Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 12 hours ago
48,168 skills
- fintel-datahimself65/finance-skillsQuery Fintel (fintel.io) institutional market data through its REST API or official MCP server. Use this skill whenever the user mentions Fintel or asks about short interest, short interest ratio or days to cover, short squeeze data, borrow rate or cost to borrow, shares available to borrow, daily short volume, fails-to-deliver (FTD), 13F institutional owners ("who owns X"), insider buying or selling from SEC Form 3/4/5, analyst price targets, ratings and forecasts, dividend or earnings history and calendars, EOD or last prices, security lookup by ticker, CUSIP, ISIN, or FIGI, Fintel leaderboards, or their Fintel watchlists and alerts. Read-only: GET endpoints only.SecurityNo warnings★ 3.5K↓ —
- adobe-install-authjeremylongshore/tons-of-skills-marketplaceSelect and prove the correct Adobe authentication model, entitlement, product profile, and secret lifecycle before integration work. Use when creating or repairing Adobe credentials. Trigger with "set up Adobe auth", "Adobe OAuth server-to-server", or "Adobe user authentication".OtherNo warnings★ 2.9K↓ —
- adk-agent-builderjeremylongshore/tons-of-skills-marketplaceScaffold production-ready AI agents on Google's Agent Development Kit (ADK): ReAct-style single agents, multi-agent orchestration (Sequential/Parallel/Loop), tool wiring, evaluation, and optional Vertex AI Agent Engine deployment. Use when building, scaffolding, or deploying ADK agents on Google Cloud, or when wiring ADK tools and orchestration patterns. Trigger with "build an ADK agent", "scaffold an agent on ADK", or "deploy to Agent Engine".DevOpsNo warnings★ 2.9K↓ —
- mutation-testingtrailofbits/skillsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.TestingNo warnings★ 7.9K↓ —
- template-skillanthropics/skillsReplace with description of the skill and when Claude should use it.OfficialOtherNo warnings★ 185.7K↓ —Also in 9 other repos
- golang-spf13-cobrasamber/cc-skills-golangGolang CLI command tree library using spf13/cobra — cobra.Command, RunE vs Run, PersistentPreRunE hook chain, Args validators (NoArgs, ExactArgs, MatchAll, custom), persistent vs local flags, command groups, ValidArgsFunction, RegisterFlagCompletionFunc, ShellCompDirective, usage/help template customization, man-page and markdown doc generation, and testing with SetArgs/SetOut/SetErr. Apply when using or adopting spf13/cobra, or when the codebase imports `github.com/spf13/cobra`. For configuration layering alongside cobra, see the `samber/cc-skills-golang@golang-spf13-viper` skill. For general CLI architecture (project layout, exit codes, signal handling, I/O patterns), see `samber/cc-skills-golang@golang-cli`.TestingNo warnings★ 3.7K↓ —
- offensive-bluetooth-classicSnailSploit/Claude-RedBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.MediaNo warnings★ 10K↓ —
- shapforyourhealth111-pixel/Vibe-SkillsModel interpretability and explainability using SHAP (SHapley Additive exPlanations). Use this skill when explaining machine learning model predictions, computing feature importance, generating SHAP plots (waterfall, beeswarm, bar, scatter, force, heatmap), debugging models, analyzing model bias or fairness, comparing models, or implementing explainable AI. Works with tree-based models (XGBoost, LightGBM, Random Forest), deep learning (TensorFlow, PyTorch), linear models, and any black-box model.EngineeringNo warnings★ 3.8K↓ —Also in 1 other repo
- apify-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Apify SDK, CLI, and API client authentication. Use when setting up a new Apify project, configuring API tokens, or initializing apify-client / Apify SDK in your codebase. Trigger with "install apify", "setup apify", "apify auth", "configure apify token".EngineeringNo warnings★ 2.9K↓ —
- principle-subtract-before-you-addbacknotprop/pstackApply when sequencing an addition, refactor, or rewrite. Remove dead code, redundant validators, and stub references first, then build on the simpler base.EngineeringNo warnings★ 3.3K↓ —Also in 1 other repo
- offensive-deauth-disassocSnailSploit/Claude-RedDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.TestingNo warnings★ 10K↓ —
- aeonforyourhealth111-pixel/Vibe-SkillsThis skill should be used for time series machine learning tasks including classification, regression, clustering, forecasting, anomaly detection, segmentation, and similarity search. Use when working with temporal data, sequential patterns, or time-indexed observations requiring specialized algorithms beyond standard ML approaches. Particularly suited for univariate and multivariate time series analysis with scikit-learn compatible APIs.PlanningNo warnings★ 3.8K↓ —Also in 1 other repo
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- writing-docsforyourhealth111-pixel/Vibe-SkillsGuides for writing and editing Remotion documentation. Use when adding docs pages, editing MDX files in packages/docs, or writing documentation content.WritingNo warnings★ 3.8K↓ —
- swarmmichael-denyer/pstack-claudeFan out N parallel workers, drain them, and return one report. Use for /swarm, 'swarm this', or parallel coverage, races, gauntlets, and exploration.OtherNo warnings★ 3.7K↓ —
- golang-samber-oopssamber/cc-skills-golangStructured error handling in Golang with samber/oops — error builders, stack traces, error codes, error context, error wrapping, error attributes, user-facing vs developer messages, panic recovery, and logger integration. Apply when using or adopting samber/oops, or when the codebase already imports github.com/samber/oops.ProductivityNo warnings★ 3.7K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 10K↓ —
- orca-replaydavepoon/buildwithclaudeAnswers questions about a past agent run from its recording rather than from memory, and replays or forks that run. Use when asked why an earlier run did something, or to reproduce a failure.ProductivityNo warnings★ 3.7K↓ —
- ctf-writeupljagiello/ctf-skillsGenerates a single standardized submission-style CTF writeup for competition handoff and organizer review. Use after solving a CTF challenge to document the solution steps, tools used, and lessons learned in a structured format.WritingNo warnings★ 3.6K↓ —
- offensive-wpa2-pskSnailSploit/Claude-RedWPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.MarketingNo warnings★ 10K↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 10K↓ —
- maintain-verification-skillbacknotprop/pstackPeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.3K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 10K↓ —
- nemotron-retrieval-recipesNVIDIA/skillsUse when planning, debugging, tuning, evaluating, exporting, or deploying public Nemotron `embed`/`rerank` retrieval recipes.DevOpsNo warnings★ 3.8K↓ —
stripe-automation
davepoon/buildwithclaude
ProductivityUpdated yesterday
From the author
Automate Stripe tasks via Rube MCP (Composio): customers, charges, subscriptions, invoices, products, refunds. Always search tools first for current schemas.
Install
npx skills add davepoon/buildwithclaude --skill stripe-automation -a claude-code
Installs to .claude/skills/stripe-automation/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md