Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,644 skills from 2,355 repositories · updated 4 minutes ago
48,644 skills
- property-based-testingforyourhealth111-pixel/Vibe-SkillsProperty-based testing with fast-check (TypeScript/JavaScript) and Hypothesis (Python). Generate test cases automatically, find edge cases, and test mathematical properties. Use when user mentions property-based testing, fast-check, Hypothesis, generating test data, QuickCheck-style testing, or finding edge cases automatically.TestingNo warnings★ 3.8K↓ —
- kiro-steeringgotalab/cc-sddMaintain {{KIRO_DIR}}/steering/ as persistent project memory (bootstrap/sync). Use when initializing or updating steering documents.ProductivityNo warnings★ 3.7K↓ —
- metric-calculatorforyourhealth111-pixel/Vibe-SkillsCompute well-defined metrics from existing formulas, datasets, or test outputs. Use as an explicit/manual helper when the metric definition is already known, not for choosing the overall analysis owner or dashboard strategy.TestingNo warnings★ 3.8K↓ —
- kiro-steering-customgotalab/cc-sddCreate custom steering documents for specialized project contextsPlanningNo warnings★ 3.7K↓ —
- golang-spf13-cobrasamber/cc-skills-golangGolang CLI command tree library using spf13/cobra — cobra.Command, RunE vs Run, PersistentPreRunE hook chain, Args validators (NoArgs, ExactArgs, MatchAll, custom), persistent vs local flags, command groups, ValidArgsFunction, RegisterFlagCompletionFunc, ShellCompDirective, usage/help template customization, man-page and markdown doc generation, and testing with SetArgs/SetOut/SetErr. Apply when using or adopting spf13/cobra, or when the codebase imports `github.com/spf13/cobra`. For configuration layering alongside cobra, see the `samber/cc-skills-golang@golang-spf13-viper` skill. For general CLI architecture (project layout, exit codes, signal handling, I/O patterns), see `samber/cc-skills-golang@golang-cli`.TestingNo warnings★ 3.7K↓ —
- golang-samber-oopssamber/cc-skills-golangStructured error handling in Golang with samber/oops — error builders, stack traces, error codes, error context, error wrapping, error attributes, user-facing vs developer messages, panic recovery, and logger integration. Apply when using or adopting samber/oops, or when the codebase already imports github.com/samber/oops.ProductivityNo warnings★ 3.7K↓ —
- building-python-mcp-serverskajisho5/ffmpeg-skillBuilds robust Python MCP (Model Context Protocol) servers with FastMCP — tool design, error contracts, event-loop-safe blocking work, subprocess/CLI wrapping, single-file vs packaged distribution, global-state-free testing, and prompt-injection awareness. Use when writing an MCP server, exposing a tool or CLI to an LLM client, debugging tool registration/packaging, or testing MCP tools.EngineeringNo warnings★ 4.2K↓ —
- golang-google-wiresamber/cc-skills-golangCompile-time dependency injection in Golang using google/wire — wire.NewSet, wire.Build, wire.Bind (interface→concrete), wire.Struct, wire.Value, wire.InterfaceValue, wire.FieldsOf, cleanup functions, //go:build wireinject injector files, and generated wire_gen.go. Apply when using or adopting google/wire, when the codebase imports `github.com/google/wire`, or when wiring an application graph at compile time via `wire.Build`. For runtime DI with reflection, see `samber/cc-skills-golang@golang-uber-dig` skill.DesignNo warnings★ 3.7K↓ —
- golang-uber-digsamber/cc-skills-golangImplements dependency injection in Golang using uber-go/dig — reflection-based container, Provide/Invoke, dig.In/dig.Out parameter and result objects, named values, value groups, optional dependencies, scopes, and Decorate. Apply when using or adopting uber-go/dig, when the codebase imports `go.uber.org/dig`, or when wiring an application graph at startup. For higher-level lifecycle and modules, see `samber/cc-skills-golang@golang-uber-fx` skill.OtherNo warnings★ 3.7K↓ —
- golang-concurrencysamber/cc-skills-golangGolang concurrency design — goroutine lifecycle and leak prevention, channels and `select`, channel ownership and direction, `sync.Mutex`/`RWMutex`/`sync.Map`/`sync.Once`/atomics, `errgroup`, `singleflight`, worker pools, and fan-out/fan-in pipelines. Use when writing or reviewing concurrent Go code, when choosing between channels and mutexes, when protecting a shared map or counter, or when a goroutine has no clear exit. Not for defensive coding unrelated to concurrency such as nil panics, slice aliasing, or numeric overflow (→ See `samber/cc-skills-golang@golang-safety` skill), and not for debugging a specific hung, crashing, or racing program after the fact (→ See `samber/cc-skills-golang@golang-troubleshooting` skill).DesignNo warnings★ 3.7K↓ —
- fix-merge-conflictsmichael-denyer/pstack-claudeResolve merge conflicts non-interactively, validate build and tests, and finalize conflict resolutionTestingNo warnings★ 3.7K↓ —
- principle-experience-firstmichael-denyer/pstack-claudeApply when product, UX, or feature-scope tradeoffs come up. Choose user delight over implementation convenience; ship fewer polished features over more rough ones.DesignNo warnings★ 3.7K↓ —
- gsd:quickdavepoon/buildwithclaudeExecute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agentsProductivityNo warnings★ 3.7K↓ —
- competitor-analystjeremylongshore/tons-of-skills-marketplaceCompetitive analysis and market positioning partner for Product Managers. Use when the user needs to analyze competitors, map positioning, or identify feature gaps. Trigger with "competitor", "competitive analysis", "market map", "feature comparison", "how does X compare", or "positioning".OtherNo warnings★ 2.9K↓ —
- wiki-dedupAr9av/obsidian-wikiDetect and merge wiki pages representing the same concept under different names. Use for page-identity deduplication and consolidation. Destructive merges require confirmation; not for link repair or general linting.OtherNo warnings★ 3.6K↓ —
- doca-compressNVIDIA/skillsHardware compression offload with DOCA Compress on a BlueField DPU, ConnectX NIC, or host: DEFLATE compress and decompress, plus LZ4 decompress (stream and block; LZ4 encode is NOT supported), instead of CPU zlib / zstd. Trigger on "offload this gzip", "decompress incoming network data on the NIC", "compress task returns INVALID_VALUE on alloc_init", "submitted a task but no completion arrives", or "decompress LZ4 on the BlueField", even without naming DOCA Compress. Covers enabling compress-deflate, decompress-deflate, decompress-lz4-stream and decompress-lz4-block tasks on a doca_compress context, sizing source / destination doca_buf against the per-task cap query, mmap permissions, offload vs CPU decisions, a round-trip smoke, and DOCA_ERROR_* from Compress calls. Refuse and route elsewhere for zstd / Snappy / brotli, LZ4 encode (a CPU LZ4 library), pure mmap-to-mmap copies (doca-dma), or DOCA Core lifecycle internals.ProductivityNo warnings★ 3.8K↓ —
- canva-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement endpoint- and user-scoped Canva throttling with bounded backoff and reconciliation. Use when handling HTTP 429, sizing concurrency, or preventing duplicate asynchronous jobs. Trigger with: "Canva rate limit", "Canva 429", "throttle Canva requests".OtherNo warnings★ 2.9K↓ —
- wiki-digestAr9av/obsidian-wikiProduce a day/week/month knowledge digest summarizing what was learned, updated, and connected in the wiki. Use for readable recent-learning summaries; wiki-status reports source and ingestion state instead.ProductivityNo warnings★ 3.6K↓ —
- canva-install-authjeremylongshore/tons-of-skills-marketplaceImplement Canva Connect OAuth 2.0 Authorization Code with SHA-256 PKCE on a backend. Use when creating an integration, adding explicit scopes, handling callback state, or rotating single-use refresh tokens. Trigger with: "set up Canva OAuth", "Canva PKCE", "refresh Canva token".EngineeringNo warnings★ 2.9K↓ —
- ramp-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement a shared Ramp request budget with rolling-window throttling, bounded retries, pagination, and 504 recovery. Use when clients receive 429 or 504 responses or share one outbound IP. Trigger with "Ramp rate limit" or "Ramp 429".OtherNo warnings★ 2.9K↓ —
- hive-mind-advancedforyourhealth111-pixel/Vibe-SkillsAdvanced Hive Mind collective intelligence system for queen-led multi-agent coordination with consensus mechanisms and persistent memoryProductivityNo warnings★ 3.8K↓ —
- oiloil-ui-ux-guidedavepoon/buildwithclaudeModern, clean UI/UX guidance + review skill. Use when you need actionable UX/UI recommendations, design principles, or a design review checklist for new features or existing systems (web/app). Focus on CRAP (Contrast/Repetition/Alignment/Proximity) plus task-first UX, information architecture, feedback & system status, consistency, affordances, error prevention/recovery, and cognitive load. Enforce a modern minimal style (clean, spacious, typography-led), reduce unnecessary copy, forbid emoji as icons, and recommend intuitive refined icons from a consistent icon set.DesignNo warnings★ 3.7K↓ —
- technical-analystjeremylongshore/tons-of-skills-marketplaceTechnical analysis translator for Product Managers. Use when the user needs to analyze a system, codebase, API, or technical concept in PM-friendly terms. Trigger with "understand system", "explain code", "technical analysis", "how does X work", or "what does this service do".EngineeringNo warnings★ 2.9K↓ —
- skill-content-gap-analysisZJU-REAL/Easel分析社媒赛道的内容空白，发现高需求低竞争的蓝海选题机会。 当用户说"蓝海选题""内容空白""没人做的选题""选题机会""高需求低竞争""差异化选题""内容缺口"时使用。 和 skill-competitor-analysis 的区别：本 SKILL 从赛道供需交叉验证找蓝海选题空白； competitor-analysis 拆解具体竞品账号的内容策略。OtherNo warnings★ 4.3K↓ —
offensive-cloud
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or whe
Install
npx skills add SnailSploit/Claude-Red --skill offensive-cloud -a claude-code
Installs to .claude/skills/offensive-cloud/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md