Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 4 hours ago
48,622 skills
- apply-aestheticplugin87/ux-ui-agent-skillsApply a visual direction, an archetype (high-end agency, editorial minimal, brutalist, soft-SaaS, dark-tech) or one of 2,144 named design systems (apple, linear-app, stripe, vercel, notion, material, shadcn, spotify, tesla…), by resolving it into the token system. Use when the user wants a specific look/vibe/brand feel, or asks to make a design feel premium/expensive/non-generic.DesignNo warnings★ 3.1K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10.2K↓ —
- clari-debug-bundlejeremylongshore/tons-of-skills-marketplaceAnalyze a Clari incident and collect a minimal support bundle with job timelines, contract fingerprints, and secret-safe evidence. Use when escalating a provider or pipeline failure. Trigger with: "collect Clari diagnostics", "build a Clari support bundle", "redact a Clari incident".EngineeringNo warnings★ 2.9K↓ —
- fit-scoreraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "score this influencer", "rank these creators for our campaign", or "tell me which influencer is the best fit"; produces the typed STAR Suitability (S) read plus a separately labeled campaign-fit ranking without mixing campaign-specific commercial fit into the Suitability read. Not for finding new influencers — use influencer-discovery; not for sending outreach — use outreach-manager. 达人适配度评分/创作者筛选排名MarketingNo warnings★ 3K↓ —
- submission-checklistforyourhealth111-pixel/Vibe-SkillsStage-based submission checklists for papers/reports: pre-submission, submission, revision/rebuttal, camera-ready. Includes templates (cover letter, rebuttal matrix) and quality gates.OtherNo warnings★ 3.8K↓ —
- pr-improvertrailofbits/skillsRuns an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolkit's review-pr). Use to fix review findings on a branch before opening or updating a pull request ('clean up this branch', 'fix this PR until review passes', 'run review-and-fix on my changes'). NOT for a one-time review — run the PR-review skill directly.EngineeringNo warnings★ 7.9K↓ —
- j-rigjeremylongshore/tons-of-skills-marketplaceInspect and use the J-Rig refiner CLI to bootstrap evaluation metadata, score a skill with an authorized provider, propose edits and inspect stored candidates. Use when improving an existing SKILL.md with evaluation evidence. Trigger with "refine this skill", "bootstrap an eval set" or "skill refiner status".WritingNo warnings★ 2.9K↓ —
- dev-browsercode-yeongyu/oh-my-openagentBrowser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website", "log into", or any browser interaction request.BrowserNo warnings★ 70.6K↓ —
- figmaheygen-com/hyperframesBring Figma into a HyperFrames video - rendered assets, brand tokens, components, storyboard frames as reconstructed motion (frames read as states, not slides), shaders and connector-assisted motion. Use when the person pastes a figma.com link or asks to use a Figma design, frame, logo or brand.OfficialDesignNo warnings★ 76.9K↓ —
- attio-install-authjeremylongshore/tons-of-skills-marketplaceChoose and configure Attio REST authentication for a single workspace or multi-workspace OAuth app, including least-privilege scopes and a read-only verification. Use when connecting a service to Attio. Trigger with "Attio auth", "Attio API key", or "Attio OAuth setup".EngineeringNo warnings★ 2.9K↓ —
- wiki-narrateAr9av/obsidian-wikiTurn a wiki topic into a cited Markdown briefing, plain-language explanation, or progressive lecture. Use this skill for topic-based briefing, explanation, and lecture requests that must stay within the evidence compiled in an Obsidian vault.ProductivityNo warnings★ 3.6K↓ —
- attio-debug-bundlejeremylongshore/tons-of-skills-marketplaceAssemble a minimal redacted Attio diagnostic bundle with request fingerprints, schema context, retry evidence, and environment metadata. Use when escalating an Attio integration failure without leaking CRM data or secrets. Trigger with "Attio debug bundle", "Attio support evidence", or "collect Attio diagnostics".EngineeringNo warnings★ 2.9K↓ —
- apollo-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Apollo.io rate limiting and backoff. Use when handling rate limits, implementing retry logic, or optimizing API request throughput. Trigger with phrases like "apollo rate limit", "apollo 429", "apollo throttling", "apollo backoff", "apollo request limits".EngineeringNo warnings★ 2.9K↓ —
- adobe-install-authjeremylongshore/tons-of-skills-marketplaceSelect and prove the correct Adobe authentication model, entitlement, product profile, and secret lifecycle before integration work. Use when creating or repairing Adobe credentials. Trigger with "set up Adobe auth", "Adobe OAuth server-to-server", or "Adobe user authentication".OtherNo warnings★ 2.9K↓ —
- jetson-init-sourceNVIDIA/skillsSet up the BSP source workspace: Linux_for_Tegra overlay tracker, bsp_sources, Crosstool-NG toolchain. Use after jetson-init-image; not for fetching inputs.MediaNo warnings★ 3.8K↓ —
- pre-publish-reviewcode-yeongyu/oh-my-openagentNuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release synthesis. Runs ONLY when the user explicitly asks for a pre-publish review — a plain publish/release request MUST NOT trigger this; /publish ships directly. Triggers: 'pre-publish review', 'review before publish', 'release review', 'pre-release review', 'ready to publish?', 'can I publish?', 'pre-publish', 'safe to publish', 'publishing review', 'pre-publish check'.EngineeringNo warnings★ 70.6K↓ —Also in 1 other repo
- offensive-fuzzingSnailSploit/Claude-RedPractical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.WritingNo warnings★ 10.2K↓ —
- in-your-own-wordsbacknotprop/pstackRestate in your own words what you think the user's goals are and what problem they're trying to solve. Use for /in-your-own-words.OtherNo warnings★ 3.3K↓ —
- paperclippaperclipai/paperclipInteract with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.PlanningNo warnings★ 109.7K↓ —
- clerk-androidclerk/skillsImplement Clerk authentication for native Android apps using Kotlin and Jetpack Compose with clerk-android source-guided patterns. Use for prebuilt AuthView/UserButton or custom API-driven auth flows. Do not use for Expo or React Native projects.OfficialEngineeringNo warnings★ 89↓ —
- principle-experience-firstbacknotprop/pstackApply when product, UX, or feature-scope tradeoffs come up. Choose user delight over implementation convenience; ship fewer polished features over more rough ones.DesignNo warnings★ 3.3K↓ —Also in 3 other repos
- reflectbacknotprop/pstackSpawn three parallel review subagents over the active transcript, surface learnings, and route each to a concrete edit on an existing skill. Use when the user says reflect.WritingNo warnings★ 3.3K↓ —
- website-generatorjeremylongshore/tons-of-skills-marketplaceUse when the user asks to create a website, build a site, generate a landing page, or mentions B12. Trigger phrases: "create a website", "build me a site", "website for my business", "generate a landing page", "B12 website". Trigger with 'website', 'generator'.DesignNo warnings★ 2.9K↓ —
- recallbacknotprop/pstackReconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents), then hand back a tight current-state brief. Use for 'recall my work on X', 'catch me up', 'what have I been working on', 'where did I leave off', before starting or resuming work.ProductivityNo warnings★ 3.3K↓ —
audit-augmentation
trailofbits/skills
EngineeringUpdated 4 days ago
From the author
Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.
Install
npx skills add trailofbits/skills --skill audit-augmentation -a claude-code
Installs to .claude/skills/audit-augmentation/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (4)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/formats.md