Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 1 hour ago
16,444 skills
- fondo-install-authjeremylongshore/tons-of-skills-marketplaceSet up Fondo account and configure integrations with Gusto, QuickBooks, and bank accounts for automated startup bookkeeping and R&D tax credits. Trigger: "setup fondo", "fondo account", "fondo integrations", "connect fondo".FinanceNo warnings★ 2.9K↓ —
- wiki-updateAr9av/obsidian-wikiSync knowledge from the current project into the Obsidian wiki. Use when work already in the current project should be distilled into the vault; named-vault routing includes @work update wiki. wiki-capture saves the current conversation and wiki-ingest handles external/new sources.ProductivityNo warnings★ 3.6K↓ —
- groq-data-handlingjeremylongshore/tons-of-skills-marketplaceUse when you need to keep PII out of Groq API calls, filter model responses, audit-log conversations, or track token cost and usage for a Groq integration. Implements prompt sanitization, PII redaction, response filtering, and usage tracking. Trigger with phrases like "groq data", "groq PII", "groq GDPR", "groq data retention", "groq privacy", "groq compliance".LegalNo warnings★ 2.9K↓ —
- offensive-sstiSnailSploit/Claude-RedDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.TestingNo warnings★ 9.8K↓ —
- wiki-rebuildAr9av/obsidian-wikiArchive and rebuild wiki knowledge from source, or restore a prior archive. Use for full restart/recovery when incremental repair is inappropriate; this is broader and more destructive than ordinary update or lint.OtherNo warnings★ 3.6K↓ —
- kiro-implgotalab/cc-sddImplement approved tasks using TDD with native subagent dispatch. Runs all pending tasks autonomously or selected tasks manually.TestingNo warnings★ 3.7K↓ —
- linear-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze and reduce the infrastructure and quota cost of a Linear integration through workload accounting, query budgets, and push-based updates. Use when a sync is wasteful, throttled, or expensive to operate. Trigger with "reduce Linear API load", "budget Linear queries", or "tune Linear integration cost".DevOpsNo warnings★ 2.9K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
- kiro-reviewgotalab/cc-sddReview a task implementation against approved specs, task boundaries, and verification evidence. Use after an implementer finishes a task, after remediation, or before accepting a task as complete.EngineeringNo warnings★ 3.7K↓ —Also in 7 other repos
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserNo warnings★ 7.9K↓ —
- llm-wikiAr9av/obsidian-wikiExplain and apply the foundational LLM Wiki architecture and knowledge-management strategy. Use for setup, architecture, schema, or organization decisions; operational ingest/query/lint work uses dedicated skills.PlanningNo warnings★ 3.6K↓ —
- solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.SecurityNo warnings★ 7.9K↓ —
- qwen21-nsfw-pose-skillArekejoker/qwen21-nsfw-pose-skillQwen-Image 2.1 NSFW/姿势出图 skill：作者级提示词配方 + NSFW LoRA + 136 姿势 VNCCS 人偶控制；适用 Claude Code / Codex / Cursor / OpenClawMediaNo warnings★ 3.8K↓ —
- envelope-teamdavepoon/buildwithclaudeDesign and generate .envelope.json AI agent team definitions — the open standard for multi-agent teams with hierarchy, access policies, human-in-the-loop gates, and cron schedules.DesignNo warnings★ 3.7K↓ —Also in 1 other repo
- kiro-verify-completiongotalab/cc-sddVerify completion and success claims with fresh evidence. Use before claiming a task is complete, a fix works, tests pass, or a feature is ready for GO.TestingNo warnings★ 3.7K↓ —
- wiki-importAr9av/obsidian-wikiImport a wiki graph into the current vault from graph.json or an OKF/markdown bundle. Use for transferring previously exported wiki content between vaults; pair with wiki-export for the reverse direction.OtherNo warnings★ 3.6K↓ —
- mvpdavepoon/buildwithclaudeGuides the founder through designing and optionally building the simplest MVP or prototype that validates their current hypotheses. Use when the founder wants to build something to test assumptions, discusses what to build next, wants to interpret results from a live MVP, or is deciding whether the current approach is still right. Also use when a founder proposes something to build — the skill will check whether the proposed form is the simplest thing that generates honest signal.TestingNo warnings★ 3.7K↓ —
- figma-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect Figma API diagnostic evidence for support tickets and troubleshooting. Use when encountering persistent issues, preparing support tickets, or collecting diagnostic information for Figma API problems. Trigger with phrases like "figma debug", "figma support bundle", "collect figma logs", "figma diagnostic".DesignNo warnings★ 2.9K↓ —
- ugc-ad-remixdavepoon/buildwithclaudeTurn a proven UGC video ad into a shot-by-shot script for your own product. Use when the user shares a TikTok, Reels or Shorts ad (link or transcript) and wants a version for their product, asks to "remix", "rewrite" or "copy the structure of" an ad, or needs a UGC script that is ready to film. Uses the free UGCfy AI MCP when it is connected; works from pasted ad text without it.MarketingNo warnings★ 3.7K↓ —
- speak-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Speak API rate limits with exponential backoff, request queuing, and optimization strategies. Use when implementing rate limits features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak rate limits", "speak rate limits".EngineeringNo warnings★ 2.9K↓ —
- hey-researchNewdavepoon/buildwithclaudeResearches Robinhood Chain (chain id 4663) projects and tokens with HEY Research Lab's public, source-backed record. Use when someone asks about a Robinhood Chain project, token, $TICKER or 0x contract: is it still being built, what did it ship and when, what changed this week, which project a contract belongs to, or what HEY does not know. Read-only, no key. Not price predictions, trading advice or safety verdicts.ScienceNo warnings★ 3.7K↓ —
- verify-paperclippaperclipai/paperclipVerify Paperclip from a source checkout, published npm install, or existing staging or production stack. Select the environment, data state, version, and platform; drive real UI or CLI journeys and capture evidence. Route deployment to the private Cloud skills.DevOpsNo warnings★ 108.5K↓ —
- cross-linkerAr9av/obsidian-wikiFind and add missing cross-references between wiki pages. Use when pages are disconnected or after large ingestion. This modifies pages to add links; use wiki-lint for report-oriented structural auditing.OtherNo warnings★ 3.6K↓ —
- paperclippaperclipai/paperclipInteract with the Paperclip control plane API for task coordination and governance. Use when checking assignments, updating issue status, posting comments, delegating work, managing routines, or calling Paperclip API endpoints.PlanningNo warnings★ 108.5K↓ —
offensive-fuzzing
SnailSploit/Claude-Red
WritingUpdated Oct 12, 2026
From the author
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a claude-code
Installs to .claude/skills/offensive-fuzzing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md