Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 4 hours ago
48,622 skills
- briefdavepoon/buildwithclaudeSession-start briefing from Origin. Reads the project status file (the /handoff-maintained ledger of Active/Backlog work), then loads identity, preferences, and topic-relevant memories so the agent walks in with context. Surfaces any memories the daemon has flagged for human revision before the session uses them. Invoked as `/brief [topic]`. Call FIRST at session start, before any other Origin verb.ProductivityNo warnings★ 3.7K↓ —
- rag-perfNVIDIA/skillsPerformance benchmarking for a deployed NVIDIA RAG Blueprint server: profiling pass + aiperf load test driven by a single YAML config. Not for accuracy / RAGAS scoring (use rag-eval) or for deploying / repairing services (use rag-blueprint).TestingNo warnings★ 3.8K↓ —
- validate-skillmdjeremylongshore/tons-of-skills-marketplaceValidate and grade SKILL.md files with the marketplace rubric, static production checks, and optional J-Rig behavioral evidence. Use when creating a skill, checking quality, preparing a marketplace submission, or reviewing evaluation results. Trigger with "validate this skill", "grade my skill", "deep eval", "check SKILL.md", or "/validate-skillmd".OtherNo warnings★ 2.9K↓ —
- atheristrailofbits/skillsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.EngineeringNo warnings★ 7.9K↓ —
- principle-outcome-oriented-executionmichael-denyer/pstack-claudeApply during planned rewrites and migrations with explicit phase boundaries. Converge on the target architecture; don't preserve smooth intermediate states with throwaway compatibility code.PlanningNo warnings★ 3.7K↓ —
- task-observerrebelytics/one-skill-to-rule-them-allMonitors task execution for skill improvement opportunities: logs patterns, user corrections and methodology worth preserving to the workspace, turns them into skill updates in a weekly review, and flags repeating work as new skills. Use during ANY multi-step task, agentic workflow, or work session. Also triggers in post-task feedback discussions and when the user mentions skill observations, the observation log, or skill taxonomy. Also known as "One Skill to Rule Them All" — trigger on this phrase too. IMPORTANT: invoke this skill before the FIRST tool call of any session and before writing or proposing a plan — any turn that will involve a tool call counts. This sentence is the session-start trigger and the only activation layer that survives an unreachable config file; pair it with a CLAUDE.md instruction or a session-start hook (references/environments.md). A subagent dispatched by a session already running it does not run it: it writes nothing and puts its findings in its report.ProductivityNo warnings★ 3.7K↓ —
- hex-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure Hex SDK/CLI authentication. Use when setting up a new Hex integration, configuring API keys, or initializing Hex in your project. Trigger with phrases like "install hex", "setup hex", "hex auth", "configure hex API key".EngineeringNo warnings★ 2.9K↓ —
- maintain-formal-verification-skillmichael-denyer/pstack-claudeBring a project's formal verification back in line with the code after the code changes: find the commits that touched verified code, update the model, harness, or properties to describe the code as it is now, rerun, and say whether each failure is drift in the verification or a bug in the code. Use for /maintain-formal-verification-skill, "is the model still true to the code", or after merges and refactors that touched verified code without rechecking it.EngineeringNo warnings★ 3.7K↓ —
- exa-install-authjeremylongshore/tons-of-skills-marketplaceConfigure an Exa client without leaking credentials or mixing API-key, MCP OAuth, enterprise managed authorization, and payment-protocol trust models. Use when operating or reviewing this Exa boundary. Trigger with "Exa install auth", "review Exa install auth", or "fix Exa install auth".EngineeringNo warnings★ 2.9K↓ —
- doca-urom-svcNVIDIA/skillsOperate the DOCA UROM Service container on BlueField Arm for remote memory operations (puts, gets, atomics, collectives) enqueued by a paired host using `doca-urom`: pull the NGC image, choose the UCX component, size queues, configure Comch pairing, and align host and service versions. SECURITY: the service has no standalone access control; Comch pairing and RDMA permissions are the boundary. Pair only intended hosts, expose least-privilege memory regions, and verify both views before start. Trigger for slow UCX collectives, unexpected NOT_PERMITTED, or missing completions. Do not use for host application code, MPI/UCX integration design, or DOCA install.SecurityNo warnings★ 3.8K↓ —
- route-handlersdavepoon/buildwithclaudeThis skill should be used when the user asks to "create an API route", "add an endpoint", "build a REST API", "handle POST requests", "create route handlers", "stream responses", or needs guidance on Next.js API development in the App Router.EngineeringNo warnings★ 3.7K↓ —
- clade-load-scalejeremylongshore/tons-of-skills-marketplaceScale Claude usage for high-throughput applications — batches, queues, Use when working with load-scale patterns. concurrency control, and tier upgrades. Trigger with "anthropic scale", "claude high volume", "anthropic throughput", "scale claude api", "anthropic concurrent requests".EngineeringNo warnings★ 2.9K↓ —
- sympyforyourhealth111-pixel/Vibe-SkillsUse this skill when working with symbolic mathematics in Python. This skill should be used for symbolic computation tasks including solving equations algebraically, performing calculus operations (derivatives, integrals, limits), manipulating algebraic expressions, working with matrices symbolically, physics calculations, number theory problems, geometry computations, and generating executable code from mathematical expressions. Apply this skill when the user needs exact symbolic results rather than numerical approximations, or when working with mathematical formulas that contain variables and parameters.ScienceNo warnings★ 3.8K↓ —Also in 1 other repo
- hubspot-authjeremylongshore/tons-of-skills-marketplaceAuthenticate production HubSpot integrations and survive the auth-side failures — 30-min token expiry storms, 500K daily rate-limit burnout, scope drift, token leakage in commits, multi-portal credential routing, OAuth refresh-token decay. Use when hardening token caching, rotating private app credentials, building a multi-portal credential router, or recovering from 429/403 auth cascades. Trigger with "hubspot auth", "hubspot token cache", "hubspot rate limit", "hubspot scope drift", "hubspot multi-portal", "hubspot OAuth refresh".OtherNo warnings★ 2.9K↓ —
- get-unpublished-changescode-yeongyu/oh-my-openagentCompare HEAD with the latest published npm versions and list all unpublished changes by release layer. Triggers: unpublished changes, changelog, what changed, whats new.OtherNo warnings★ 70.6K↓ —
- offensive-wifi-reconSnailSploit/Claude-RedWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each.LegalNo warnings★ 10.2K↓ —
- gsd:audit-fixdavepoon/buildwithclaudeAutonomous audit-to-fix pipeline — find issues, classify, fix, test, commitTestingNo warnings★ 3.7K↓ —
- ops-projectsdavepoon/buildwithclaudePortfolio dashboard for all GSD-tracked projects. Scans ~/Projects and ~/gsd-workspaces for .planning/ directories, shows phase status, git state, blockers, and next actions for every project. Run /ops projects to see the full portfolio.PlanningNo warnings★ 3.7K↓ —
- sprint-workflowjeremylongshore/tons-of-skills-marketplaceExecute this skill should be used when the user asks about "how sprints work", "sprint phases", "iteration workflow", "convergent development", "sprint lifecycle", "when to use sprints", or wants to understand the sprint execution model and its convergent diffusion approach. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- exa-rate-limitsjeremylongshore/tons-of-skills-marketplaceBudget Exa throughput per endpoint and distinguish caller rate limiting from vendor overload and billing exhaustion. Use when operating or reviewing this Exa boundary. Trigger with "Exa rate limits", "review Exa rate limits", or "fix Exa rate limits".EngineeringNo warnings★ 2.9K↓ —
- jetson-print-bsp-infoNVIDIA/skillsUse when you need to print Jetson BSP info (L4T version, board configs, rootfs state) from a Linux_for_Tegra root on the host PC. This is an example skill.OtherNo warnings★ 3.8K↓ —
- readdavepoon/buildwithclaudePreview a distilled wiki page from inside Claude Code. Prints title, summary, source count, and the local md path. Full body lives on disk — open with the user's editor. Invoked as `/read <title_or_id>`.WritingNo warnings★ 3.7K↓ —
- doca-socket-relayNVIDIA/skillsUse this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint, walking the bind → connect → round-trip → admit-fleet smoke, or diagnosing a stuck/silent relay. Trigger even when the user does not explicitly mention "DOCA Socket Relay" — typical implicit phrasings include "move my socket app onto the BlueField without rewriting it", "host app gets ECONNREFUSED on the relay", "relay accepts the connection but bytes never arrive on the DPU side", "first round-trip works, the rest hang", "bridge an AF_UNIX (UDS) socket to a DPU peer over Comch", or "I want a sidecar that forwards my socket to the BlueField". Refuse and route elsewhere for the comch programming API, line-rate raw packet I/O via doca-eth, and DOCA install/bring-up — those belong to other skills.DevOpsNo warnings★ 3.8K↓ —
- doca-flow-tuneNVIDIA/skillsUse this skill when the user is tuning a live or captured `doca-flow` pipeline with `doca_flow_tune` — snapshotting pipe / counter / KPI state, picking a tuning axis (rule placement, resource hints / table sizing, HW-offload mode) and a matching measurement (rule-install rate, lookup latency, hardware-counter delta), running offline or online (read-only or state-changing) modes, reading the dumper CSV / analyze JSON / visualize mermaid, or applying a recommendation back into the Flow program. Trigger even when the user does not explicitly mention "doca_flow_tune" — typical implicit phrasings include "Flow rule-install rate is low on BlueField", "table sizing looks wrong for this pipe", "tune visualize step is empty", "before/after counters don't move", or "which doca-flow knob does this recommendation hit". Refuse and route elsewhere for writing the doca-flow application, DOCA install, or streaming Flow telemetry — those belong to other skills.DataNo warnings★ 3.8K↓ —
address-sanitizer
trailofbits/skills
TestingUpdated 4 days ago
From the author
Builds and runs code under AddressSanitizer to catch buffer overflows, use-after-free, and other memory errors during fuzzing or tests. Covers -fsanitize=address builds, ASAN_OPTIONS, reading the crash report, LeakSanitizer, and the overhead and platform trade-offs. Use when fuzzing C/C++ or Rust that has unsafe blocks or FFI, when debugging a memory corruption crash, or when reading an ASan stack trace.
Install
npx skills add trailofbits/skills --skill address-sanitizer -a claude-code
Installs to .claude/skills/address-sanitizer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg