat pricing, per-company data isolation - even when the words "organization" or "B2B" are never used.OfficialOtherNo warnings★ 89↓ —
- strategic-clarityjeremylongshore/tons-of-skills-marketplaceAnalyze and audit team context to establish identity, boundaries, and strategic clarity. Use when starting a new role, inheriting ambiguity, or defining ownership. Trigger with "strategic clarity", "team identity", "new role", "inherited ambiguity", "what does my team own", or "define our boundaries".ProductivityNo warnings★ 2.9K↓ —
- brand-language-codifieraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "codify our brand voice", "define naming rules for our products and tiers", or "write the tone-of-voice guide with banned phrases"; produces the brand-level voice canon (register, tone spectrum, banned-phrase list, few-shot examples drawn only from the brand's own published material) and the naming tax (product / feature / tier naming rules plus approved and banned terms) that seeds the narrative-registry canon and that every channel's voice adaptation points up to. Not for per-platform voice adaptation — use channel-registry's voice-dossier; not for finished copy or blog posts — use content-writer; not for the message hierarchy itself — use message-system-architect; not for claim adjudication — use offer-claims-registry. 品牌语气/词汇表/命名税/禁用词/品牌语言规范FinanceNo warnings★ 3K↓ —
- documentation-lookupforyourhealth111-pixel/Vibe-SkillsUse when the user needs current library, framework, or API documentation and version-specific code examples.PlanningNo warnings★ 3.8K↓ —
- paid-ads-xnowork-studio/notfair-pluginAudit, diagnose, and safely operate connected X Ads (Twitter Ads) accounts through the NotFair MCP. Use for X Ads performance, campaign or line-item analysis, spend, conversions, targeting, promoted posts, audiences, budgets, bids, creative, campaign setup, or approved X Ads changes.MarketingNo warnings★ 4.1K↓ —
- narrative-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to record/query the brand narrative canon, tagline, message hierarchy, voice/naming rules, or a canon re-version; curates complete versioned canon events through the append-only narrative stream and derived views. Not for TALE scoring — use narrative-quality-auditor; not for authoring the system — use message-system-architect. 品牌叙事台账/canon 记录/语气与命名规范PlanningNo warnings★ 3K↓ —
- skill-content-gap-analysisZJU-REAL/Easel分析社媒赛道的内容空白，发现高需求低竞争的蓝海选题机会。 当用户说"蓝海选题""内容空白""没人做的选题""选题机会""高需求低竞争""差异化选题""内容缺口"时使用。 和 skill-competitor-analysis 的区别：本 SKILL 从赛道供需交叉验证找蓝海选题空白； competitor-analysis 拆解具体竞品账号的内容策略。OtherNo warnings★ 4.2K↓ —
- cohere-hello-worldjeremylongshore/tons-of-skills-marketplaceRun bounded Cohere v2 Chat, Embed, or Rerank requests with current model discovery and explicit validation. Use when proving a new Cohere setup. Trigger with "Cohere hello world", "Cohere quickstart", or "test Cohere API".TestingNo warnings★ 2.9K↓ —
offsite-signal-analyzer
aaron-he-zhu/aaron-marketing-skills
MarketingUpdated 15 hours ago
From the author
Use when the user asks to "analyze backlinks", "analyze my off-site signals", or "track AI traffic / ChatGPT / Perplexity referrals"; profiles referring domains, anchor-text mix, toxic links, and disavow candidates (backlinks mode) or isolates AI-assistant referral sessions in GA4/GSC/logs and reports their trend, landing pages, and AI-vs-organic conversion (ai-referrals mode). Not for internal links — use site-structure-optimizer; not for keyword positions — use rank-tracker; not for multi-metric stakeholder reports — use performance-monitor. 外链分析/反向链接/AI流量/AI引荐/ChatGPT流量/AI转化
Install
npx skills add aaron-he-zhu/aaron-marketing-skills --skill offsite-signal-analyzer -a claude-code
Installs to .claude/skills/offsite-signal-analyzer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (4)
- SKILL.md
- references/backlinks-analysis-templates.md
- references/link-quality-rubric.md
- references/outreach-templates.md