Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,642 skills from 2,355 repositories · updated 9 minutes ago
48,642 skills
- attio-rate-limitsjeremylongshore/tons-of-skills-marketplaceAnalyze and design an Attio request governor with separate read and write budgets, query-score awareness, bounded retries, and observable backpressure. Use when an Attio integration receives 429 responses or needs safe concurrency controls. Trigger with "Attio rate limits", "Attio 429", or "throttle Attio requests".DesignNo warnings★ 2.9K↓ —
- canva-load-scalejeremylongshore/tons-of-skills-marketplaceDesign a mock-first Canva capacity test and a tightly authorized provider probe. Use when sizing queues, workers, token-refresh serialization, or endpoint concurrency without inventing universal quotas. Trigger with: "load test Canva", "size Canva workers", "Canva capacity plan".TestingNo warnings★ 2.9K↓ —
- verify-paperclippaperclipai/paperclipVerify Paperclip from a source checkout, published npm install, or existing staging or production stack. Select the environment, data state, version, and platform; drive real UI or CLI journeys and capture evidence. Route deployment to the private Cloud skills.DevOpsNo warnings★ 109.7K↓ —
- doca-dmsNVIDIA/skillsOperate NVIDIA DOCA Management Service on a BlueField, Arm/x86 host, or Kubernetes pod: from DOCA 3.5 the local `dms-cli` (one command per YANG path, no server), and the `dmsd` + `dmspe` service: choose deployment and authentication, configure `-allowed_users` and `dmsgroup`, use gNMI Get/Set, run supported gNOI workflows, and debug frontend/backend failures. Trigger even without "DMS" for "manage a remote BlueField over gRPC", "gNOI reboot from orchestrator", or fleet-management requests. SAFETY: reboot, OS install, factory-reset, and managed-file deletion are destructive and require target-bound explicit confirmation; never invoke them speculatively. Route installation and library/API build questions elsewhere, and route telemetry streaming and aggregation to doca-dts (DOCA Telemetry Service).DevOpsNo warnings★ 3.8K↓ —
- ulw-researchcode-yeongyu/oh-my-openagentRuns maximum-saturation research with a cooperating team, claim-graph gating, and a cited, QA'd deliverable. Use when the user explicitly asks for research or a deep investigation, including any 'ulw' research wording.ScienceNo warnings★ 70.6K↓ —
- mass-ulwcode-yeongyu/oh-my-openagentDrives dependency-ordered child work through the native workflow tool, each phase's stages defined up front in one run, with retry/amend/send recovery. Use when the user asks for mass-ulw, a DAG of tasks, or fan-out work where some tasks must wait on others.ProductivityNo warnings★ 70.6K↓ —
- product-briefjeremylongshore/tons-of-skills-marketplaceStructured product brief and PRD creation assistant. Use when the user needs to create a product brief, PRD, or feature spec that defines what to build and why. Trigger with "product brief", "PRD", "spec", "feature doc", "write a brief", or "define this feature".WritingNo warnings★ 2.9K↓ —
- exa-hello-worldjeremylongshore/tons-of-skills-marketplaceProve a new Exa Search integration with a bounded synthetic query and content-free assertions. Use when operating or reviewing this Exa boundary. Trigger with "Exa hello world", "review Exa hello world", or "fix Exa hello world".EngineeringNo warnings★ 2.9K↓ —
- principle-model-the-domainmichael-denyer/pstack-claudeApply when writing stateful logic, or when code branches a lot or repeats a shape assumption across files.WritingNo warnings★ 3.7K↓ —
- hex-common-errorsjeremylongshore/tons-of-skills-marketplaceDiagnose and fix Hex common errors and exceptions. Use when encountering Hex errors, debugging failed requests, or troubleshooting integration issues. Trigger with phrases like "hex error", "fix hex", "hex not working", "debug hex".EngineeringNo warnings★ 2.9K↓ —
- maintain-formal-verification-skillmichael-denyer/pstack-claudeBring a project's formal verification back in line with the code after the code changes: find the commits that touched verified code, update the model, harness, or properties to describe the code as it is now, rerun, and say whether each failure is drift in the verification or a bug in the code. Use for /maintain-formal-verification-skill, "is the model still true to the code", or after merges and refactors that touched verified code without rechecking it.EngineeringNo warnings★ 3.7K↓ —
- route-handlersdavepoon/buildwithclaudeThis skill should be used when the user asks to "create an API route", "add an endpoint", "build a REST API", "handle POST requests", "create route handlers", "stream responses", or needs guidance on Next.js API development in the App Router.EngineeringNo warnings★ 3.7K↓ —
- agreement-generatorjeremylongshore/tons-of-skills-marketplaceDraft a business agreement from the selected relationship type, confirmed party and commercial facts, and explicit proposed choices with provenance. Use when preparing a service, partnership, licensing or other business agreement. Trigger with "agreement-generator" or "create a freelancer agreement".OtherNo warnings★ 2.9K↓ —
- task-observerrebelytics/one-skill-to-rule-them-allMonitors task execution for skill improvement opportunities: logs patterns, user corrections and methodology worth preserving to the workspace, turns them into skill updates in a weekly review, and flags repeating work as new skills. Use during ANY multi-step task, agentic workflow, or work session. Also triggers in post-task feedback discussions and when the user mentions skill observations, the observation log, or skill taxonomy. Also known as "One Skill to Rule Them All" — trigger on this phrase too. IMPORTANT: invoke this skill before the FIRST tool call of any session and before writing or proposing a plan — any turn that will involve a tool call counts. This sentence is the session-start trigger and the only activation layer that survives an unreachable config file; pair it with a CLAUDE.md instruction or a session-start hook (references/environments.md). A subagent dispatched by a session already running it does not run it: it writes nothing and puts its findings in its report.ProductivityNo warnings★ 3.7K↓ —
- drill-statusdavepoon/buildwithclaudeShow drill-me learning progress — topics studied, cards due for review, weakest concepts, and what to study next. Use when the user asks what's due, how their learning is going, or for their drill-me status.EngineeringNo warnings★ 3.7K↓ —
- reviewdavepoon/buildwithclaudePower-user audit of Origin's pending surfaces. Most users want `/brief` for revisions. That handles the daily flow. Use `/review` only for explicit deep-walk audits after bulk imports, or when you want to walk the full queue rather than the top 3 shown in /brief. Invoked as `/review captures` or `/review revisions`.EngineeringNo warnings★ 3.7K↓ —
- fondo-install-authjeremylongshore/tons-of-skills-marketplaceSet up Fondo account and configure integrations with Gusto, QuickBooks, and bank accounts for automated startup bookkeeping and R&D tax credits. Trigger: "setup fondo", "fondo account", "fondo integrations", "connect fondo".FinanceNo warnings★ 2.9K↓ —
- linear-hello-worldjeremylongshore/tons-of-skills-marketplaceProve Linear authentication and workspace visibility with the smallest read-only GraphQL or SDK query. Use when establishing a new integration baseline without creating test issues. Trigger with "test Linear connection", "Linear hello world", or "verify Linear API key".TestingNo warnings★ 2.9K↓ —
- helpdavepoon/buildwithclaudeOne-screen quick reference for the Origin plugin. Lists the daily verbs, the daily flow, where data lives, and how to view it without a GUI. Use when the user says "help", "what can I do", "list origin commands", "how do I use origin", or invokes `/help`.OtherNo warnings★ 3.7K↓ —
- offensive-exploit-developmentSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 10.2K↓ —
- pr-gardeningpaperclipai/paperclipDiscover the pull requests this Paperclip instance opened (never community contributions), report what each is for and how confident we are that it is merge-ready, and automatically drive the non-ready ones back to green with /prepare-paperclip-pr — without ever merging.OtherNo warnings★ 109.7K↓ —
- offensive-bluetooth-classicSnailSploit/Claude-RedBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.MediaNo warnings★ 10.2K↓ —
- lindy-install-authjeremylongshore/tons-of-skills-marketplaceSet up a Lindy account and authenticated webhook trigger. Use when onboarding to Lindy, configuring bearer authentication for webhook triggers, or connecting Lindy agents to your application. Trigger with phrases like "install lindy", "setup lindy", "lindy auth", "configure lindy webhook", "lindy webhook secret".OtherNo warnings★ 2.9K↓ —
- usfiscaldataforyourhealth111-pixel/Vibe-SkillsQuery the U.S. Treasury Fiscal Data API for federal financial data including national debt, government spending, revenue, interest rates, exchange rates, and savings bonds. Access 54 datasets and 182 data tables with no API key required. Use when working with U.S. federal fiscal data, national debt tracking (Debt to the Penny), Daily Treasury Statements, Monthly Treasury Statements, Treasury securities auctions, interest rates on Treasury securities, foreign exchange rates, savings bonds, or any U.S. government financial statistics.FinanceNo warnings★ 3.8K↓ —
security-guardrails
davepoon/buildwithclaude
SecurityUpdated 6 hours ago
From the author
Adversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow bypass, and social engineering attacks.
Install
npx skills add davepoon/buildwithclaude --skill security-guardrails -a claude-code
Installs to .claude/skills/security-guardrails/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md