Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,300 skills from 2,272 repositories · updated 17 minutes ago
46,192 skills
- make-automationdavepoon/buildwithclaudeAutomate Make (Integromat) tasks via Rube MCP (Composio): operations, enums, language and timezone lookups. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- constant-time-testingtrailofbits/skillsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.TestingNo warnings★ 7.9K↓ —
- skill-quality-gateZJU-REAL/Easel发布前质量关卡：合规风险检测（敏感词、绝对化用语、平台规则） + 产物质量审核（完整性、可读性、平台适配度）。一次检查，两道把关。 当用户说"检查合规"、"质量检查"、"能不能发"、"有没有敏感词"、 "审核一下"、"发布前检查"、"质量够不够"时使用。 合并了原 skill-check-compliance 和 skill-review-deliverable 的能力。LegalNo warnings★ 4.1K↓ —
- subject-line-labaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "generate subject line variants", "pre-score my subject lines", or "will this subject get truncated / trigger spam filters"; produces a labeled subject + preheader variant set and a per-variant heuristic pre-score card — spam-trigger flags, length/truncation across desktop + mobile, emoji-count, and the inbox preview render (from-name + subject + preheader) — before any test is run. Not for the body copy or CTA — use email-creative-builder; not for the A/B test design or significance read — use send-experiment-designer; not for the profile-weighted EQS or the S1/S2/N1/D1 vetoes — use email-quality-auditor. 邮件主题行生成/主题行预打分/截断与垃圾词检查TestingNo warnings★ 3K↓ —
- audio-visualizerZJU-REAL/Easel音频可视化视频：把纯音频（播客片段、音乐、口播金句、电台）渲染成带动态波形/频谱的视频，配封面和标题，好发到抖音/B站/视频号等只收视频的平台。当用户说 音频可视化、音频转视频、播客做成视频、音频波形视频、音乐可视化、给音频配画面、声波视频、频谱视频、把音频发到视频平台、电台切片视频 时使用。基于 shared/scripts/audio_viz.py（ffmpeg showwaves/showcqt/showspectrum）。与 audio-mix 区别：那个输出音频，本 SKILL 输出视频；与 slideshow-video 区别：那个用图片，本 SKILL 用音频驱动画面。MediaNo warnings★ 4.1K↓ —
- gsd:exploredavepoon/buildwithclaudeSocratic ideation and idea routing — think through ideas before committing to plansPlanningNo warnings★ 3.7K↓ —
- image-enhanceZJU-REAL/Easel图片增强 / 放大 / 变清晰：高质量放大（Lanczos 2x/4x）+ 去噪 + 锐化 + 自动对比度/饱和度，改善偏糊、偏暗、噪点多的图片。当用户说 图片放大、图片变清晰、提高清晰度、图片增强、去噪点、锐化、图片太糊了、放大到高清、提升画质、优化图片、图片调亮调色 时使用。基于 shared/scripts/img_enhance.py（Pillow+OpenCV）。注意：这是传统增强非 AI 超分，凭空生成细节请用 ai-image-gen 图生图。与 image-editing 区别：那个做缩放/裁切/水印等常规操作，本 SKILL 专做画质提升。MediaNo warnings★ 4.1K↓ —
- figma-implement-designforyourhealth111-pixel/Vibe-SkillsTranslate Figma nodes into production-ready code with 1:1 visual fidelity using the Figma MCP workflow (design context, screenshots, assets, and project-convention translation). Trigger when the user provides Figma URLs or node IDs, or asks to implement designs or components that must match Figma specs. Requires a working Figma MCP server connection.DesignNo warnings★ 3.8K↓ —
- data-storytellingforyourhealth111-pixel/Vibe-SkillsTransform data into compelling narratives using visualization, context, and persuasive structure. Use when presenting analytics to stakeholders, creating data reports, or building executive presentations.DataNo warnings★ 3.8K↓ —
- fuzzing-dictionarytrailofbits/skillsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.PlanningNo warnings★ 7.9K↓ —
- fuzzing-obstaclestrailofbits/skillsPatches past the barriers that stop a fuzzer making progress — checksum and hash verification, magic-value validation, time-based seeds, and other non-deterministic global state. Covers locating the blocking check, neutering it behind a fuzzing build flag, and avoiding the false positives a patch can introduce. Use when a fuzzer is stuck at validation, when coverage shows large regions behind a checksum, or when valid inputs are impractical to generate.OtherNo warnings★ 7.9K↓ —
- resemble-detectdavepoon/buildwithclaudeDeepfake detection and media safety — detect AI-generated audio, images, video, and text, trace synthesis sources, apply watermarks, verify speaker identity, and analyze media intelligence using Resemble AIMediaNo warnings★ 3.7K↓ —
- coverage-analysistrailofbits/skillsMeasures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.MarketingNo warnings★ 7.9K↓ —
- hypothesis-testingforyourhealth111-pixel/Vibe-SkillsProperty-based testing with Hypothesis for discovering edge cases and validating invariants. Use when implementing comprehensive test coverage, testing complex logic with many inputs, or validating mathematical properties and invariants across input domains. Triggered by: hypothesis, property-based testing, @given, strategies, generative testing.TestingNo warnings★ 3.8K↓ —
- observeplugin87/ux-ui-agent-skillsShow whether the agent followed the kit's rules in recent sessions: pages edited and measured, Stop hook blocks, findings left open. Reads local hook events only.WritingNo warnings★ 3K↓ —
- launch-readiness-auditoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "audit our launch plan", "are we ready to launch", or evaluate launch execution/outcomes; runs one typed RAMP preflight, execution, or outcome profile without mixing time horizons. Not for recording launch state — use launch-registry; not for running launch day — use launch-day-conductor. 发布就绪审计/RAMP分阶段评估/发布前放行PlanningNo warnings★ 3K↓ —
- entry-point-analyzertrailofbits/skillsAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.SecurityNo warnings★ 7.9K↓ —
- differential-reviewtrailofbits/skillsPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.EngineeringNo warnings★ 7.9K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 7.9K↓ —
- cargo-fuzztrailofbits/skillsSets up and runs cargo-fuzz, the standard fuzzing tool for Cargo-based Rust projects. Covers cargo fuzz init, the nightly toolchain requirement, fuzz_target! harnesses, Arbitrary-derived structured inputs, sanitizer options, cargo fuzz coverage, and reproducing a crash artifact. Use when fuzzing a Rust crate, writing a fuzz_target!, exercising unsafe blocks or FFI in Rust, or triaging a cargo fuzz crash.WritingNo warnings★ 7.9K↓ —
- mutation-testingtrailofbits/skillsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.TestingNo warnings★ 7.9K↓ —
- replay-regressiontrailofbits/skillsUse when independently verifying a supplied PoC against fresh live before/after deployments.DevOpsNo warnings★ 7.9K↓ —
- testing-handbook-generatortrailofbits/skillsGenerates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.TestingNo warnings★ 7.9K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.9K↓ —
send-experiment-designer
aaron-he-zhu/aaron-marketing-skills
TestingUpdated 5 hours ago
From the author
Use when the user asks to "design an email A/B test", "set up a multivariate subject/CTA test", "run a send-time test", "build a hold-out group", or "is this email result statistically and practically material?"; produces a falsifiable hypothesis, one-variable-per-cell matrix, sample-size/MDE/duration/power plan, and an effect/uncertainty read from own ESP data. Applies only a precommitted owner-approved action rule; the helper never chooses a business action. Not for EQS/vetoes or writing the email. 邮件AB测试设计/多变量测试/发送时间测试/留出组/显著性判定
Install
npx skills add aaron-he-zhu/aaron-marketing-skills --skill send-experiment-designer -a claude-code
Installs to .claude/skills/send-experiment-designer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md