Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,644 skills from 2,355 repositories · updated 9 minutes ago
48,644 skills
- dark-social-attributoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "figure out where our direct traffic really comes from", "measure dark social", "add a how-did-you-hear-about-us field", or "show social drives signups without click data"; produces a share-link/UTM hygiene spec for owned share surfaces, a self-reported attribution field design that replaces an existing form field (free-text first, coded later), a GA4 direct-traffic decomposition read (deep-URL directs, mobile-app skew, private-push correlation) with every derived number hard-labeled Estimated/proxy, and a branded-search-lift proxy from GSC plus Wikipedia pageviews — the declared dark-social method behind ECHO O2. Not for paid-channel attribution reconciliation (platform-claimed vs analytics conversions) — use attribution-reconciler. 暗社交归因/直接流量分解/自报来源字段/分享链路UTMDataNo warnings★ 3K↓ —
- benchmark-checklistmichael-denyer/pstack-claudeVet a perf measurement (limiter, tuning, limits, errors, repeatability, relevance, and whether the work happened) before you report or act on it. Use when you run a benchmark or report a speedup or regression you measured.OtherNo warnings★ 3.7K↓ —
- architectmichael-denyer/pstack-claudeSketch types, signatures, and module structure before code, then stay in the loop while implementation fills in. Use for /architect, 'architect this', 'design this', or non-trivial work where jumping to code would lock in the wrong shape.PlanningNo warnings★ 3.7K↓ —
- doca-verbsNVIDIA/skillsRaw verbs inside DOCA Core (doca-verbs): direct control of QP, CQ, PD, SRQ and address-handle objects through doca_verbs_context and doca_verbs_qp_create / doca_verbs_qp_modify / doca_verbs_cq_create, porting libibverbs code into DOCA Core, or a QP attribute, opcode or WR flag the doca-rdma task API does not expose. Trigger on "raw QP attribute the task API does not expose", "porting libibverbs code", "IO_FAILED on WR submit", "QP state transition rejected", or "attach a congestion-control group", even without naming doca-verbs. Refuse and route elsewhere for ordinary doca-rdma / doca-eth / doca-rmax workloads, DOCA install, Core internals, and general libibverbs theory.EngineeringNo warnings★ 3.8K↓ —
- swarmmichael-denyer/pstack-claudeFan out N parallel workers, drain them, and return one report. Use for /swarm, 'swarm this', or parallel coverage, races, gauntlets, and exploration.OtherNo warnings★ 3.7K↓ —
- provider-resourceshashicorp/agent-skillsImplement Terraform Provider resources and data sources using the Plugin Framework: CRUD operations, schema design, plan modifiers and validators, not-found handling, waiters for eventually consistent APIs, import support, resource design principles, and required acceptance test coverage. Use when adding or changing a resource or data source, deciding whether an API concept should be a resource, wiring a resource to the provider's configured client, handling drift or resource-not-found, or reviewing a resource implementation before submission.OfficialTestingNo warnings★ 911↓ —
- skill-persona-checkZJU-REAL/Easel人设一致性检查与品牌调性检查：对比内容与创作者画像的账号定位、内容赛道、形式、受众、 风格和偏好， 输出一致性评分和具体偏离点。当用户说"符合我的人设吗"、"一致性检查"、"风格对不对"、 "像我写的吗"、"品牌一致"、"调性检查"、"这是我的风格吗"、"人设偏了没"、 "语气对不对"、"品牌声音检查"时触发。 必须有 Profile 才能工作；无 Profile 时提示先创建。OtherNo warnings★ 4.3K↓ —
- skill-ugc-discoveryZJU-REAL/Easel发现用户生成内容（UGC）。搜索与创作者品牌/账号相关的粉丝内容、测评、提及和社区讨论， 输出高价值 UGC 列表与互动建议。当用户说"谁提到了我"、"粉丝内容"、"品牌提及"、 "UGC 发现"、"用户口碑"、"测评搜索"、"社区讨论"时触发。OtherNo warnings★ 4.3K↓ —
- denarioforyourhealth111-pixel/Vibe-SkillsMultiagent AI system for scientific research assistance that automates research workflows from data analysis to publication. This skill should be used when generating research ideas from datasets, developing research methodologies, executing computational experiments, performing literature searches, or generating publication-ready papers in LaTeX format. Supports end-to-end research pipelines with customizable agent orchestration.DataNo warnings★ 3.8K↓ —Also in 2 other repos
- share-of-voice-trackeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "track our share of voice", "what share of the conversation do we own vs competitors", or "trend our SOV this quarter"; computes SOV% = brand mentions ÷ (brand + competitor panel mentions) per platform per period on a LOCKED competitor panel — a panel switch invalidates the trend (restart the series and log the break; the ECHO O3 rule) — plus a sentiment-weighted SOV variant (sentiment labeled Estimated unless human-coded) and a Wikipedia-pageviews attention-share alternative; built from keyless listening connectors, gdelt.py news echo, and user exports — public counts only, closed platforms are never scraped. Not for backlink or offsite SEO signals — use offsite-signal-analyzer. 声量份额/竞品声量对比/提及份额/注意力份额BrowserNo warnings★ 3K↓ —
- skill-content-calendar-logZJU-REAL/Easel统一内容日历底座。记录每次发布（发布页/对话页均自动落库）、用户排期、平台活动/节日/特殊日期到 一个时间线，并供 Agent 规划前读回。当用户说"内容日历""日历里有什么""接下来发什么""这周发了啥" "把这个活动记到日历""最近的发布节奏""哪个平台该更新了"时触发。是发布时间线的权威底座， 与 skill-publish-log（指标底座）互补：本底座管"何时发什么/该做什么"，publish-log 管"每条数据表现"。ProductivityNo warnings★ 4.3K↓ —
- principle-type-system-disciplinemichael-denyer/pstack-claudeApply when designing types, reviewing a function signature, or writing code in any statically-typed language. Make illegal states unrepresentable, brand semantic primitives, parse external data at boundaries, exhaust variants, derive from authoritative schemas.WritingNo warnings★ 3.7K↓ —
- last30daysnexu-io/open-designRecent community and social trend research over the last 30 days. Use when the brief asks what people are saying now, recent sentiment, community reactions, social proof, launch reaction, trend scan, or last-30-days context.ScienceNo warnings★ 105.3K↓ —
- principle-never-block-on-the-humanmichael-denyer/pstack-claudeApply when tempted to ask 'should I do X?' on reversible work.OtherNo warnings★ 3.7K↓ —
- security-guardrailsdavepoon/buildwithclaudeAdversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow bypass, and social engineering attacks.SecurityNo warnings★ 3.7K↓ —
- plain-englishjeremylongshore/tons-of-skills-marketplaceExplain supplied contract clauses in clear language while preserving conditions, exceptions and source locators. Use when a non-lawyer wants to understand an agreement. Trigger with "explain this contract", "plain-english" or "translate this contract to plain English".LegalNo warnings★ 2.9K↓ —
- od-contributenexu-io/open-designOne-click contribution flow for OpenDesign (nexu-io/open-design) — even for non-coders. Pick one of four cards (ship a Skill or Design System you made with OD; translate docs; fix a typo / write a blog; report a bug), the agent validates and opens a PR (or issue) for you. Trigger words contribute to open design, ship my OD skill, ship my OD design system, translate OD docs, report an OD bug, od-contribute.DesignNo warnings★ 105.3K↓ —
- positioning-mapperaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "map our positioning", "name our competitive alternatives", or "pick a beachhead segment for the launch"; produces a Dunford-style positioning canvas — named competitive alternatives (including spreadsheet and status quo), unique attributes (verifiable, or routed to the claims ledger), value themes (attribute→benefit→value chains), a target beachhead segment scored on serviceability / pain intensity / reachability, and a one-sentence onlyness statement — the sole upstream of the message house and the entity-signal source for the canonical entity profile. Not for the message house or per-channel launch copy — use message-house-builder; not for audience/persona profiling itself — use audience-mapper; not for SEO keyword positioning — use keyword-research. 定位画布/竞争替代品/独特价值/滩头细分DataNo warnings★ 3K↓ —
- surveysdavepoon/buildwithclaudeManages the founder's survey-based validation — crafting the right questions, deploying a survey to the internet, and analyzing results against hypotheses. Use when the founder wants to run a survey, create survey questions, validate hypotheses at scale, check how a survey is going, understand whether a survey is the right tool right now, or deploy a question set to get quantitative signal. Also bring this up if you believe that creating a survey to collect quantitative evidence may be useful at this point.DevOpsNo warnings★ 3.7K↓ —
- stripe-automationdavepoon/buildwithclaudeAutomate Stripe tasks via Rube MCP (Composio): customers, charges, subscriptions, invoices, products, refunds. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- i4h-workflow-setupNVIDIA/skillsPreflight and set up the root-level workflow runtime. Use for installation, missing component environments, or third-party failures; do not use for rollout validation.ProductivityNo warnings★ 3.8K↓ —
- launch-asset-packageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "package the launch assets", "build a press kit", or "prep the store listing and go-live checklist"; produces a tier-scoped launch asset manifest with production status — a press kit spec (factsheet, description, history, features, videos, images, logo and icon, awards, contact), demo script and screenshot specs, a launch FAQ, dual-store listing metadata drafts against the official character budgets (per App Store Connect / Play Console documentation), and a technical go-live checklist manifest (robots flip, sitemap, OG tags, analytics verification — execution stays with technical-seo-checker and serp-markup-builder). Not for the message copy itself — use message-house-builder or content-writer; not for landing page UX — use landing-optimizer; not for keyword research beyond the store surfaces — use keyword-research. 发布资产打包/press kit/商店listing规格/上线检查清单DataNo warnings★ 3K↓ —
- speak-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Speak API rate limits with exponential backoff, request queuing, and optimization strategies. Use when implementing rate limits features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak rate limits", "speak rate limits".EngineeringNo warnings★ 2.9K↓ —
- clickup-automationdavepoon/buildwithclaudeAutomate ClickUp project management including tasks, spaces, folders, lists, comments, and team operations via Rube MCP (Composio). Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
sharp-edges
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration.
Install
npx skills add trailofbits/skills --skill sharp-edges -a claude-code
Installs to .claude/skills/sharp-edges/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (19)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/auth-patterns.md
- references/case-studies.md
- references/config-patterns.md
- references/crypto-apis.md
- references/lang-c.md
- references/lang-csharp.md
- references/lang-go.md
- references/lang-java.md
- references/lang-javascript.md
- +7 more