Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 8 hours ago
48,622 skills
- linkedin-readerhimself65/finance-skillsRead LinkedIn for financial research through opencli: the user's feed, and job search with location, seniority, job type, remote, company, and date filters. Use this skill whenever the user wants to check their LinkedIn feed, see what professionals or analysts are posting about a company, market, or earnings, gauge professional sentiment, or search finance and trading jobs on LinkedIn. Read-only: it cannot post, like, comment, connect, message, or apply.MarketingNo warnings★ 3.5K↓ —
- version-bumperjeremylongshore/tons-of-skills-marketplaceExecute automatically handles semantic version updates across plugin.json and marketplace catalog when user mentions version bump, update version, or release. ensures version consistency in AI assistant-code-plugins repository. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.EngineeringNo warnings★ 2.9K↓ —
- nvshmem-get-startedNVIDIA/skillsUse when NVSHMEM beginners want a tutorial-style overview on assessment, mental models, first C/C++ or Python NVSHMEM programs, compilation, launching, and next steps.EngineeringNo warnings★ 3.8K↓ —
- doca-telemetry-utilsNVIDIA/skillsdoca_telemetry_utils command line on a host with DOCA: discover the diagnostic-counter schema, translate counter names to binary Data IDs and back, and check per-device counter support before committing a DOCA Telemetry exporter config. Use this skill when telemetry counters vanish between the exporter and the collector: "my exporter ships but the collector sees nothing", "this metric silently drops downstream", "which counters does this BlueField expose", "translate this 0x... back to a counter name", "what do node / pcie_index / depth mean here", or "is this counter supported on this device", even without naming the tool. Route exporter or collector code to doca-telemetry-exporter / doca-telemetry, DTS deployment to doca-dts, and DOCA install or repair to doca-setup.DevOpsNo warnings★ 3.8K↓ —
- json-canvasdavepoon/buildwithclaudeCreate and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.WritingNo warnings★ 3.7K↓ —Also in 1 other repo
- fxmacrodatadavepoon/buildwithclaudeLook up official macroeconomic releases, central-bank policy rates, release calendars and FX rates for 22 currencies through the FXMacroData MCP server. Use for questions about CPI, GDP, jobs data, rate decisions, bond yields or what data is due next, when the answer should come from the published number rather than news coverage. Remote server at https://mcp.fxmacrodata.com/mcp; USD works without a key.OtherNo warnings★ 3.7K↓ —
- gsd:extract-learningsdavepoon/buildwithclaudeExtract decisions, lessons, patterns, and surprises from completed phase artifactsOtherNo warnings★ 3.7K↓ —
- ops-daemondavepoon/buildwithclaudeCheck claude-ops background daemon end-to-end and auto-fix common issues. Detects stale plist paths after plugin upgrades, missing service commands, dead processes, corrupt health files, and bash version mismatches.OtherNo warnings★ 3.7K↓ —
- ops-projectsdavepoon/buildwithclaudePortfolio dashboard for all GSD-tracked projects. Scans ~/Projects and ~/gsd-workspaces for .planning/ directories, shows phase status, git state, blockers, and next actions for every project. Run /ops projects to see the full portfolio.PlanningNo warnings★ 3.7K↓ —
- ops-voicedavepoon/buildwithclaudeVoice operations — make phone calls (Bland AI), text-to-speech (ElevenLabs), transcribe audio (Whisper/Groq). Replace OpenClaw voice capabilities.MediaNo warnings★ 3.7K↓ —
- gsd:check-todosdavepoon/buildwithclaudeList pending todos and select one to work onOtherNo warnings★ 3.7K↓ —
- gsd:add-backlogdavepoon/buildwithclaudeAdd an idea to the backlog parking lot (999.x numbering)OtherNo warnings★ 3.7K↓ —
- ops-settingsdavepoon/buildwithclaudePost-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-running the full setup wizard. Runs a smoke test after each update.TestingNo warnings★ 3.7K↓ —
- hubspot-authjeremylongshore/tons-of-skills-marketplaceAuthenticate production HubSpot integrations and survive the auth-side failures — 30-min token expiry storms, 500K daily rate-limit burnout, scope drift, token leakage in commits, multi-portal credential routing, OAuth refresh-token decay. Use when hardening token caching, rotating private app credentials, building a multi-portal credential router, or recovering from 429/403 auth cascades. Trigger with "hubspot auth", "hubspot token cache", "hubspot rate limit", "hubspot scope drift", "hubspot multi-portal", "hubspot OAuth refresh".OtherNo warnings★ 2.9K↓ —
- correctbacknotprop/pstackFind the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.TestingNo warnings★ 3.3K↓ —
- i4h-workflow-validateNVIDIA/skillsRun the root-level workflow runtime policy or rule-based rollouts and verify simulator success. Use for evaluation, checkpoints, or local controllers; do not use for replay or dataset annotation.ProductivityNo warnings★ 3.8K↓ —
- apify-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect Apify debug evidence for support tickets and troubleshooting. Use when an Actor run has failed, is stuck, or produced empty output and you need to gather run metadata, logs, dataset samples, and environment info before opening a support ticket. Trigger with "apify debug", "apify support bundle", "collect apify logs", "apify diagnostic", "apify run failed why".EngineeringNo warnings★ 2.9K↓ —
- cleanup-codejeremylongshore/tons-of-skills-marketplaceComprehensive codebase cleanup across 11 quality dimensions: dead code, duplication, weak types, circular deps, defensive cruft, legacy code, AI slop, type consolidation, security, performance, and async patterns. Analyzes code with confidence scoring and verifies changes with build/test gates. Use when codebase has accumulated tech debt, after major feature work, before releases, or when code quality metrics are declining. Trigger with "/cleanup-code-code", "clean up the codebase", "remove dead code", "fix code quality".EngineeringNo warnings★ 2.9K↓ —
- clawringdavepoon/buildwithclaudePhone calling skill for OpenClaw: agent makes real outbound phone calls to users for alerts, briefings, reminders, and urgent notifications. Managed service, no Twilio setup needed. 100+ countries, 70+ voices.OtherNo warnings★ 3.7K↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 98.9K↓ —
- canvas-designdavepoon/buildwithclaudeCreate beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.DesignNo warnings★ 3.7K↓ —
- differential-reviewtrailofbits/skillsPerforms security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.EngineeringNo warnings★ 7.9K↓ —
- api-contractjeremylongshore/tons-of-skills-marketplaceConfigure this skill should be used when the user asks about "API contract", "api-contract.md", "shared interface", "TypeScript interfaces", "request response schemas", "endpoint design", or needs guidance on designing contracts that coordinate backend and frontend agents. Use when building or modifying API endpoints. Trigger with phrases like 'create API', 'design endpoint', or 'API scaffold'.LegalNo warnings★ 2.9K↓ —
- wycheprooftrailofbits/skillsValidates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH, and more. Covers loading test vectors, mapping result flags onto pass and fail expectations, and reading a failure. Use when testing a crypto implementation against known attacks, checking a library against standard test vectors, or investigating why two implementations disagree on the same input.TestingNo warnings★ 7.9K↓ —
agentic-actions-auditor
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
Install
npx skills add trailofbits/skills --skill agentic-actions-auditor -a claude-code
Installs to .claude/skills/agentic-actions-auditor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (15)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/action-profiles.md
- references/cross-file-resolution.md
- references/foundations.md
- references/vector-a-env-var-intermediary.md
- references/vector-b-direct-expression-injection.md
- references/vector-c-cli-data-fetch.md
- references/vector-d-pr-target-checkout.md
- references/vector-e-error-log-injection.md
- references/vector-f-subshell-expansion.md
- +3 more