Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 14 hours ago
45,010 skills
- umap-learnforyourhealth111-pixel/Vibe-SkillsUMAP dimensionality reduction. Fast nonlinear manifold learning for 2D/3D visualization, clustering preprocessing (HDBSCAN), supervised/parametric UMAP, for high-dimensional data.OtherNo warnings★ 3.8K↓ —Also in 1 other repo
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 9.8K↓ —
- server-actionsdavepoon/buildwithclaudeThis skill should be used when the user asks about "Server Actions", "form handling in Next.js", "mutations", "useFormState", "useFormStatus", "revalidatePath", "revalidateTag", or needs guidance on data mutations and form submissions in Next.js App Router.OtherNo warnings★ 3.7K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsNo warnings★ 9.8K↓ —
- keyword-researchnowork-studio/notfair-pluginDiscover, analyze, and prioritize keywords for SEO and GEO content strategies from a seed keyword or niche. Identifies high-value opportunities based on search volume, competition, intent, and business relevance. Generates topic clusters. For building a dated editorial calendar from your own Search Console data, use `content-planner` instead — this skill is seed-driven keyword discovery, not calendar scheduling. Use when asked to "find keywords", "keyword research", "keyword analysis", "search volume", "keyword difficulty", "content ideas from a seed", or any keyword discovery task.ScienceNo warnings★ 4.1K↓ —
- serply-web-searchdavepoon/buildwithclaudeSearch Google, Bing, Google News and Google Scholar, and read public pages, through the Serply MCP server. Use when you need current information beyond training data, recent news coverage, or academic papers, with source URLs. Remote server at https://api.serply.io/mcp with an API key from https://serply.io sent in the X-Api-Key header.EngineeringNo warnings★ 3.7K↓ —
- offensive-wpsSnailSploit/Claude-RedWPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.SecurityNo warnings★ 9.8K↓ —
- sentry-automationdavepoon/buildwithclaudeAutomate Sentry tasks via Rube MCP (Composio): manage issues/events, configure alerts, track releases, monitor projects and teams. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- anima-install-authjeremylongshore/tons-of-skills-marketplaceInstall the Anima SDK and configure authentication for Figma-to-code generation. Use when setting up design-to-code automation, configuring Figma token access, or initializing the @animaapp/anima-sdk for server-side code generation. Trigger with: "install anima", "setup anima", "anima auth", "anima figma token".DesignNo warnings★ 2.9K↓ —
- offensive-sstiSnailSploit/Claude-RedDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.TestingNo warnings★ 9.8K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserNo warnings★ 7.9K↓ —
- mbse-requirementsNewdavepoon/buildwithclaudeAuthor, review, and repair system requirements to aerospace and defense practice. Use when writing or fixing requirements, applying EARS patterns, assigning requirement IDs, setting priority or verification method, splitting compound requirements, removing ambiguity, or reviewing a requirements document for quality. Triggers on requirement, shall statement, EARS, spec review, acceptance criteria, requirements quality, ReqIF.PlanningNo warnings★ 3.7K↓ —
- paid-ads-optimizenowork-studio/notfair-pluginDiagnose wasted paid-ad spend, pacing, and allocation, then propose safe evidence-backed optimizations. Use for waste, negatives, budgets, bid changes, poor CPA or ROAS, underpacing, overspend, or scaling decisions.MarketingNo warnings★ 4.1K↓ —
- broken-link-checkernowork-studio/notfair-pluginScans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".BrowserNo warnings★ 4.1K↓ —
- card-quoteZJU-REAL/Easel生成适合微博、知乎、公众号或 X/Twitter 分享的 16:9 横版金句卡和数据卡。当用户说“做金句卡、语录卡、数据卡、横版分享卡”时使用。小红书竖版知识卡用 card-xiaohongshu，竖版营销海报用 poster-hero。OtherNo warnings★ 4.2K↓ —
- verify-paperclippaperclipai/paperclipVerify Paperclip from a source checkout, published npm install, or existing staging or production stack. Select the environment, data state, version, and platform; drive real UI or CLI journeys and capture evidence. Route deployment to the private Cloud skills.DevOpsNo warnings★ 108.5K↓ —
- paperclippaperclipai/paperclipInteract with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.PlanningNo warnings★ 108.5K↓ —
- jetson-init-targetNVIDIA/skillsAuthor a new Jetson target-platform profile (reference_devkit + optional custom_carrier) and update the active pointer. Use to create a target; not for switching existing profiles.OtherNo warnings★ 3.8K↓ —
- jetson-customize-pcieNVIDIA/skillsPer-controller PCIe enable / disable / lanes / link-speed for a Jetson Thor or Orin custom carrier via ODMDATA + kernel-DT overlay. Do NOT use for UPHY lane allocation or endpoint-mode bring-up.OtherNo warnings★ 3.8K↓ —
- paid-ads-redditnowork-studio/notfair-pluginAudit, diagnose, and safely operate connected Reddit Ads accounts through the NotFair MCP. Use for Reddit advertising, Reddit Ads performance, campaign or ad-group analysis, spend, conversions, targeting, audiences, pixels, budgets, bids, creative, campaign setup, or approved Reddit Ads changes.MarketingNo warnings★ 4.1K↓ —
- batch-processZJU-REAL/Easel批量处理：对一个目录里的一批图片/视频/音频统一套用同一操作——批量压缩、加水印、转格式、缩放、转比例、音量归一化等。当用户说 批量处理、批量压缩、批量加水印、批量转格式、一批图片/视频、给这个文件夹、全部转成、批量缩放、批量转竖版、整个目录 时使用。基于 shared/scripts/batch_process.py（委派 image_ops/video_ops/audio_ops）。与 image-editing/video-editing/audio-editing 区别：那些处理单文件，本 SKILL 批量套用到整个目录。MediaNo warnings★ 4.2K↓ —
- auto-subtitleZJU-REAL/Easel自动字幕 / 语音转字幕：把音频或视频里的语音识别成字幕文件（SRT/ASS/TXT/JSON），可选把字幕烧录进视频。当用户说自动字幕、语音转字幕、视频加字幕、上字幕、转录、听写、字幕文件、生成字幕、烧字幕时使用。OtherNo warnings★ 4.2K↓ —
- vulndavepoon/buildwithclaudeLook up a vulnerability by ID or list all vulnerabilities for a packageSecurityNo warnings★ 3.7K↓ —
visualize
code-yeongyu/oh-my-openagent
WritingUpdated 18 hours ago
From the author
Builds a self-contained HTML page (chart, table, diagram, dashboard) to show inline in a thread. Use before calling show_html_page, html_preview or html_render, or whenever an answer reads better as a page than as prose.
Install
npx skills add code-yeongyu/oh-my-openagent --skill visualize -a claude-code
Installs to .claude/skills/visualize/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (Custom or unclear) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: Custom or unclear
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance95
Maintenance100
Licence45
Adoption75
Files (1)
- SKILL.md