Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 20 hours ago
48,620 skills
- validate-pluginjeremylongshore/tons-of-skills-marketplaceValidate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard. Runs structural validation (plugin.json fields, file references, permissions) and content validation (SKILL.md grading, command/agent frontmatter). Use when building a new plugin, preparing for marketplace submission, or auditing existing plugins. Trigger with "validate this plugin", "check plugin structure", "grade my plugin", "/validate-plugin".PlanningNo warnings★ 2.9K↓ —
- html-planplannotator/effective-htmlDirect-invocation specialist for clear, self-contained HTML plans that preserve source material while improving hierarchy, sequence, ownership, dependencies, and reviewability. Use when the user explicitly invokes html-plan or the broad html skill routes a plan request here. Do not activate independently from a general request.PlanningNo warnings★ 3.8K↓ —
- trend-spotteraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "find trending topics", "what trends should my brand jump on", or "time a campaign around a cultural moment"; produces a ranked trend report with brand-fit scores, format calls (rising/peak/declining), a cultural calendar, and go/skip recommendations. Not for finding the creators to run those trends — use influencer-discovery; not for building the brand posting calendar from a go verdict — use social-calendar-builder. 热点趋势洞察/借势营销MarketingNo warnings★ 3K↓ —
- server-actionsdavepoon/buildwithclaudeThis skill should be used when the user asks about "Server Actions", "form handling in Next.js", "mutations", "useFormState", "useFormStatus", "revalidatePath", "revalidateTag", or needs guidance on data mutations and form submissions in Next.js App Router.OtherNo warnings★ 3.7K↓ —
- differential-reviewtrailofbits/skillsPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.EngineeringNo warnings★ 7.9K↓ —
- paid-measurement-loopaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "read back" a paid campaign change, "did this ad change work", or "compare ROAS/CPA before and after"; reads ROAS/CPA against a control over a fixed readback window and returns a Promote / Keep-testing / Rollback / Unproven readback decision with the math delegated to roi-calculator. Not for RQS scoring or veto adjudication — use ad-account-auditor; not for the ROI ratio math — use roi-calculator; not for cross-channel rollups — use performance-analyzer. 付费广告复盘/ROAS回看/投放效果归因TestingNo warnings★ 3K↓ —
- momentum-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "keep the launch momentum going after launch week", "plan a changelog / release-notes cadence as GTM", or "is this update worth a relaunch"; produces a T+1→T+30 momentum plan — a launch-moment calendar (milestone / shipped-loop / badge moments only), announcement-tier routing (major = full-channel, medium = targeted, minor = changelog-only), a relaunch legitimacy call, spike-to-owned handoff briefs, and the next Tier-1 moment with launch-stacking spacing. Not for the 30-day content-reuse map or paid amplification execution — use content-amplifier; not for planning the next launch end to end — use launch-tier-planner. 抗第二周断崖/changelog-as-GTM/relaunch/下一发布时刻PlanningNo warnings★ 3K↓ —
- denarioforyourhealth111-pixel/Vibe-SkillsMultiagent AI system for scientific research assistance that automates research workflows from data analysis to publication. This skill should be used when generating research ideas from datasets, developing research methodologies, executing computational experiments, performing literature searches, or generating publication-ready papers in LaTeX format. Supports end-to-end research pipelines with customizable agent orchestration.DataNo warnings★ 3.8K↓ —Also in 2 other repos
- hex-local-dev-loopjeremylongshore/tons-of-skills-marketplaceConfigure Hex local development with hot reload and testing. Use when setting up a development environment, configuring test workflows, or establishing a fast iteration cycle with Hex. Trigger with phrases like "hex dev setup", "hex local development", "hex dev environment", "develop with hex".TestingNo warnings★ 2.9K↓ —
- requesting-code-reviewforyourhealth111-pixel/Vibe-SkillsPrepare and request a code review after implementation or before merge by assembling scope, requirements, git range, and reviewer instructions.EngineeringNo warnings★ 3.8K↓ —
- design-reviewplugin87/ux-ui-agent-skillsReview or audit a design/UI across 6 weighted dimensions with Nielsen's 10 heuristics and a prioritized findings table. Use when the user wants a design critique, quality score, heuristic evaluation, or audit of an existing screen, page, or product before/after build.DesignNo warnings★ 3.1K↓ —
- attio-rate-limitsjeremylongshore/tons-of-skills-marketplaceAnalyze and design an Attio request governor with separate read and write budgets, query-score awareness, bounded retries, and observable backpressure. Use when an Attio integration receives 429 responses or needs safe concurrency controls. Trigger with "Attio rate limits", "Attio 429", or "throttle Attio requests".DesignNo warnings★ 2.9K↓ —
- scientific-brainstormingforyourhealth111-pixel/Vibe-SkillsOpen-ended scientific ideation partner. Use for research gaps, mechanism exploration, interdisciplinary connections, assumptions, possible research directions, and lightweight literature matrix or A+B paper-combination idea mapping. For structured testable hypotheses and validation plans, use hypothesis-generation instead.ScienceNo warnings★ 3.8K↓ —
- exa-sdk-patternsjeremylongshore/tons-of-skills-marketplaceIsolate exa-js or exa-py behind an application-owned adapter that preserves current request semantics and safe evidence. Use when operating or reviewing this Exa boundary. Trigger with "Exa sdk patterns", "review Exa sdk patterns", or "fix Exa sdk patterns".EngineeringNo warnings★ 2.9K↓ —
- oil-motionnexu-io/open-design处理视频和序列帧，编译滚动、指针、拖动与状态驱动的网页动效；内含本地媒体处理脚本和运行时。新素材生成使用宿主工具。OtherNo warnings★ 105.3K↓ —
- canva-load-scalejeremylongshore/tons-of-skills-marketplaceDesign a mock-first Canva capacity test and a tightly authorized provider probe. Use when sizing queues, workers, token-refresh serialization, or endpoint concurrency without inventing universal quotas. Trigger with: "load test Canva", "size Canva workers", "Canva capacity plan".TestingNo warnings★ 2.9K↓ —
- memoryjeremylongshore/tons-of-skills-marketplaceUse when sharpening a perception or observation you ALREADY formed about conversation state, user behavior, drift, emotional shifts, or cross-turn patterns. Trigger phrases include "what did you notice about X", "the user keeps doing Y", "I sense something has changed", "is the user X-ing", "what does this pattern suggest", "what shifted across our turns", "am I missing something here", "why did the conversation move from X to Y", or any moment requiring verification of whether a felt signal is real or projection. The skill calls the memory MCP tool to retrieve a perception scaffold (perception failure, detection procedure, suppression vectors) that SHARPENS an observation you already have. It is NOT a substitute for observing first. Do NOT trigger for fact extraction, summarization, list-making, factual lookups, or write-heavy memory tasks (storing/retrieving structured data). Memory harness is filter/perception oriented; calling on write-heavy tasks produces scaffold paralysis.ProductivityNo warnings★ 2.9K↓ —
- deliverability-qaaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "run a deliverability pre-flight before I send", "check my SPF/DKIM/DMARC/BIMI", "why am I landing in spam / promotions", or "score my sender reputation and list hygiene"; runs the ONE-TIME pre-send SEND S1 authentication pre-flight and builds the SEND S (Sender-integrity / Deliverability) evidence read — DNS + DMARC-RUA auth, domain/IP reputation, inbox placement, content/link/render, and point-in-time bounce/complaint hygiene — using Pass/Partial/Fail/Unknown/N/A states and scoring only at complete applicable coverage. Not for the recurring hygiene trend — use list-hygiene-monitor; not for final EQS or veto verdicts — use email-quality-auditor; not for segments/suppression lists — use list-segment-builder. 邮件送达率预检/SPF DKIM DMARC认证/发件域声誉TestingNo warnings★ 3K↓ —
- brief-generatoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "create an influencer brief" or "write a campaign brief"; produces a structured creator brief with deliverables, key messages, creative direction, timeline, disclosure rules, and compensation terms. Not for choosing how to split spend across creators — use budget-optimizer. 达人合作简报/创作者BFMarketingNo warnings★ 3K↓ —
- figma-implement-designforyourhealth111-pixel/Vibe-SkillsTranslate Figma nodes into production-ready code with 1:1 visual fidelity using the Figma MCP workflow (design context, screenshots, assets, and project-convention translation). Trigger when the user provides Figma URLs or node IDs, or asks to implement designs or components that must match Figma specs. Requires a working Figma MCP server connection.DesignNo warnings★ 3.8K↓ —
- subject-line-labaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "generate subject line variants", "pre-score my subject lines", or "will this subject get truncated / trigger spam filters"; produces a labeled subject + preheader variant set and a per-variant heuristic pre-score card — spam-trigger flags, length/truncation across desktop + mobile, emoji-count, and the inbox preview render (from-name + subject + preheader) — before any test is run. Not for the body copy or CTA — use email-creative-builder; not for the A/B test design or significance read — use send-experiment-designer; not for the profile-weighted EQS or the S1/S2/N1/D1 vetoes — use email-quality-auditor. 邮件主题行生成/主题行预打分/截断与垃圾词检查TestingNo warnings★ 3K↓ —
- pulumi-neo-handoffpulumi/agent-skillsHand off the current thread to a new Pulumi Neo task as a one-way transfer. Use when the user explicitly asks to hand off, send, transfer, or continue current work in Pulumi Neo (e.g. "hand this to Neo", "continue in Neo", "/neo-handoff"). Do not load when the user only mentions Neo, asks what Neo can do, asks for an AI-written PR or preview explanation, or hands off to a different agent.OfficialWritingNo warnings★ 78↓ —
- pulumi-arm-to-pulumipulumi/agent-skillsConvert or migrate Azure ARM (Azure Resource Manager) templates, Bicep templates, or code to Pulumi, including importing existing Azure resources. This skill MUST be loaded whenever a user requests migration, conversion, or import of ARM templates, Bicep templates, ARM code, Bicep code, or Azure resources to Pulumi.OfficialDevOpsNo warnings★ 78↓ —
- pulumi-context-apipulumi/agent-skillsQuery the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill `pulumi-debug-failed-operation`).OfficialEngineeringNo warnings★ 78↓ —
genotoxic
trailofbits/skills
TestingUpdated 5 days ago
From the author
Graph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.
Install
npx skills add trailofbits/skills --skill genotoxic -a claude-code
Installs to .claude/skills/genotoxic/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (6)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/graph-analysis.md
- references/mutation-frameworks.md
- references/triage-methodology.md