Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,395 skills from 2,375 repositories · updated 20 minutes ago
49,393 skills
- nemoclaw-user-guideNVIDIA/skillsGuides human users' AI agents to the NemoClaw docs MCP server and canonical Fern documentation in Markdown form. Use when users ask how to install, configure, operate, troubleshoot, secure, or learn NemoClaw with an AI coding assistant. Trigger keywords - nemoclaw docs, use nemoclaw with ai agent, nemoclaw mcp docs, nemoclaw install help, nemoclaw quickstart, nemoclaw markdown docs, llms.txt, agent skills.EngineeringNo warnings★ 3.8K↓ —
- lindy-rate-limitsjeremylongshore/tons-of-skills-marketplaceManage Lindy AI credits, rate limits, and usage optimization. Use when hitting rate limits, optimizing credit consumption, or implementing usage controls. Trigger with phrases like "lindy rate limit", "lindy credits", "lindy quota", "lindy throttling", "lindy API limits".EngineeringNo warnings★ 2.9K↓ —
- pathmlforyourhealth111-pixel/Vibe-SkillsComputational pathology toolkit for analyzing whole-slide images (WSI) and multiparametric imaging data. Use this skill when working with histopathology slides, H&E stained images, multiplex immunofluorescence (CODEX, Vectra), spatial proteomics, nucleus detection/segmentation, tissue graph construction, or training ML models on pathology data. Supports 160+ slide formats including Aperio SVS, NDPI, DICOM, OME-TIFF for digital pathology workflows.DocumentsNo warnings★ 3.8K↓ —
- hypothesis-testerjeremylongshore/tons-of-skills-marketplaceStructured hypothesis formulation, experiment design, and results interpretation for Product Managers. Use when the user needs to validate an assumption, design an A/B test, or evaluate results. Trigger with "hypothesis", "A/B test", "experiment", "validate assumption", "test this", or "should we ship".TestingNo warnings★ 2.9K↓ —
- pptx-html-fidelity-auditnexu-io/open-designAudit a python-pptx export against its source HTML deck, identify layout/content drift (footer overflow, cropped content, missing italic/em, lost styling, off-rhythm spacing), and re-export with strict footer-rail + cursor-flow layout discipline. Use this skill whenever the user has a .pptx that was generated from an HTML slide deck and asks to compare/audit/verify/fix the export — including phrases like "compare ppt with html", "fidelity audit", "fix the pptx", "ppt is cut off", "footer overlap", "italic missing in pptx", "re-export the deck", "pptx-html-fidelity-audit", or any case where a python-pptx → HTML round-trip needs verification or repair. Also trigger when the user shows you a deck.html and a deck.pptx side by side and is debugging visual differences.DocumentsNo warnings★ 105.7K↓ —
- recalldavepoon/buildwithclaudeSearch Origin's local memory by query. Targeted lookup, not orientation. Invoked as `/recall <query>`. Use when the user asks "do you remember", "what do you know about", "look up".ProductivityNo warnings★ 3.7K↓ —
- genotoxictrailofbits/skillsGraph-informed mutation testing triage. Parses codebases with Trailmark, runs mutation testing and necessist, then uses survived mutants, unnecessary test statements, and call graph data to identify false positives, missing test coverage, and fuzzing targets. Use when triaging survived mutants, analyzing mutation testing results, identifying test gaps, finding fuzzing targets from weak tests, running mutation frameworks (including circomvent and cairo-mutants), or using necessist.TestingNo warnings★ 8K↓ —
- review-workcode-yeongyu/oh-my-openagentPost-implementation gate review: run manual QA on the real surface yourself, then launch ONE gate reviewer (never a panel) to audit goal, constraints, code quality, security, missed context, and QA evidence. Use before a PR handoff or when the user explicitly asks to review completed work.EngineeringNo warnings★ 70.7K↓ —
- trailmarktrailofbits/skillsBuilds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.SecurityNo warnings★ 8K↓ —
- runway-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate, observe, and preserve one approved Runway text-to-video task using the current per-model contract. Use when proving the first billable generation path. Trigger with: "Runway hello world", "first Runway video", "smoke test Runway generation".TestingNo warnings★ 2.9K↓ —
- audit-prep-assistanttrailofbits/skillsPrepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments). Use when preparing your own codebase to be audited by someone else, getting a repository review-ready before an external security review, deciding what to fix before auditors start, or asking what assessors need from a project. For understanding unfamiliar code you are about to audit, use audit-context-building instead.SecurityNo warnings★ 8K↓ —
- flyio-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement Fly.io Machines API pacing, per-resource serialization, retry, and reconciliation from the documented action limits. Use when automating Machine or app operations. Trigger with: "handle Fly 429", "throttle Machines API", "batch Fly Machine updates".EngineeringNo warnings★ 2.9K↓ —
- docs-writeforyourhealth111-pixel/Vibe-SkillsWrite documentation following Metabase's conversational, clear, and user-focused style. Use when creating or editing documentation files (markdown, MDX, etc.).WritingNo warnings★ 3.8K↓ —Also in 1 other repo
- g-assist-mcp-skillNVIDIA/skillsUse this skill to check or change this machine's NVIDIA display and GPU settings, such as resolution, refresh rate, V-Sync, G-SYNC, brightness, color, and GPU performance.OtherNo warnings★ 3.8K↓ —
- flyio-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze Fly.io Machine, volume, network, IP, and Managed Postgres cost drivers without freezing volatile prices. Use when reducing spend or forecasting capacity. Trigger with: "audit Fly bill", "right-size Fly Machines", "reduce Fly idle cost".DataNo warnings★ 2.9K↓ —
- whymichael-denyer/pstack-claudeUse for 'why does X work this way', 'why we picked Y', design rationale, regressions, postmortems, or data-backed thresholds. Discovers available MCPs and queries each evidence category (source control, issue tracker, long-form docs, real-time chat, infrastructure observability, error tracking, product analytics warehouse) in parallel, then returns a cited read on decisions and tradeoffs. Use how for runtime behavior.DevOpsNo warnings★ 3.9K↓ —
- forgetdavepoon/buildwithclaudeDelete a memory from Origin by ID. Destructive and cannot be undone — prefer `/capture` with `supersedes` for corrections. Invoked as `/forget <source_id>`.ProductivityNo warnings★ 3.7K↓ —
- constant-time-testingtrailofbits/skillsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.TestingNo warnings★ 8K↓ —
- property-based-testingtrailofbits/skillsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.TestingNo warnings★ 8K↓ —
- notion-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement adaptive Notion request throttling and bounded retry behavior from observed responses. Use when handling 429s, queue pressure, or bursty workloads. Trigger with "handle Notion rate limits", "throttle Notion requests", or "fix Notion 429".ProductivityNo warnings★ 2.9K↓ —
- finta-hello-worldjeremylongshore/tons-of-skills-marketplaceSet up your first fundraise pipeline in Finta with investors and deal stages. Use when starting a new fundraise, importing investor lists, or learning Finta's pipeline management features. Trigger with phrases like "finta hello world", "finta first pipeline", "start fundraise in finta", "finta quick start".FinanceNo warnings★ 2.9K↓ —
- offensive-data-exfiltrationSnailSploit/Claude-RedDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitationDevOpsNo warnings★ 10.3K↓ —
- nemo-fabric-integrateUpdatedNVIDIA/skillsUse this skill when integrating NVIDIA NeMo Fabric into a consumer application, service, evaluation harness, or platform through the typed Python SDK — translating the consumer's own application, job, or deployment config into an in-memory FabricConfig, choosing the single-invocation convenience API or an explicitly started runtime, validating with plan and doctor, and consuming normalized results, artifacts, and telemetry.DevOpsNo warnings★ 3.8K↓ —
- prompt-improverjeremylongshore/tons-of-skills-marketplaceAnalyze and improve plugin prompts, skill definitions, and command instructions for clarity, safety, and effectiveness. Use when the user asks to "improve a prompt", "review a skill", "enhance instructions", "make this prompt better", "optimize this command", or "audit prompt quality".EngineeringNo warnings★ 2.9K↓ —
ossfuzz
trailofbits/skills
TestingUpdated 21 hours ago
From the author
Enrolls a project in OSS-Fuzz, Google's free continuous fuzzing service for open source, and drives it locally. Covers project.yaml, Dockerfile and build.sh setup, the helper scripts, reproducing OSS-Fuzz crash reports, and the acceptance criteria. Use when setting up continuous fuzzing for an open-source project, reproducing an OSS-Fuzz bug report, or testing an OSS-Fuzz build before submitting it.
Install
npx skills add trailofbits/skills --skill ossfuzz -a claude-code
Installs to .claude/skills/ossfuzz/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg