Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,168 skills from 2,325 repositories · updated 18 hours ago
48,168 skills
- offensive-exploit-developmentSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 10K↓ —
- clerk-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Clerk SDK/CLI authentication. Use when setting up a new Clerk integration, configuring API keys, or initializing Clerk in your project. Trigger with phrases like "install clerk", "setup clerk", "clerk auth", "configure clerk API key", "add clerk to project".EngineeringNo warnings★ 2.9K↓ —
- contribute-publishjeremylongshore/tons-of-skills-marketplacePublish one prepared OSS contribution action to GitHub after a fresh human approval boundary. Shows the exact target, content, command, commit, and test evidence before any mutation. Use when local preparation is complete and the user explicitly asks to post a claim, create a Design Issue, comment, push a branch, or open a pull request. Trigger with "/contribute-publish" or "publish this prepared contribution".TestingNo warnings★ 2.9K↓ —
- offensive-bluetooth-classicSnailSploit/Claude-RedBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.MediaNo warnings★ 10K↓ —
- teachmichael-denyer/pstack-claudeExplain a body of work plainly so a person actually understands it. Runs the `how` and `why` skills and weaves what they find into one clear explanation. Use for 'teach me this', 'help me really understand X', 'explain this change or subsystem to me'.OtherNo warnings★ 3.7K↓ —
- offensive-deauth-disassocSnailSploit/Claude-RedDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.TestingNo warnings★ 10K↓ —
- pulumi-automation-apipulumi/agent-skillsLoad this skill when a user asks how to run Pulumi programmatically, embed Pulumi in an application, orchestrate multiple stacks in code, build a self-service infrastructure portal, replace pulumi CLI shell scripts with code, or use the Pulumi Automation API (LocalWorkspace, createOrSelectStack, inline programs). Also load for questions about multi-stack sequencing, parallel deployments, or passing outputs between stacks via code.OfficialEngineeringNo warnings★ 78↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 10K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 10K↓ —
- prisma-postgres-setupprisma/skillsObtain or reuse a Prisma Postgres database and connect an application. Use when the user needs a database and has none configured ("I need a database", "add a Postgres database", "set up a database for this app"), runs or mentions `create-db` or `npx create-db`, or asks to set up or connect Prisma Postgres, including in v0 and the Vercel Marketplace. Hands Prisma ORM configuration to prisma-orm-setup; reuses an existing connection first and honors an explicit provider, driver, alternative ORM, or database-only choice.OfficialDataNo warnings★ 77↓ —
- sentry-load-scalejeremylongshore/tons-of-skills-marketplaceScale Sentry for high-traffic applications handling millions of events per day. Use when optimizing SDK performance at high volume, implementing adaptive sampling, managing quotas and costs at scale, or deploying Sentry across multi-region infrastructure. Trigger with phrases like "sentry high traffic", "scale sentry", "sentry millions events", "sentry high volume", "sentry quota management", "sentry load test".TestingNo warnings★ 2.9K↓ —
- speckit-specifyforyourhealth111-pixel/Vibe-SkillsCreate or update feature specifications from natural language descriptions. Use when starting new features or refining requirements. Generates spec.md with user stories, functional requirements, and acceptance criteria following spec-driven development methodology.PlanningNo warnings★ 3.8K↓ —
- pulumi-overviewpulumi/agent-skillsUse this skill for any task that creates, modifies, inspects, or destroys cloud infrastructure or SaaS configuration, from one-off CLI operations to full multi-resource projects, across providers in the Pulumi ecosystem. A typical project spans many providers (AWS or Azure or GCP, Kubernetes, Cloudflare, Auth0, Datadog, Vercel, and others), and Pulumi drives them through one CLI, one state model, and one credential layer. Trigger even when the user does not name Pulumi; phrasings like "deploy this app," "provision a database," "stand up a VPC," "configure Auth0," "set up Datadog monitoring," or "tear down staging" qualify. Also trigger for tasks that migrate, port, or convert existing infrastructure code (Terraform, CloudFormation, CDK, Bicep, ARM) to Pulumi. Do not trigger for application runtime code that reads or writes data via cloud SDKs; that is application code, not infrastructure.OfficialDevOpsNo warnings★ 78↓ —
- provider-upgradepulumi/agent-skillsUpgrade any Pulumi provider to a newer version and reconcile the resulting diff. Use when users want to upgrade or update a provider (including editing package.json, requirements.txt, pyproject.toml, go.mod, or Pulumi.yaml to bump a provider SDK), check for breaking changes before or during an upgrade, fix resources that broke after a provider upgrade, or resolve unexpected replacements, creates, or deletes in a post-upgrade preview, including pulumi-gcp v10 errors such as a missing gcp.notebooks or gcp.iap.Brand type or a required secretDataWoVersion. Applies to all providers (aws, azure-native, gcp, kubernetes, aws-native, cloudflare, datadog, etc.) — not just Tier 1. Do NOT use for querying which stacks use what package versions; use skill `package-usage` for cross-stack audits. Do NOT use for general infrastructure tasks.OfficialDevOpsNo warnings★ 78↓ —
- capturedavepoon/buildwithclaudeSave a memory to Origin in flow. Active capture verb — use proactively when the user states a preference, makes a decision, corrects you, or shares a durable fact. Invoked as `/capture <content>`.ProductivityNo warnings★ 3.7K↓ —
- running-e2e-testsjeremylongshore/tons-of-skills-marketplaceExecute end-to-end tests covering full user workflows across frontend and backend. Use when performing specialized testing. Trigger with phrases like "run end-to-end tests", "test user flows", or "execute E2E suite".TestingNo warnings★ 2.9K↓ —
- offensive-sstiSnailSploit/Claude-RedDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.TestingNo warnings★ 10K↓ —
- pulumi-context-apipulumi/agent-skillsQuery the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill `pulumi-debug-failed-operation`).OfficialEngineeringNo warnings★ 78↓ —
- golang-samber-rosamber/cc-skills-golangReactive streams and event-driven programming in Golang using samber/ro — ReactiveX implementation with 150+ type-safe operators, cold/hot observables, 5 subject types (Publish, Behavior, Replay, Async, Unicast), declarative pipelines via Pipe, 40+ plugins (HTTP, cron, fsnotify, JSON, logging), automatic backpressure, error propagation, and Go context integration. Apply when using or adopting samber/ro, when the codebase imports github.com/samber/ro, or when building asynchronous event-driven pipelines, real-time data processing, streams, or reactive architectures in Go. Not for finite slice transforms (→ See `samber/cc-skills-golang@golang-samber-lo` skill).PlanningNo warnings★ 3.7K↓ —
- szamlazz-invoicingdavepoon/buildwithclaudeIssue, cancel, and fetch Hungarian invoices via the szamlazz.hu Agent API. Handles VAT calculation, NAV taxpayer lookup, partner caching, and PDF generation. Use when the user mentions számla, számlázás, invoice, sztornó, díjbekérő, proforma, or wants to bill a customer.DocumentsNo warnings★ 3.7K↓ —
- notion-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement adaptive Notion request throttling and bounded retry behavior from observed responses. Use when handling 429s, queue pressure, or bursty workloads. Trigger with "handle Notion rate limits", "throttle Notion requests", or "fix Notion 429".ProductivityNo warnings★ 2.9K↓ —
- miro-debug-bundlejeremylongshore/tons-of-skills-marketplaceDesign and implement a repository-side Miro diagnostic-bundle workflow with bounded metadata and automatic redaction. Use when escalating a Miro failure. Trigger with "build Miro debug bundle".EngineeringNo warnings★ 2.9K↓ —
- perqNewdavepoon/buildwithclaudeFind verified free AI credits, free tiers, startup programs and student perks for LLM APIs, GPUs, voice, databases and dev tools through Perq's read-only search API or hosted MCP server. Use when the user asks what free credits they can get, the cheapest way to try a model or API, or which startup or student programs apply. Every answer carries the vendor's source link and a last-verified date.EngineeringNo warnings★ 3.7K↓ —
- skill-lookupforyourhealth111-pixel/Vibe-SkillsActivates when the user asks about Agent Skills, wants to find reusable AI capabilities, needs to install skills, or mentions skills for Claude. Use for discovering, retrieving, and installing skills.OtherNo warnings★ 3.8K↓ —
i4h-workflow-dataset-mimic
NVIDIA/skills
ProductivityUpdated 2 days ago
From the author
Expand workflow HDF5 demonstrations with action jitter, optionally scoped to node segments. Use for synthetic variants; do not use to collect data, alter state directly, or generate new images.
Install
npx skills add NVIDIA/skills --skill i4h-workflow-dataset-mimic -a claude-code
Installs to .claude/skills/i4h-workflow-dataset-mimic/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (5)
- BENCHMARK.md
- SKILL.md
- evals/evals.json
- skill-card.md
- skill.oms.sig