Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 8 hours ago
48,622 skills
- cairo-vulnerability-scannertrailofbits/skillsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.SecurityNo warnings★ 7.9K↓ —
- hyperframesheygen-com/hyperframesRead first to make, edit, animate or render any video with HyperFrames (HTML rendered to video), including launch films, explainers, music videos, charts, maps, vertical clips, title cards, captions and overlays. Holds the render contract, the work loop and what each kind of video needs.OfficialMediaNo warnings★ 76.9K↓ —
- schema-markup-generatornowork-studio/notfair-pluginGenerate JSON-LD structured data markup for rich results in Google Search. Supports FAQ, HowTo, Article, Product, LocalBusiness, and multi-type schemas. Validates against Google requirements and provides implementation guidance. Use when asked to "add schema markup", "generate structured data", "JSON-LD", "rich snippets", "FAQ schema", "product markup", "add structured data to my page", "how to get rich snippets", or any structured data task.WritingNo warnings★ 4.1K↓ —
- broken-link-checkernowork-studio/notfair-pluginScans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".BrowserNo warnings★ 4.1K↓ —
- nemo-fabric-integrateNVIDIA/skillsUse this skill when integrating NVIDIA NeMo Fabric into a consumer application, service, evaluation harness, or platform through the typed Python SDK — translating the consumer's own application, job, or deployment config into an in-memory FabricConfig, choosing the single-invocation convenience API or an explicitly started runtime, validating with plan and doctor, and consuming normalized results, artifacts, and telemetry.DevOpsNo warnings★ 3.8K↓ —
- jetson-video-capabilityNVIDIA/skillsUse when Jetson codec, profile, chroma, bit-depth, dimension, engine-count, or operational support must be reconciled from live APIs, authenticated NVIDIA samples, and NVIDIA documentation; also applies the content-DRM scope.MediaNo warnings★ 3.8K↓ —
- gsd:audit-fixdavepoon/buildwithclaudeAutonomous audit-to-fix pipeline — find issues, classify, fix, test, commitTestingNo warnings★ 3.7K↓ —
- paid-ads-creativenowork-studio/notfair-pluginCreate grounded paid-media creative concepts, copy angles, refresh hypotheses, and measurable test briefs across advertising platforms. Use for ad copy, creative briefs, UGC concepts, headlines, creative fatigue, asset ideas, or a creative refresh.MarketingNo warnings★ 4.1K↓ —
- paid-ads-optimizenowork-studio/notfair-pluginDiagnose wasted paid-ad spend, pacing, and allocation, then propose safe evidence-backed optimizations. Use for waste, negatives, budgets, bid changes, poor CPA or ROAS, underpacing, overspend, or scaling decisions.MarketingNo warnings★ 4.1K↓ —
- meta-ads-creativenowork-studio/notfair-pluginCreate evidence-based Meta ad creative briefs, copy angles, and testable asset concepts for Facebook and Instagram. Use when asked for Meta ad creative, Facebook ads copy, Instagram ad assets, UGC concepts, creative briefs, new ad concepts, or creative refreshes.MarketingNo warnings★ 4.1K↓ —
- keyword-researchnowork-studio/notfair-pluginDiscover, analyze, and prioritize keywords for SEO and GEO content strategies from a seed keyword or niche. Identifies high-value opportunities based on search volume, competition, intent, and business relevance. Generates topic clusters. For building a dated editorial calendar from your own Search Console data, use `content-planner` instead — this skill is seed-driven keyword discovery, not calendar scheduling. Use when asked to "find keywords", "keyword research", "keyword analysis", "search volume", "keyword difficulty", "content ideas from a seed", or any keyword discovery task.ScienceNo warnings★ 4.1K↓ —
- hubspot-authjeremylongshore/tons-of-skills-marketplaceAuthenticate production HubSpot integrations and survive the auth-side failures — 30-min token expiry storms, 500K daily rate-limit burnout, scope drift, token leakage in commits, multi-portal credential routing, OAuth refresh-token decay. Use when hardening token caching, rotating private app credentials, building a multi-portal credential router, or recovering from 429/403 auth cascades. Trigger with "hubspot auth", "hubspot token cache", "hubspot rate limit", "hubspot scope drift", "hubspot multi-portal", "hubspot OAuth refresh".OtherNo warnings★ 2.9K↓ —
- google-ads-auditnowork-studio/notfair-pluginGoogle Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run an audit before.MarketingNo warnings★ 4.1K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.9K↓ —
- paid-ads-reviewnowork-studio/notfair-pluginProduce a read-only, evidence-based paid-media performance review across connected platforms or supplied exports. Use for weekly or monthly reports, scorecards, performance, CPA, ROAS, CTR, spend trends, pacing, or conversion-tracking health.MarketingNo warnings★ 4.1K↓ —
- meta-ads-auditnowork-studio/notfair-pluginMeta Ads (Facebook + Instagram) account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my Meta ads", "audit my Facebook ads", "Meta ads audit", "set up my Meta ads", "onboard Meta", "Meta account overview", "how's my Meta account", "Meta health check", "what should I fix in my Facebook ads", or when the user is new to NotFair Meta and hasn't run an audit before.MarketingNo warnings★ 4.1K↓ —
- paid-ads-guidenowork-studio/notfair-pluginExplain NotFair's paid-ads skills, installation, platform boundaries, account connections, and current product capabilities. Use for questions about how NotFair works, what it supports, how to install or connect it, plans or limits, or paid-media troubleshooting that is not an account-performance request.MarketingNo warnings★ 4.1K↓ —
- semgrep-rule-creatortrailofbits/skillsCreates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.SecurityNo warnings★ 7.9K↓ —
- search-consolenowork-studio/notfair-pluginQuery and operate connected Google Search Console properties through NotFair MCP. Use for live GSC query or page performance, clicks, impressions, CTR, position, traffic changes, indexing status, URL inspection, sitemap reads or approved sitemap submission/removal, and Search Console MCP setup. Route full-site SEO audits to seo-analysis.MarketingNo warnings★ 4.1K↓ —
- cleanup-codejeremylongshore/tons-of-skills-marketplaceComprehensive codebase cleanup across 11 quality dimensions: dead code, duplication, weak types, circular deps, defensive cruft, legacy code, AI slop, type consolidation, security, performance, and async patterns. Analyzes code with confidence scoring and verifies changes with build/test gates. Use when codebase has accumulated tech debt, after major feature work, before releases, or when code quality metrics are declining. Trigger with "/cleanup-code-code", "clean up the codebase", "remove dead code", "fix code quality".EngineeringNo warnings★ 2.9K↓ —
- offensive-wifiSnailSploit/Claude-RedWireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X bypass, MAC randomization defeat, BLE/Zigbee/IEEE 802.15.4 sidebands, and Wi-Fi 6/6E/7 considerations. Use when scoping wireless pentest, war-driving an estate, or testing corporate wireless segmentation.SecurityNo warnings★ 10.2K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- firebase-ai-logic-basicsfirebase/agent-skillsIntegrates Firebase AI Logic (formerly Vertex AI for Firebase) into mobile and web apps (Android, iOS, Web, and Flutter) to call Gemini models from client code. Use when provisioning or initializing Firebase AI Logic, or adding Gemini features to an app: text generation, multimodal input, chat, streaming, structured output, hybrid on-device inference, App Check protection, or switching models with Remote Config.OfficialEngineeringNo warnings★ 497↓ —
- api-contractjeremylongshore/tons-of-skills-marketplaceConfigure this skill should be used when the user asks about "API contract", "api-contract.md", "shared interface", "TypeScript interfaces", "request response schemas", "endpoint design", or needs guidance on designing contracts that coordinate backend and frontend agents. Use when building or modifying API endpoints. Trigger with phrases like 'create API', 'design endpoint', or 'API scaffold'.LegalNo warnings★ 2.9K↓ —
trailmark-review-gate
trailofbits/skills
EngineeringUpdated 4 days ago
From the author
Runs a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.
Install
npx skills add trailofbits/skills --skill trailmark-review-gate -a claude-code
Installs to .claude/skills/trailmark-review-gate/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (6)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/gate-rules.md
- references/output-format.md
- references/review-integration.md