Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 12 hours ago
48,168 skills
- offensive-data-exfiltrationSnailSploit/Claude-RedDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitationDevOpsNo warnings★ 10K↓ —
- fondo-rate-limitsjeremylongshore/tons-of-skills-marketplaceManage rate limits for Fondo-connected services including Gusto API, QuickBooks API, Plaid, and Stripe when building parallel integrations. Trigger: "fondo rate limit", "gusto API limits", "QuickBooks throttling".EngineeringNo warnings★ 2.9K↓ —
- spenddavepoon/buildwithclaudeShow current Claude Code spend by project and branch via BudgetClawEngineeringNo warnings★ 3.7K↓ —
- seo-analysisnowork-studio/notfair-pluginFull SEO audit combining Google Search Console, URL Inspection API, PageSpeed Insights, a technical crawl, keyword research, and metadata, schema, search intent and Core Web Vitals checks. Surfaces quick wins, diagnoses traffic drops and content gaps, and produces an actionable 30-day plan. Use whenever the user asks about SEO, search rankings, organic traffic, Google Search Console, keyword performance, search visibility, technical SEO, URL indexing, or LCP, INP, CLS or Lighthouse scores. Also trigger on: "why is my traffic down", "what keywords am I ranking for", "improve my rankings", "check my search console", "SEO audit", "analyze my SEO", "technical SEO", "meta tags", "indexing issues", "crawl errors", "content strategy", "keyword cannibalization", "search intent", "schema markup", "structured data", "URL inspection", "page speed", "performance score", "core web vitals", "lighthouse", or any organic search question. If in doubt, trigger.MarketingNo warnings★ 4.1K↓ —
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.TestingNo warnings★ 10K↓ —
- serenity-skillmuxuuu/serenity-skillResearch technology and advanced-manufacturing investments using Serenity-inspired supply-chain bottleneck analysis. Use for theme scans, company thesis challenges, candidate comparisons, or learning this method. Prioritize A-shares unless another market is requested. Return research priorities, dated evidence, profit implications, and conditions that would change the judgment.ScienceNo warnings★ 4.1K↓ —
- cuboid-carouselheygen-com/hyperframesA chain of bevelled cuboids rides a travelling wave as a content carousel. HyperFrames block, 1920×1080, 6.666666666666667s, 40 variables.OfficialOtherNo warnings★ 76.3K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 10K↓ —
- offensive-wpa-enterpriseSnailSploit/Claude-RedWPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.MarketingNo warnings★ 10K↓ —
- offensive-network-attacksSnailSploit/Claude-RedDense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.TestingNo warnings★ 10K↓ —
- context-hunterforyourhealth111-pixel/Vibe-SkillsDiscover codebase patterns, conventions, and unwritten rules before making changes. Use when implementing features, fixing bugs, or refactoring code.ProductivityNo warnings★ 3.8K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10K↓ —
- gh-dashjeremylongshore/tons-of-skills-marketplaceProvides a GitHub pull request dashboard directly in the terminal. Use when the user wants to view PR status, check CI/CD progress, review bot comments, or merge pull requests without leaving Claude Code. Trigger with phrases like "show PR dashboard", "PR status", "check CI progress", "merge this PR", or "review pull request".DevOpsNo warnings★ 2.9K↓ —
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 10K↓ —
- bromichael-denyer/pstack-claudeRestate the last message in plain human language, with no jargon. Use for /bro or when asked to say it plainly.OtherNo warnings★ 3.7K↓ —
- clerk-testingclerk/skillsE2E testing for Clerk apps. Use with Playwright or Cypress for auth flow tests.OfficialTestingNo warnings★ 89↓ —
- discord-automationdavepoon/buildwithclaudeAutomate Discord tasks via Rube MCP (Composio): messages, channels, roles, webhooks, reactions. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- benchmark-checklistbacknotprop/pstackVet a perf measurement (limiter, tuning, limits, errors, repeatability, relevance, and whether the work happened) before you report or act on it. Use when you run a benchmark or report a speedup or regression you measured.OtherNo warnings★ 3.3K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- ai-image-genZJU-REAL/Easel通用 AI 生图：文生图 / 图生图 / 图像变体。当用户说 AI 生图、AI 画图、文生图、图生图、生成图片、生成配图、图像生成、AI 出图、AI 作图、换图、改图、图像编辑、给我画一张、生成一张图 时使用。支持 OpenAI 兼容 API 与 apimart 异步 API，用户自备 API key。MediaNo warnings★ 4.2K↓ —
- ai-video-genZJU-REAL/EaselAI 视频生成：文生视频 / 图生视频 / 数字人首帧驱动。通过可插拔 provider（通义万相 Wan / 火山 Seedance / 快手可灵 / OpenAI 兼容）异步生成视频，用户自备 API key。当用户说 AI 视频生成、文生视频、图生视频、AI 生成视频、AI 短视频、让图片动起来、数字人视频、生成一段视频 时使用。与 video-strategy（选型/策略）、video-editing（剪辑处理）、clipify（切片）区别：本 SKILL 是从 0 用 AI 生成新视频。MediaNo warnings★ 4.2K↓ —
- exa-cost-tuningjeremylongshore/tons-of-skills-marketplaceControl Exa spend through endpoint selection, bounded result and content work, per-key budgets, and response-derived cost evidence. Use when operating or reviewing this Exa boundary. Trigger with "Exa cost tuning", "review Exa cost tuning", or "fix Exa cost tuning".EngineeringNo warnings★ 2.9K↓ —
- auto-subtitleZJU-REAL/Easel自动字幕 / 语音转字幕：把音频或视频里的语音识别成字幕文件（SRT/ASS/TXT/JSON），可选把字幕烧录进视频。当用户说自动字幕、语音转字幕、视频加字幕、上字幕、转录、听写、字幕文件、生成字幕、烧字幕时使用。OtherNo warnings★ 4.2K↓ —
- poteto-helpbacknotprop/pstackGuides users through pstack setup, /poteto-mode, and picking the skill, playbook, or principle for a task. Type /poteto-help with a question.ProductivityNo warnings★ 3.3K↓ —
skill-trend-rider
ZJU-REAL/Easel
OtherUpdated 7 days ago
From the author
给定一个热点事件或话题，结合创作者账号定位，输出蹭热点的具体内容方案。 包含切入角度、内容形式、标题建议、风险提醒。 当用户说"这个热点怎么蹭"、"蹭热点"、"怎么结合"、"热点和我有关吗"、 "追热点"、"热点方案"、"借势"、"怎么追这个热点"、"热点怎么切"时触发。 和 skill-trending-topics 的区别：trending-topics 发现和筛选热点， trend-rider 拿到一个具体热点后规划怎么蹭、怎么切内容。
Install
npx skills add ZJU-REAL/Easel --skill skill-trend-rider -a claude-code
Installs to .claude/skills/skill-trend-rider/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (2)
- EASEL-META.md
- SKILL.md