Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 16 hours ago
48,168 skills
- tiktok-automationdavepoon/buildwithclaudeAutomate TikTok tasks via Rube MCP (Composio): upload/publish videos, post photos, manage content, and view user profiles/stats. Always search tools first for current schemas.MediaNo warnings★ 3.7K↓ —
- paperclippaperclipai/paperclipInteract with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.PlanningNo warnings★ 109.2K↓ —
- miro-hello-worldjeremylongshore/tons-of-skills-marketplaceDesign and implement a bounded, read-only Miro connectivity probe that proves authorization context before writes are enabled. Use when smoke-testing a new Miro integration. Trigger with "test Miro connection".TestingNo warnings★ 2.9K↓ —
- send-experiment-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "design an email A/B test", "set up a multivariate subject/CTA test", "run a send-time test", "build a hold-out group", or "is this email result statistically and practically material?"; produces a falsifiable hypothesis, one-variable-per-cell matrix, sample-size/MDE/duration/power plan, and an effect/uncertainty read from own ESP data. Applies only a precommitted owner-approved action rule; the helper never chooses a business action. Not for EQS/vetoes or writing the email. 邮件AB测试设计/多变量测试/发送时间测试/留出组/显著性判定TestingNo warnings★ 3K↓ —
- server-actionsdavepoon/buildwithclaudeThis skill should be used when the user asks about "Server Actions", "form handling in Next.js", "mutations", "useFormState", "useFormStatus", "revalidatePath", "revalidateTag", or needs guidance on data mutations and form submissions in Next.js App Router.OtherNo warnings★ 3.7K↓ —
- security-guardrailsdavepoon/buildwithclaudeAdversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow bypass, and social engineering attacks.SecurityNo warnings★ 3.7K↓ —
- scikit-survivalforyourhealth111-pixel/Vibe-SkillsComprehensive toolkit for survival analysis and time-to-event modeling in Python using scikit-survival. Use this skill when working with censored survival data, performing time-to-event analysis, fitting Cox models, Random Survival Forests, Gradient Boosting models, or Survival SVMs, evaluating survival predictions with concordance index or Brier score, handling competing risks, or implementing any survival analysis workflow with the scikit-survival library.EngineeringNo warnings★ 3.8K↓ —
- story-bank-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a story bank", "collect our origin and customer stories", or "assemble reusable proof stories for the message"; assembles reusable narrative units — origin, founder, customer, transformation, and proof stories — each tagged to a claims-ledger ID and a message-house pillar, with every proof labeled Measured / User-provided / [needs source]. Not for authoring the message house or pillars — use message-system-architect; not for brand voice or naming rules — use brand-language-codifier; not for finished long-form prose — use content-writer; not for adjudicating whether a proof is true — use offer-claims-registry. 品牌故事库/起源客户转化/证据故事单元WritingNo warnings★ 3K↓ —
- platform-norm-profileraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build the norm card for this platform", "what are the char limits and visible-fold cutoffs here", "is the LinkedIn link-in-first-comment thing documented or folklore", or "which of our platform cards are stale"; maintains the dated, versioned per-platform norm cards in the references/platforms/ pack — char limits, visible-fold cutoffs, hashtag norms, format/aspect specs, link and first-comment placement, disclosure-label mechanics, algorithm emphases (e.g. 小红书 search+saves weighting) — every row labeled platform-documented (official doc, Measured) or Estimated-folklore (named source) with last-verified and review-by dates, and any card past its review date flagged stale rather than trusted. Extends the single pack in place; never forks a second one. Not for picking which channels to run — use channel-portfolio-planner. 平台规范卡/字符限制/折叠线/话题标签/算法侧重/过期标记MarketingNo warnings★ 3K↓ —
- trello-automationdavepoon/buildwithclaudeAutomate Trello boards, cards, and workflows via Rube MCP (Composio). Create cards, manage lists, assign members, and search across boards programmatically.OtherNo warnings★ 3.7K↓ —
- product-feed-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "optimize my Shopping feed", "fix product disapprovals", "improve product titles/attributes", or "build feed-driven PMax asset groups"; audits and rewrites the Shopping/Performance Max product feed — title/description patterns, required and recommended attributes, GTIN/availability/price hygiene, disapproval triage, and feed-driven asset-group / listing-group structure — informing the ROAS O (Offer) dimension. Not for text ad copy — use ad-creative-builder; not for scoring the account or the RQS — use ad-account-auditor. 商品Feed优化/购物广告Feed/商品标题优化/商品禁投修复MarketingNo warnings★ 3K↓ —
- budget-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "allocate my influencer budget", "optimize spend across tiers", or "compare budget scenarios"; produces a tier/platform/content allocation table, ROI and CPM/CPE projections, scenario comparisons, and mid-campaign reallocation moves. Not for building the full campaign plan — use campaign-planner. 达人预算分配/投放预算优化MarketingNo warnings★ 3K↓ —
- social-pulse-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "monitor brand mentions", "set up social listening", "did anything spike about us this week", or "watch these accounts for buying triggers"; runs always-on keyless listening — a versioned listening-query architecture (brand variants incl. misspellings and 中文 names, exclusion terms, per-source syntax for HN Algolia / Bluesky / GDELT / Tavily), a mention sweep with six-class triage (crisis / bug / lead / praise / question / spam) each routed with an SLA, a 7-day rolling baseline with spike flags (the crisis trigger input), a B2B trigger watchlist (funding / hiring / launch signals), and an explicit coverage disclosure where X/IG/TikTok/LinkedIn/小红书 numbers are proxy-labeled, never Measured. Not for launch-window telemetry (T-0→T+30 rank and review polling) — use launch-monitor. 舆情监听/品牌提及监测/基线突刺/触发信号MarketingNo warnings★ 3K↓ —
- short-video-scripteraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "script this short video", "write a TikTok / Reels / Shorts script", "给这条抖音或视频号视频写脚本", or "fix the hook — viewers drop off in the first seconds"; produces timestamped beat-sheet scripts on the retention-gate model (0-2s hook / 2-5s confirmation / 5-15s payoff / loop-or-CTA) with per-scene script lines, on-screen text for muted viewing, asset keywords, and 9:16 format-param rows per platform norm card for TikTok, Reels, Shorts, 抖音, and 视频号 — plus 2-3 hook options from named hook families and an AI-content disclosure line by default on realistic synthetic media. Spec-only: rendering, TTS, and publishing stay with the user's own tools — no pipelines, no upload automation. Not for creator video briefs — use brief-generator; long-form video SEO belongs to content-writer. 短视频脚本/抖音分镜/开头钩子/竖屏9:16MediaNo warnings★ 3K↓ —
- todoist-automationdavepoon/buildwithclaudeAutomate Todoist task management, projects, sections, filtering, and bulk operations via Rube MCP (Composio). Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- reviewing-ffmpeg-skill-changesUpdatedkajisho5/ffmpeg-skillReview a change to the ffmpeg-skill repository for the failures its own contract makes possible — a claim in a result document that is true at one layer and false at the layer a caller reads, a new flag that reaches the code but not the contract/docs/demo surfaces, a "bug" that docs/design-decisions.md already decided with a pinning test, a fix with no regression test, a new runtime dependency or a raw ffmpeg shell call that breaks the scope boundary, a SKILL.md line added without one trimmed, a review that re-derives findings from a summary instead of the tree at the reviewed commit. Use when asked to review a PR or diff in this repository, when authoring code here and needing a pre-commit check, or when triaging an external review or audit report about this codebase.MediaNo warnings★ 4.1K↓ —
- webflow-automationdavepoon/buildwithclaudeAutomate Webflow CMS collections, site publishing, page management, asset uploads, and ecommerce orders via Rube MCP (Composio). Always search tools first for current schemas.OtherNo warnings★ 3.7K↓ —
- miro-data-handlingjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side controls for Miro reads, storage, exports, redaction, retention, and deletion by purpose and data class. Use when processing collaborative board content. Trigger with "miro board data handling".DesignNo warnings★ 2.9K↓ —
- outreach-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "write influencer outreach", "follow up with a creator", "pitch a journalist, hunter, or launch partner", or "negotiate partnership terms"; produces personalized pitches, multi-touch follow-up sequences, negotiation scripts with objection handling, and a status pipeline tracker — the shared outreach mechanics engine for creator, media/analyst, launch-partner, and social-selling / advocate-recruitment targets. Not for finalizing signed agreements — use contract-helper; not for media-list tiering, embargo terms, or press-release structure — use press-media-relations. 达人邀约建联/合作谈判话术LegalNo warnings★ 3K↓ —
- notion-hello-worldjeremylongshore/tons-of-skills-marketplaceProve a Notion connection, API version, and shared-content boundary with a minimal read-only check. Use when onboarding or diagnosing initial access. Trigger with "test Notion connection", "Notion hello world", or "verify Notion token".ProductivityNo warnings★ 2.9K↓ —
- coverage-analysistrailofbits/skillsMeasures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.MarketingNo warnings★ 7.9K↓ —
- competitor-trackeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "track competitor influencer marketing", "see who my rivals partner with", or "benchmark my influencer program"; produces a competitor partnership roster, campaign and content-strategy breakdown, performance estimates, and a gap/opportunity list. Not for finding your own new creators — use influencer-discovery. 竞品达人合作追踪/竞品营销分析MarketingNo warnings★ 3K↓ —
- launch-readiness-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit our launch plan", "are we ready to launch", or evaluate launch execution/outcomes; runs one typed RAMP preflight, execution, or outcome profile without mixing time horizons. Not for recording launch state — use launch-registry; not for running launch day — use launch-day-conductor. 发布就绪审计/RAMP分阶段评估/发布前放行PlanningNo warnings★ 3K↓ —
- navan-install-authjeremylongshore/tons-of-skills-marketplaceEstablish a Navan integration access contract without guessing endpoints, grants, or scopes. Use when onboarding a Booking API, Expense API, SFTP, SCIM, SSO, or direct integration. Trigger with "set up Navan access", "authenticate Navan", or "review Navan credentials".LegalNo warnings★ 2.9K↓ —
gh-cli
trailofbits/skills
EngineeringUpdated 4 days ago
From the author
Enforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.
Install
npx skills add trailofbits/skills --skill gh-cli -a claude-code
Installs to .claude/skills/gh-cli/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg