Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 17 hours ago
45,010 skills
- offensive-deauth-disassocSnailSploit/Claude-RedDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.TestingNo warnings★ 9.8K↓ —
- adobe-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement service-specific Adobe admission control, Retry-After handling, bounded retries, and spend-aware queues. Use when scaling workloads or handling 429 responses. Trigger with "Adobe rate limit", "Adobe 429", or "Adobe backoff".PlanningNo warnings★ 2.9K↓ —
- reddit-automationdavepoon/buildwithclaudeAutomate Reddit tasks via Rube MCP (Composio): search subreddits, create posts, manage comments, and browse top content. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 9.8K↓ —
- szamlazz-invoicingdavepoon/buildwithclaudeIssue, cancel, and fetch Hungarian invoices via the szamlazz.hu Agent API. Handles VAT calculation, NAV taxpayer lookup, partner caching, and PDF generation. Use when the user mentions számla, számlázás, invoice, sztornó, díjbekérő, proforma, or wants to bill a customer.DocumentsNo warnings★ 3.7K↓ —
- offensive-wpa2-pskSnailSploit/Claude-RedWPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.MarketingNo warnings★ 9.8K↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 9.8K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 9.8K↓ —
- doca-rdmaUpdatedNVIDIA/skillsRDMA data movement on NVIDIA BlueField/ConnectX NICs (RoCE/InfiniBand) with DOCA RDMA, instead of hand-written libibverbs/rdma_cm. Use when the user moves data between processes or hosts over the NIC, or hits "one-sided read returns permission denied", "completions never arrive after submit", "connection callback never fires", atomic compare-and-swap over RoCE, or DOCA_ERROR_FULL on the send queue under burst, even without naming DOCA RDMA. Covers bringing up an RDMA context on a doca_dev, connection methods (RDMA CM, bridge/OOB, or gRPC exchange of doca_rdma_export()), the eleven task types (Send/Receive/Send-Imm, Read/Write/Write-Imm, Atomic CmpSwap/FetchAdd, Get/Set/Add Remote Sync Event), matching mmap + RDMA permissions, queue and connection sizing, doca_rdma_cap_* queries, and DOCA_ERROR_* from RDMA calls. Raw QP/verbs control belongs to doca-verbs. Refuse and route elsewhere for general RDMA / ibverbs theory (queue pairs, MRs, RoCE vs IB), installing DOCA itself, or non-RDMA DOCA libraries.WritingNo warnings★ 3.8K↓ —
- doca-telemetry-utilsUpdatedNVIDIA/skillsdoca_telemetry_utils command line on a host with DOCA: discover the diagnostic-counter schema, translate counter names to binary Data IDs and back, and check per-device counter support before committing a DOCA Telemetry exporter config. Use this skill when telemetry counters vanish between the exporter and the collector: "my exporter ships but the collector sees nothing", "this metric silently drops downstream", "which counters does this BlueField expose", "translate this 0x... back to a counter name", "what do node / pcie_index / depth mean here", or "is this counter supported on this device", even without naming the tool. Route exporter or collector code to doca-telemetry-exporter / doca-telemetry, DTS deployment to doca-dts, and DOCA install or repair to doca-setup.DevOpsNo warnings★ 3.8K↓ —
- outlook-automationdavepoon/buildwithclaudeAutomate Outlook tasks via Rube MCP (Composio): emails, calendar, contacts, folders, attachments. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- offensive-wpsSnailSploit/Claude-RedWPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.SecurityNo warnings★ 9.8K↓ —
- pr-improvertrailofbits/skillsRuns an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolkit's review-pr). Use to fix review findings on a branch before opening or updating a pull request ('clean up this branch', 'fix this PR until review passes', 'run review-and-fix on my changes'). NOT for a one-time review — run the PR-review skill directly.EngineeringNo warnings★ 7.9K↓ —
- server-actionsdavepoon/buildwithclaudeThis skill should be used when the user asks about "Server Actions", "form handling in Next.js", "mutations", "useFormState", "useFormStatus", "revalidatePath", "revalidateTag", or needs guidance on data mutations and form submissions in Next.js App Router.OtherNo warnings★ 3.7K↓ —
- scientific-reportingforyourhealth111-pixel/Vibe-SkillsWrite research/technical reports with strong structure + figure standards. Supports Markdown/HTML/PDF outputs (Quarto optional), executive summary, methods, results, discussion, and reproducibility appendix.ScienceNo warnings★ 3.8K↓ —
- holoscan-install-wheelNVIDIA/skillsInstall Holoscan SDK 5.x CUDA 13 Python wheels in an isolated environment, choosing the full stack or version-matched components.EngineeringNo warnings★ 3.8K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserNo warnings★ 7.9K↓ —
- serply-web-searchdavepoon/buildwithclaudeSearch Google, Bing, Google News and Google Scholar, and read public pages, through the Serply MCP server. Use when you need current information beyond training data, recent news coverage, or academic papers, with source URLs. Remote server at https://api.serply.io/mcp with an API key from https://serply.io sent in the X-Api-Key header.EngineeringNo warnings★ 3.7K↓ —
- sentry-automationdavepoon/buildwithclaudeAutomate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- ulw-loopcode-yeongyu/oh-my-openagentA goal-like loop that decomposes work into systematic, evidence-bound ultrawork steps. Use when the user wants a goal loop or durable, checkpointed execution.OtherNo warnings★ 70.5K↓ —
- mbse-requirementsNewdavepoon/buildwithclaudeAuthor, review, and repair system requirements to aerospace and defense practice. Use when writing or fixing requirements, applying EARS patterns, assigning requirement IDs, setting priority or verification method, splitting compound requirements, removing ambiguity, or reviewing a requirements document for quality. Triggers on requirement, shall statement, EARS, spec review, acceptance criteria, requirements quality, ReqIF.PlanningNo warnings★ 3.7K↓ —
- verify-paperclippaperclipai/paperclipVerify Paperclip from a source checkout, published npm install, or existing staging or production stack. Select the environment, data state, version, and platform; drive real UI or CLI journeys and capture evidence. Route deployment to the private Cloud skills.DevOpsNo warnings★ 108.5K↓ —
- paperclippaperclipai/paperclipInteract with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.PlanningNo warnings★ 108.5K↓ —
finta-cost-tuning
jeremylongshore/tons-of-skills-marketplace
PlanningUpdated yesterday
From the author
Optimize Finta plan selection and feature usage. Trigger with phrases like "finta cost", "finta pricing", "finta plan selection".
Install
npx skills add jeremylongshore/tons-of-skills-marketplace --skill finta-cost-tuning -a claude-code
Installs to .claude/skills/finta-cost-tuning/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md