Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 9 hours ago
48,622 skills
- principle-fix-root-causesbacknotprop/pstackApply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.EngineeringNo warnings★ 3.3K↓ —Also in 1 other repo
- constant-time-analysistrailofbits/skillsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.SecurityNo warnings★ 7.9K↓ —
- receiving-code-reviewforyourhealth111-pixel/Vibe-SkillsReview-feedback handling route for CodeRabbit, GitHub, PR, or human reviewer comments. Use before implementing suggestions to verify each finding. Do not use for a fresh code review, security audit, TDD, or final completion evidence.EngineeringNo warnings★ 3.8K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.PlanningNo warnings★ 3.7K↓ —
- offensive-wifiSnailSploit/Claude-RedWireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X bypass, MAC randomization defeat, BLE/Zigbee/IEEE 802.15.4 sidebands, and Wi-Fi 6/6E/7 considerations. Use when scoping wireless pentest, war-driving an estate, or testing corporate wireless segmentation.SecurityNo warnings★ 10.2K↓ —
- golang-continuous-integrationsamber/cc-skills-golangGitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).SecurityNo warnings★ 3.7K↓ —
- comparison-cardZJU-REAL/Easel对比图/一图流：生成 A vs B 参数对比图、优劣势对比表、产品参数一图流。 用 HTML+CSS 渲染成可截图的视觉卡片，适合小红书/微博等平台分享。 使用时机：用户说"做个对比图"、"A vs B"、"参数对比"、"优劣对比"、 "一图流"、"对比表"、"哪个好"、"对比一下"。 和 chart-visualization 的区别：chart 做数据图表（柱状图/折线图），comparison-card 做对比表/一图流。 和 infographic 的区别：infographic 做多维信息图，comparison-card 专注 A vs B 对比。DesignNo warnings★ 4.3K↓ —
- property-based-testingtrailofbits/skillsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.TestingNo warnings★ 7.9K↓ —
- i4h-workflow-createNVIDIA/skillsCreate a minimal blank Workflow scaffold with a Scene containing ground and light plus an idle run mode. Use for fast new Workflow scaffolding.ProductivityNo warnings★ 3.8K↓ —
- terraform-style-guidehashicorp/agent-skillsGenerate Terraform HCL code following HashiCorp's official style conventions and best practices. Use when writing, reviewing, or generating Terraform configurations.OfficialDevOpsNo warnings★ 911↓ —
- hreflang-internationalnowork-studio/notfair-pluginInternational / multilingual SEO audit focused on hreflang correctness: missing or broken return tags, wrong language/region codes, missing x-default, self-referencing errors, hreflang vs canonical conflicts, and inconsistent signals across HTML head, HTTP headers and XML sitemap. Also reviews URL structure (ccTLD vs subdirectory vs subdomain), language targeting and geo signals. Use whenever the user runs a multi-language or multi-region site and asks about hreflang, international or multilingual SEO, the wrong-language page showing in search, or duplicate content across country versions. Trigger on: "hreflang", "international SEO", "multilingual SEO", "multi-region", "wrong language in Google", "x-default", "ccTLD vs subdirectory", "geo targeting", "language targeting", "my English page shows for Thai users", "th/en page ranking in the wrong country", or any cross-language/cross-country ranking question. For full-site audits use /seo-analysis; for a single URL use /seo-page.MarketingNo warnings★ 4.1K↓ —
- gsd:ai-integration-phasedavepoon/buildwithclaudeGenerate AI design contract (AI-SPEC.md) for phases that involve building AI systems — framework selection, implementation guidance from official docs, and evaluation strategyDesignNo warnings★ 3.7K↓ —
- speckit-taskstoissuesforyourhealth111-pixel/Vibe-SkillsConvert tasks from tasks.md into GitHub issues. Use after task breakdown to track work items in GitHub project management.PlanningNo warnings★ 3.8K↓ —
- canva-automationdavepoon/buildwithclaudeAutomate Canva tasks via Rube MCP (Composio): designs, exports, folders, brand templates, autofill. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- jetson-print-bsp-infoNVIDIA/skillsUse when you need to print Jetson BSP info (L4T version, board configs, rootfs state) from a Linux_for_Tegra root on the host PC. This is an example skill.OtherNo warnings★ 3.8K↓ —
- flyio-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect a bounded, redacted Fly.io support bundle for release, Machine, health, volume, network, and platform incidents. Use when escalating a reproducible problem. Trigger with: "build Fly debug bundle", "collect Fly support evidence", "sanitize Fly incident data".EngineeringNo warnings★ 2.9K↓ —
- design-tokensplugin87/ux-ui-agent-skillsGenerate, extend, or audit design tokens in DTCG format with the 3-tier architecture (primitive → semantic → component). Use when the user wants a color palette, type scale, spacing/shadow/radius/motion tokens, multi-brand theming, or wants to validate token files. Covers colors, typography, spacing, shadows, borders, breakpoints, motion, gradients, opacity, blur, sizing, states, theming.DesignNo warnings★ 3.1K↓ —
- fondo-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild internal tools that consume Fondo financial data exports with typed parsers, QuickBooks integration, and financial modeling patterns. Trigger: "fondo data patterns", "fondo integration", "fondo QuickBooks sync".FinanceNo warnings★ 2.9K↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 98.9K↓ —
- card-xiaohongshuZJU-REAL/Easel把已有卡片文案渲染为 1080×1440 小红书竖版知识卡片组，并按 card-design 选择视觉风格。当用户说“渲染/制作小红书卡片、知识卡、滑动卡片组”时使用。整套笔记策划与文案用 xhs-note-creator；横版金句卡用 card-quote。DesignNo warnings★ 4.3K↓ —
- create-verification-skillmichael-denyer/pstack-claudeGenerate a project-local verification skill that drives your app the way a user does — any language, framework, or platform. Use for /create-verification-skill, "make a control skill for this repo", "make a driver skill for this repo", or when a project has no scripted way to prove UI/CLI/service behavior.DesignNo warnings★ 3.7K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —
- governanceplugin87/ux-ui-agent-skillsGovern how the design system evolves (SemVer for tokens/components, the contribution workflow, deprecation policy, and change communication). Use when the user wants to add/promote/deprecate a component or token, decide a version bump, set up a contribution process, or keep the system from fragmenting.DesignNo warnings★ 3.1K↓ —
- gsd:code-reviewdavepoon/buildwithclaudeReview source files changed during a phase for bugs, security issues, and code quality problemsEngineeringNo warnings★ 3.7K↓ —
offensive-fuzzing
SnailSploit/Claude-Red
WritingUpdated Oct 12, 2026
From the author
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-fuzzing -a claude-code
Installs to .claude/skills/offensive-fuzzing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md