Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 12 hours ago
48,168 skills
- hex-sdk-patternsjeremylongshore/tons-of-skills-marketplaceApply production-ready Hex SDK patterns for TypeScript and Python. Use when implementing Hex integrations, refactoring SDK usage, or establishing team coding standards for Hex. Trigger with phrases like "hex SDK patterns", "hex best practices", "hex code patterns", "idiomatic hex".EngineeringNo warnings★ 2.9K↓ —
- pi-history-ingestAr9av/obsidian-wikiIngest Pi coding-agent session history into Obsidian as distilled knowledge. Use for importing or mining ~/.pi/agent/sessions or Pi conversation logs; use wiki-agent for targeted topic-only recall.EngineeringNo warnings★ 3.6K↓ —
- firebase-ai-logic-basicsfirebase/agent-skillsIntegrates Firebase AI Logic (formerly Vertex AI for Firebase) into mobile and web apps (Android, iOS, Web, and Flutter) to call Gemini models from client code. Use when provisioning or initializing Firebase AI Logic, or adding Gemini features to an app: text generation, multimodal input, chat, streaming, structured output, hybrid on-device inference, App Check protection, or switching models with Remote Config.OfficialEngineeringNo warnings★ 495↓ —
- wycheprooftrailofbits/skillsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.TestingNo warnings★ 7.9K↓ —
- omomomocode-yeongyu/oh-my-openagentEaster egg command - about oh-my-opencode. Triggers: omomomo, about, easter egg.OtherNo warnings★ 70.5K↓ —
- cad-dxf-agentjeremylongshore/tons-of-skills-marketplaceAnalyzes DXF drawings deterministically — ADA/IBC code compliance, drawing health and QA, quantity takeoff, plain-English summaries, RFI generation, and room/zone detection — with no LLM or API key. Use when a user has a .dxf file and wants to check code compliance, audit drawing quality, pull quantities, summarize a drawing, generate RFIs, or detect rooms and areas. Trigger with "analyze this DXF", "check compliance", "drawing health", "quantity takeoff", "summarize this drawing", "generate RFIs", "detect zones", or "/cad-dxf-agent".TestingNo warnings★ 2.9K↓ —
- principle-build-the-leverbacknotprop/pstackApply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks. Build the tool that does it or proves it (codemod, script, generator, or a skill your subagents follow) instead of working by hand. The tool is the artifact a reviewer can rerun.WritingNo warnings★ 3.3K↓ —
- jetson-init-targetNVIDIA/skillsAuthor a new Jetson target-platform profile (reference_devkit + optional custom_carrier) and update the active pointer. Use to create a target; not for switching existing profiles.OtherNo warnings★ 3.8K↓ —
- template-skillanthropics/skillsReplace with description of the skill and when Claude should use it.OfficialOtherNo warnings★ 185.7K↓ —Also in 9 other repos
- offensive-exploit-developmentSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 10K↓ —
- jetson-derive-carrierNVIDIA/skillsBootstrap a custom carrier board by forking carrier files and scaffolding a DT overlay from the reference devkit. Use after jetson-init-source; not for module-level or kernel-DTB changes.OtherNo warnings★ 3.8K↓ —
- shapforyourhealth111-pixel/Vibe-SkillsModel interpretability and explainability using SHAP (SHapley Additive exPlanations). Use this skill when explaining machine learning model predictions, computing feature importance, generating SHAP plots (waterfall, beeswarm, bar, scatter, force, heatmap), debugging models, analyzing model bias or fairness, comparing models, or implementing explainable AI. Works with tree-based models (XGBoost, LightGBM, Random Forest), deep learning (TensorFlow, PyTorch), linear models, and any black-box model.EngineeringNo warnings★ 3.8K↓ —Also in 1 other repo
- offensive-bluetooth-classicSnailSploit/Claude-RedBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.MediaNo warnings★ 10K↓ —
- offensive-deauth-disassocSnailSploit/Claude-RedDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.TestingNo warnings★ 10K↓ —
- aeonforyourhealth111-pixel/Vibe-SkillsThis skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.PlanningNo warnings★ 3.8K↓ —Also in 1 other repo
- second-opiniontrailofbits/skillsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.EngineeringNo warnings★ 7.9K↓ —
- what-did-i-get-donemichael-denyer/pstack-claudeSummarize authored commits over a user-specified time period into a concise updatePlanningNo warnings★ 3.7K↓ —
- writing-plansforyourhealth111-pixel/Vibe-SkillsUse when you have a spec or requirements for a multi-step task, before touching codeWritingNo warnings★ 3.8K↓ —
- data-artistforyourhealth111-pixel/Vibe-SkillsCreate beautiful data visualizations with mathematical elegance, color theory, and narrative design - the "Data is Beautiful" aesthetic.DesignNo warnings★ 3.8K↓ —
- reviewdavepoon/buildwithclaudePower-user audit of Origin's pending surfaces. Most users want `/brief` for revisions. That handles the daily flow. Use `/review` only for explicit deep-walk audits after bulk imports, or when you want to walk the full queue rather than the top 3 shown in /brief. Invoked as `/review captures` or `/review revisions`.EngineeringNo warnings★ 3.7K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 10K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 10K↓ —
- apify-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Apify SDK, CLI, and API client authentication. Use when setting up a new Apify project, configuring API tokens, or initializing apify-client / Apify SDK in your codebase. Trigger with "install apify", "setup apify", "apify auth", "configure apify token".EngineeringNo warnings★ 2.9K↓ —
- offensive-wpsSnailSploit/Claude-RedWPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.SecurityNo warnings★ 10K↓ —
fondo-install-auth
jeremylongshore/tons-of-skills-marketplace
FinanceUpdated 22 hours ago
From the author
Set up Fondo account and configure integrations with Gusto, QuickBooks, and bank accounts for automated startup bookkeeping and R&D tax credits. Trigger: "setup fondo", "fondo account", "fondo integrations", "connect fondo".
Install
npx skills add jeremylongshore/tons-of-skills-marketplace --skill fondo-install-auth -a claude-code
Installs to .claude/skills/fondo-install-auth/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md