Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 17 hours ago
48,168 skills
- cleanup-codejeremylongshore/tons-of-skills-marketplaceComprehensive codebase cleanup across 11 quality dimensions: dead code, duplication, weak types, circular deps, defensive cruft, legacy code, AI slop, type consolidation, security, performance, and async patterns. Analyzes code with confidence scoring and verifies changes with build/test gates. Use when codebase has accumulated tech debt, after major feature work, before releases, or when code quality metrics are declining. Trigger with "/cleanup-code-code", "clean up the codebase", "remove dead code", "fix code quality".EngineeringNo warnings★ 2.9K↓ —
- attio-install-authjeremylongshore/tons-of-skills-marketplaceChoose and configure Attio REST authentication for a single workspace or multi-workspace OAuth app, including least-privilege scopes and a read-only verification. Use when connecting a service to Attio. Trigger with "Attio auth", "Attio API key", or "Attio OAuth setup".EngineeringNo warnings★ 2.9K↓ —
- fixdavepoon/buildwithclaudeGet fix intelligence for a vulnerability and propose concrete remediation for the current repositorySecurityNo warnings★ 3.7K↓ —
- navan-hello-worldjeremylongshore/tons-of-skills-marketplaceProve one contracted Navan integration can authenticate and return a bounded read-only response without inventing a universal API. Use when completing access intake. Trigger with "test Navan access", "first Navan read", or "Navan connectivity proof".TestingNo warnings★ 2.9K↓ —
- gsd:add-testsdavepoon/buildwithclaudeGenerate tests for a completed phase based on UAT criteria and implementationTestingNo warnings★ 3.7K↓ —
- terraform-style-guidehashicorp/agent-skillsGenerate Terraform HCL code following HashiCorp's official style conventions and best practices. Use when writing, reviewing, or generating Terraform configurations.OfficialDevOpsNo warnings★ 910↓ —
- message-system-architectaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "author our durable brand message hierarchy", "build the brand message house that seeds the canon", or "define the main narrative, three pillars, and tagline for the whole brand"; produces the DURABLE brand message system — main narrative, three value pillars, per-persona proof points (each labeled Measured / User-provided / '[needs source]'), and the tagline/one-liner — that seeds the narrative-registry canon and from which every per-launch house derives. Not for a single launch's message house or PR-FAQ — use message-house-builder; not for claim adjudication — use offer-claims-registry; not for the change-narrative arc itself — use strategic-narrative-designer. 品牌消息屋/主叙事/三支柱/标语/持久叙事 canonPlanningNo warnings★ 3K↓ —
- gsd:add-phasedavepoon/buildwithclaudeAdd phase to end of current milestone in roadmapPlanningNo warnings★ 3.7K↓ —
- send-experiment-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "design an email A/B test", "set up a multivariate subject/CTA test", "run a send-time test", "build a hold-out group", or "is this email result statistically and practically material?"; produces a falsifiable hypothesis, one-variable-per-cell matrix, sample-size/MDE/duration/power plan, and an effect/uncertainty read from own ESP data. Applies only a precommitted owner-approved action rule; the helper never chooses a business action. Not for EQS/vetoes or writing the email. 邮件AB测试设计/多变量测试/发送时间测试/留出组/显著性判定TestingNo warnings★ 3K↓ —
- platform-norm-profileraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build the norm card for this platform", "what are the char limits and visible-fold cutoffs here", "is the LinkedIn link-in-first-comment thing documented or folklore", or "which of our platform cards are stale"; maintains the dated, versioned per-platform norm cards in the references/platforms/ pack — char limits, visible-fold cutoffs, hashtag norms, format/aspect specs, link and first-comment placement, disclosure-label mechanics, algorithm emphases (e.g. 小红书 search+saves weighting) — every row labeled platform-documented (official doc, Measured) or Estimated-folklore (named source) with last-verified and review-by dates, and any card past its review date flagged stale rather than trusted. Extends the single pack in place; never forks a second one. Not for picking which channels to run — use channel-portfolio-planner. 平台规范卡/字符限制/折叠线/话题标签/算法侧重/过期标记MarketingNo warnings★ 3K↓ —
- research-grantsforyourhealth111-pixel/Vibe-SkillsWrite competitive research proposals for NSF, NIH, DOE, DARPA, and Taiwan NSTC. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and compliance with submission requirements.ScienceNo warnings★ 3.8K↓ —
- story-bank-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a story bank", "collect our origin and customer stories", or "assemble reusable proof stories for the message"; assembles reusable narrative units — origin, founder, customer, transformation, and proof stories — each tagged to a claims-ledger ID and a message-house pillar, with every proof labeled Measured / User-provided / [needs source]. Not for authoring the message house or pillars — use message-system-architect; not for brand voice or naming rules — use brand-language-codifier; not for finished long-form prose — use content-writer; not for adjudicating whether a proof is true — use offer-claims-registry. 品牌故事库/起源客户转化/证据故事单元WritingNo warnings★ 3K↓ —
- deliverability-qaaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "run a deliverability pre-flight before I send", "check my SPF/DKIM/DMARC/BIMI", "why am I landing in spam / promotions", or "score my sender reputation and list hygiene"; runs the ONE-TIME pre-send SEND S1 authentication pre-flight and builds the SEND S (Sender-integrity / Deliverability) evidence read — DNS + DMARC-RUA auth, domain/IP reputation, inbox placement, content/link/render, and point-in-time bounce/complaint hygiene — using Pass/Partial/Fail/Unknown/N/A states and scoring only at complete applicable coverage. Not for the recurring hygiene trend — use list-hygiene-monitor; not for final EQS or veto verdicts — use email-quality-auditor; not for segments/suppression lists — use list-segment-builder. 邮件送达率预检/SPF DKIM DMARC认证/发件域声誉TestingNo warnings★ 3K↓ —
- launch-readiness-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit our launch plan", "are we ready to launch", or evaluate launch execution/outcomes; runs one typed RAMP preflight, execution, or outcome profile without mixing time horizons. Not for recording launch state — use launch-registry; not for running launch day — use launch-day-conductor. 发布就绪审计/RAMP分阶段评估/发布前放行PlanningNo warnings★ 3K↓ —
- tao-train-oneformerNVIDIA/skillsOneFormer for universal image segmentation. Unifies panoptic, instance, and semantic segmentation with a single architecture using task-conditioned queries. Use when training, evaluating, exporting, quantizing, or running inference for a TAO OneFormer model. Trigger phrases include "train OneFormer", "universal segmentation", "task-conditioned segmentation", "panoptic / instance / semantic in one model".MediaNo warnings★ 3.8K↓ —
- gsd:mvp-phasedavepoon/buildwithclaudePlan an MVP-mode phase — captures an "As a / I want to / So that" user story, runs SPIDR splitting, then delegates to plan-phasePlanningNo warnings★ 3.7K↓ —
- seo-pagenowork-studio/notfair-pluginSingle-page SEO audit: content quality under Google's E-E-A-T framework and Helpful Content guidelines, on-page factors, search intent, technical signals and readability. Pulls GSC data for the page, crawls the live HTML, checks metadata, schema, internal linking and depth, and produces a scored report with fixes. Use whenever the user wants to analyze a specific page or URL, not the whole site. Trigger on: "analyze this page", "audit this URL", "how is this page doing", "evaluate my blog post", "check this landing page", "page SEO", "content quality check", "is this page good enough", "review this page's SEO", "what's wrong with this page", "how can I improve this page", "page analysis", "single page audit", "content audit for [URL]", or any request naming a specific URL/page for SEO evaluation. If the user provides a specific URL (not just a domain), this is likely the right skill; use /seo-analysis for full-site audits instead.MarketingNo warnings★ 4.1K↓ —
- gsd:audit-fixdavepoon/buildwithclaudeAutonomous audit-to-fix pipeline — find issues, classify, fix, test, commitTestingNo warnings★ 3.7K↓ —
- serp-analysisaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze the SERP" or "SERP分析"; maps SERP features, layout, ranking factors, search intent, AI Overviews, and snippet opportunities for a query. Not for keyword demand discovery — use keyword-research. SERP分析/搜索结果ScienceNo warnings★ 3K↓ —
- launch-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "monitor my launch", "track our Product Hunt / Hacker News ranking", or "watch the launch window"; runs the T-0 to T+30 window watch — pre-launch instrumentation verification (UTM/event checks, the upstream of RAMP P1), HN rank/points/comments polling with a comments-over-points flamewar early-warning (Estimated heuristic), PH votes/featured status, store charts and reviews, news echo, D0/W1/M1 KPI snapshots vs targets, spike-vs-sustain and owned-capture reads, and alert thresholds against the launch-tier KPI targets. Not for launch-day go/rollback calls — use launch-day-conductor; not for metric deep-dives — use performance-analyzer; not for SEO rank tracking — use rank-tracker. 发布监控/排名轮询/火焰战比/spike-sustainMarketingNo warnings★ 3K↓ —
- attio-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a typed Attio REST client with tenant-aware tokens, endpoint-specific pagination, structured errors, bounded retries, and contract tests while distinguishing it from the Attio App SDK. Use when creating or refactoring Attio integration code. Trigger with "Attio SDK", "Attio client wrapper", or "typed Attio API".TestingNo warnings★ 2.9K↓ —
- tech-debt-auditcode-yeongyu/oh-my-openagentThorough, file-cited technical debt audit across 9 dimensions using AST-grep (tree-sitter), grep, LSP, and language-native tooling. Produces TECH_DEBT_AUDIT.md with severity, effort estimates, and prioritized fixes. Use when asked for codebase health check, tech debt audit, architecture review, code quality assessment, or cleanup planning. Triggers: 'tech debt', 'technical debt', 'debt audit', 'code health', 'technical debt audit', 'codebase health check', 'find tech debt', 'debt analysis', 'audit code quality'.PlanningNo warnings★ 70.5K↓ —
- subject-line-labaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "generate subject line variants", "pre-score my subject lines", or "will this subject get truncated / trigger spam filters"; produces a labeled subject + preheader variant set and a per-variant heuristic pre-score card — spam-trigger flags, length/truncation across desktop + mobile, emoji-count, and the inbox preview render (from-name + subject + preheader) — before any test is run. Not for the body copy or CTA — use email-creative-builder; not for the A/B test design or significance read — use send-experiment-designer; not for the profile-weighted EQS or the S1/S2/N1/D1 vetoes — use email-quality-auditor. 邮件主题行生成/主题行预打分/截断与垃圾词检查TestingNo warnings★ 3K↓ —
- doca-hardware-safetyNVIDIA/skillsUse this skill whenever the agent is about to recommend or apply a change that touches DPU / NIC hardware state on a live system — mlxconfig firmware-parameter write, NIC firmware burn, BFB reflash, NIC ↔ DPU mode flip, SR-IOV or device-emulation slot enable, kernel boot-parameter change (IOMMU, hugepages, VFIO), PCIe rebind / rescan / link-state flip, BlueField cold reboot, or remediation of a BlueField thermal shutdown. Wrap the change in pre-flight inventory, OOB reachability, a maintenance window, replica rehearsal, and rollback. Trigger on implicit phrasing: "flip BlueField mode over SSH", "enable SR-IOV and reboot", "burned firmware but mlxconfig shows old value", "BlueField thermal shutdown". Not for read-only inventory or version queries (doca-version, doca-caps). Refuse orientation (doca-public-knowledge-map), install or env debug (doca-setup), and program-side debug (doca-debug, doca-programming-guide).WritingNo warnings★ 3.8K↓ —
testing-handbook-generator
trailofbits/skills
TestingUpdated 4 days ago
From the author
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.
Install
npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code
Installs to .claude/skills/testing-handbook-generator/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (10)
- SKILL.md
- agent-prompt.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- discovery.md
- templates/domain-skill.md
- templates/fuzzer-skill.md
- templates/technique-skill.md
- templates/tool-skill.md
- testing.md