Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 1 hour ago
48,622 skills
- thermosmichael-denyer/pstack-claudeLaunch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.SecurityNo warnings★ 3.7K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 10.2K↓ —
- creator-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks "what did we pay this creator last time" or to "update the creator roster"; curates creator identity, rate, rights, exclusivity, compliance-event, and performance facts through the append-only creators event stream. Not for scoring fit — use fit-scorer; not for reviewing content — use creator-content-auditor. 创作者档案/达人名册LegalNo warnings★ 3K↓ —
- versioning-apisjeremylongshore/tons-of-skills-marketplaceImplement API versioning with backward compatibility, deprecation notices, and migration paths. Use when managing API versions and backward compatibility. Trigger with phrases like "version the API", "manage API versions", or "handle API versioning".EngineeringNo warnings★ 2.9K↓ —
- jetson-init-sourceNVIDIA/skillsSet up the BSP source workspace: Linux_for_Tegra overlay tracker, bsp_sources, Crosstool-NG toolchain. Use after jetson-init-image; not for fetching inputs.MediaNo warnings★ 3.8K↓ —
- clade-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure the Anthropic SDK for Claude API access. Use when setting up Claude integration, configuring API keys, or initializing the Anthropic client in your project. Trigger with phrases like "install anthropic", "setup claude api", "anthropic auth", "configure anthropic API key".EngineeringNo warnings★ 2.9K↓ —
- hypothesis-testerjeremylongshore/tons-of-skills-marketplaceStructured hypothesis formulation, experiment design, and results interpretation for Product Managers. Use when the user needs to validate an assumption, design an A/B test, or evaluate results. Trigger with "hypothesis", "A/B test", "experiment", "validate assumption", "test this", or "should we ship".TestingNo warnings★ 2.9K↓ —
- consent-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "log this subscriber's opt-in", record unsubscribes/complaints, or query lawful basis; curates pseudonymous consent facts through the append-only consent stream and applies suppression/erasure tombstones immediately. Not for SEND scoring — use email-quality-auditor; not for building segments — use list-segment-builder. 订阅同意台账/实时退订抑制/合法性依据登记ProductivityNo warnings★ 3K↓ —
- channel-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to register/query a social channel, record channel state, cadence, governance, voice adaptation, UGC permission, or advocacy facts; curates them through the append-only channels event stream and derived views. Not for ECHO scoring — use social-quality-auditor; not for channel selection — use channel-portfolio-planner. 渠道台账/账号档案/UGC授权记录PlanningNo warnings★ 3K↓ —
- kiro-spec-designgotalab/cc-sddCreate comprehensive technical design for a specificationDesignNo warnings★ 3.7K↓ —Also in 4 other repos
- canva-sdk-patternsjeremylongshore/tons-of-skills-marketplaceImplement a narrow typed Canva Connect REST adapter from a pinned OpenAPI contract. Use when generating or hand-writing request types, response validation, error classification, and tenant-safe client boundaries. Trigger with: "Canva SDK pattern", "generate Canva client", "type Canva API".LegalNo warnings★ 2.9K↓ —
- chat-motion-overlaynexu-io/open-designGenerate configurable chat motion overlays from a transcript or screenshot, including plain bubble scenes, app-style chat containers, optional device frames, preset or uploaded avatars, nickname display rules, and transparent-video-ready Remotion bundles. Use when Codex needs to create reusable short-form chat clips for Douyin, demo videos, story reenactments, social-message proof scenes, or embeddable alpha overlays for Hyperframe and Remotion workflows.MediaNo warnings★ 105.3K↓ —
- last30daysnexu-io/open-designRecent community and social trend research over the last 30 days. Use when the brief asks what people are saying now, recent sentiment, community reactions, social proof, launch reaction, trend scan, or last-30-days context.ScienceNo warnings★ 105.3K↓ —
- strategic-clarityjeremylongshore/tons-of-skills-marketplaceAnalyze and audit team context to establish identity, boundaries, and strategic clarity. Use when starting a new role, inheriting ambiguity, or defining ownership. Trigger with "strategic clarity", "team identity", "new role", "inherited ambiguity", "what does my team own", or "define our boundaries".ProductivityNo warnings★ 2.9K↓ —
- cudaq-importingNVIDIA/skillsUse when porting circuits from another framework (e.g. Qiskit) into CUDA-Q kernels while preserving the source algorithm and validation fidelity.OtherNo warnings★ 3.8K↓ —
- canva-install-authjeremylongshore/tons-of-skills-marketplaceImplement Canva Connect OAuth 2.0 Authorization Code with SHA-256 PKCE on a backend. Use when creating an integration, adding explicit scopes, handling callback state, or rotating single-use refresh tokens. Trigger with: "set up Canva OAuth", "Canva PKCE", "refresh Canva token".EngineeringNo warnings★ 2.9K↓ —
- list-growth-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "grow my email list", "design a lead magnet / signup incentive", "set up double opt-in", or "plan a referral / recommendation loop"; produces a list-growth plan — acquisition channels, lead-magnet / incentive concepts, a compliant double-opt-in capture-flow spec, referral-loop mechanics, and subscriber-growth / cost-per-opt-in targets (labeled Estimated) — that feeds SEND-S (consent quality captured at acquisition) and SEND-N (lifecycle entry). Not for the signup page/popup UX itself — use landing-optimizer; not for recording the opt-in — use consent-registry; not for the confirmation-email copy — use email-creative-builder. 邮件列表增长/lead magnet/双重确认/推荐环MarketingNo warnings★ 3K↓ —
- hubspot-authjeremylongshore/tons-of-skills-marketplaceAuthenticate production HubSpot integrations and survive the auth-side failures — 30-min token expiry storms, 500K daily rate-limit burnout, scope drift, token leakage in commits, multi-portal credential routing, OAuth refresh-token decay. Use when hardening token caching, rotating private app credentials, building a multi-portal credential router, or recovering from 429/403 auth cascades. Trigger with "hubspot auth", "hubspot token cache", "hubspot rate limit", "hubspot scope drift", "hubspot multi-portal", "hubspot OAuth refresh".OtherNo warnings★ 2.9K↓ —
- doca-rdmaNVIDIA/skillsRDMA data movement on NVIDIA BlueField/ConnectX NICs (RoCE/InfiniBand) with DOCA RDMA, instead of hand-written libibverbs/rdma_cm. Use when the user moves data between processes or hosts over the NIC, or hits "one-sided read returns permission denied", "completions never arrive after submit", "connection callback never fires", atomic compare-and-swap over RoCE, or DOCA_ERROR_FULL on the send queue under burst, even without naming DOCA RDMA. Covers bringing up an RDMA context on a doca_dev, connection methods (RDMA CM, bridge/OOB, or gRPC exchange of doca_rdma_export()), the eleven task types (Send/Receive/Send-Imm, Read/Write/Write-Imm, Atomic CmpSwap/FetchAdd, Get/Set/Add Remote Sync Event), matching mmap + RDMA permissions, queue and connection sizing, doca_rdma_cap_* queries, and DOCA_ERROR_* from RDMA calls. Raw QP/verbs control belongs to doca-verbs. Refuse and route elsewhere for general RDMA / ibverbs theory (queue pairs, MRs, RoCE vs IB), installing DOCA itself, or non-RDMA DOCA libraries.WritingNo warnings★ 3.8K↓ —
- privacy-generatorjeremylongshore/tons-of-skills-marketplaceDraft a service-specific privacy notice from confirmed processing facts, source observations and scoped applicability review, with a separate evidence and unresolved-questions record. Use when preparing or revising a privacy policy. Trigger with "privacy-generator" or "create a privacy policy".PlanningNo warnings★ 2.9K↓ —
- ops-monitordavepoon/buildwithclaudeUnified APM and monitoring surface. Polls Datadog, New Relic, and OpenTelemetry backends for active alerts, error traces, and entity health. Use --watch for live polling every 60 seconds. Use --setup to configure monitoring credentials.OtherNo warnings★ 3.7K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —
- od-contributenexu-io/open-designOne-click contribution flow for OpenDesign (nexu-io/open-design) — even for non-coders. Pick one of four cards (ship a Skill or Design System you made with OD; translate docs; fix a typo / write a blog; report a bug), the agent validates and opens a PR (or issue) for you. Trigger words contribute to open design, ship my OD skill, ship my OD design system, translate OD docs, report an OD bug, od-contribute.DesignNo warnings★ 105.3K↓ —
- kiro-steeringgotalab/cc-sddManage {{KIRO_DIR}}/steering/ as persistent project knowledgeOtherNo warnings★ 3.7K↓ —
hex-ci-integration
jeremylongshore/tons-of-skills-marketplace
TestingUpdated 11 hours ago
From the author
Configure Hex CI/CD integration with GitHub Actions and testing. Use when setting up automated testing, configuring CI pipelines, or integrating Hex tests into your build process. Trigger with phrases like "hex CI", "hex GitHub Actions", "hex automated tests", "CI hex".
Install
npx skills add jeremylongshore/tons-of-skills-marketplace --skill hex-ci-integration -a claude-code
Installs to .claude/skills/hex-ci-integration/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md