Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 4 hours ago
48,622 skills
- brand-strategyjeremylongshore/tons-of-skills-marketplaceBuild or review a seven-part brand strategy covering identity, audience, positioning, messaging, visual principles, channels and measurement. Use when creating a brand brief, defining positioning or revising brand messaging. Trigger with "create brand strategy", "build brand brief" or "brand messaging".EngineeringNo warnings★ 2.9K↓ —
- gsd:notedavepoon/buildwithclaudeZero-friction idea capture. Append, list, or promote notes to todos.ProductivityNo warnings★ 3.7K↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 10.2K↓ —
- sprint-workflowjeremylongshore/tons-of-skills-marketplaceExecute this skill should be used when the user asks about "how sprints work", "sprint phases", "iteration workflow", "convergent development", "sprint lifecycle", "when to use sprints", or wants to understand the sprint execution model and its convergent diffusion approach. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 10.2K↓ —
- exa-rate-limitsjeremylongshore/tons-of-skills-marketplaceBudget Exa throughput per endpoint and distinguish caller rate limiting from vendor overload and billing exhaustion. Use when operating or reviewing this Exa boundary. Trigger with "Exa rate limits", "review Exa rate limits", or "fix Exa rate limits".EngineeringNo warnings★ 2.9K↓ —
- stop-that-shitlennney/stop-that-shitComplete requested work while preventing speculative defenses and scope creep. Use when considering extra hardening, reviewing possible overengineering, resolving repeated verification loops, following explicit task boundaries, or when the user invokes Stop That Shit. Ordinary use of validation, retries, or dependencies alone is not a trigger.PlanningNo warnings★ 3.5K↓ —Also in 1 other repo
- neon-object-storageneondatabase/agent-skillsS3-compatible object storage that branches with your database, so each branch gets its own copy of the files and the rows that point at them. Use when a user wants object storage, a bucket, blob/file storage, or somewhere to put uploads, images, documents, avatars, or user-generated files for their app or agent — especially when they already use (or are setting up) Lakebase Postgres and don't want to add a separate storage provider like AWS S3, Cloudflare R2, or Supabase Storage. Triggers include "object storage", "bucket", "blob storage", "file storage", "store uploads/images/files", "S3-compatible storage", "presigned URL", "where do I put files", "storage logs", "bucket logs", "CDN in front of object storage", "Neon Object Storage", "Neon Storage", and "storage that branches with my database".OfficialDevOpsNo warnings★ 108↓ —Also in 1 other repo
- version-bumperjeremylongshore/tons-of-skills-marketplaceExecute automatically handles semantic version updates across plugin.json and marketplace catalog when user mentions version bump, update version, or release. ensures version consistency in AI assistant-code-plugins repository. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.EngineeringNo warnings★ 2.9K↓ —
- security-researchcode-yeongyu/oh-my-openagentTeam Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.SecurityNo warnings★ 70.6K↓ —
- golang-how-tosamber/cc-skills-golangGolang skills orchestrator — always active on any Golang coding, review, debug, or setup task. Reads the task context and loads the most relevant skills from samber/cc-skills-golang, often multiple at once: writing a gRPC service loads golang-grpc + golang-testing + golang-error-handling; debugging a panic loads golang-troubleshooting + golang-safety; auditing security loads golang-security + golang-lint + golang-safety. Also: disambiguates competing clusters when two skills seem to overlap (performance vs benchmark vs troubleshooting, samber/lo vs mo vs ro, DI cluster, safety vs security), and configures the project's agent-config file (CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, or Copilot instructions) to force-trigger skills in a project (/golang-how-to configure).SecurityNo warnings★ 3.7K↓ —
- gsd:dodavepoon/buildwithclaudeRoute freeform text to the right GSD command automaticallyOtherNo warnings★ 3.7K↓ —
- gsd:healthdavepoon/buildwithclaudeDiagnose planning directory health and optionally repair issuesPlanningNo warnings★ 3.7K↓ —
- gsd:pause-workdavepoon/buildwithclaudeCreate context handoff when pausing work mid-phaseProductivityNo warnings★ 3.7K↓ —
- principle-foundational-thinkingmichael-denyer/pstack-claudeApply before writing logic: choosing core types and data structures, sequencing scaffold-vs-feature work, asking what concurrent actors share. Get the data structures right so downstream code becomes obvious.WritingNo warnings★ 3.7K↓ —
- principle-never-block-on-the-humanmichael-denyer/pstack-claudeApply when tempted to ask 'should I do X?' on reversible work.OtherNo warnings★ 3.7K↓ —
- wiki-digestAr9av/obsidian-wikiProduce a day/week/month knowledge digest summarizing what was learned, updated, and connected in the wiki. Use for readable recent-learning summaries; wiki-status reports source and ingestion state instead.ProductivityNo warnings★ 3.6K↓ —
- principle-type-system-disciplinemichael-denyer/pstack-claudeApply when designing types, reviewing a function signature, or writing code in any statically-typed language. Make illegal states unrepresentable, brand semantic primitives, parse external data at boundaries, exhaust variants, derive from authoritative schemas.WritingNo warnings★ 3.7K↓ —
- second-opiniontrailofbits/skillsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.EngineeringNo warnings★ 7.9K↓ —
- publishcode-yeongyu/oh-my-openagentPublish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. Ship-only: never runs pre-publish-review or re-reviews merged code unless the user explicitly asks. Argument: <patch|minor|major|explicit-semver>. Triggers: publish, release, deploy, npm publish.DevOpsNo warnings★ 70.6K↓ —
- navan-hello-worldjeremylongshore/tons-of-skills-marketplaceProve one contracted Navan integration can authenticate and return a bounded read-only response without inventing a universal API. Use when completing access intake. Trigger with "test Navan access", "first Navan read", or "Navan connectivity proof".TestingNo warnings★ 2.9K↓ —
- agent-patternsjeremylongshore/tons-of-skills-marketplaceExecute this skill should be used when the user asks about "SPAWN REQUEST format", "agent reports", "agent coordination", "parallel agents", "report format", "agent communication", or needs to understand how agents coordinate within the sprint system. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- ramp-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a small typed Ramp Developer API adapter with secure token management, pagination, structured errors, rate control, idempotency, and schema drift checks. Use when replacing scattered raw requests in application code. Trigger with "Ramp API client" or "Ramp SDK patterns".EngineeringNo warnings★ 2.9K↓ —
- principle-subtract-before-you-addmichael-denyer/pstack-claudeApply when sequencing an addition, refactor, or rewrite. Remove dead code, redundant validators, and stub references first, then build on the simpler base.EngineeringNo warnings★ 3.7K↓ —
i4h-workflow-validate
NVIDIA/skills
ProductivityUpdated 2 days ago
From the author
Run the root-level workflow runtime policy or rule-based rollouts and verify simulator success. Use for evaluation, checkpoints, or local controllers; do not use for replay or dataset annotation.
Install
npx skills add NVIDIA/skills --skill i4h-workflow-validate -a claude-code
Installs to .claude/skills/i4h-workflow-validate/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (5)
- BENCHMARK.md
- SKILL.md
- evals/evals.json
- skill-card.md
- skill.oms.sig