Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,395 skills from 2,375 repositories · updated 19 minutes ago
49,393 skills
- vulnerability-triage-brocardstrailofbits/skillsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.SecurityNo warnings★ 8K↓ —
- gsd:ai-integration-phasedavepoon/buildwithclaudeGenerate AI design contract (AI-SPEC.md) for phases that involve building AI systems — framework selection, implementation guidance from official docs, and evaluation strategyDesignNo warnings★ 3.7K↓ —
- node-zombie-guardianforyourhealth111-pixel/Vibe-SkillsUse when diagnosing stale or orphaned Node.js processes launched by VCO, auditing ownership/liveness, or safely simulating cleanup without touching external Node workloads.OtherNo warnings★ 3.8K↓ —
- audit-context-buildingtrailofbits/skillsUnderstand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.ProductivityNo warnings★ 8K↓ —
- nvshmem-tune-performanceNVIDIA/skillsRoute NVSHMEM tuning to data collection, remote transport, NIC-to-PE mapping, or TMA. Do not use for unrelated CUDA, NCCL, or application tuning.OtherNo warnings★ 3.8K↓ —
- algorand-vulnerability-scannertrailofbits/skillsScans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).SecurityNo warnings★ 8K↓ —
- openai-docsforyourhealth111-pixel/Vibe-SkillsUse when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations (for example: Codex, Responses API, Chat Completions, Apps SDK, Agents SDK, Realtime, model capabilities or limits); prioritize OpenAI docs MCP tools and restrict any fallback browsing to official OpenAI domains.EngineeringNo warnings★ 3.8K↓ —
- newsletter-monetization-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "monetize my newsletter", "build a sponsorship rate card", or "model paid-subscription revenue"; produces a revenue model (paid tiers, ad/sponsorship inventory + CPM/flat rate card, referral/boost loops), a list-growth ↔ revenue projection, and honest-offer / disclosure checks for the SEND-D lever. Not for scoring the whole program or running D1 — use email-quality-auditor; not for the return math — use roi-calculator; not for the post-click page — use landing-optimizer. 邮件newsletter变现/赞助刊例/付费订阅测算MarketingNo warnings★ 3.1K↓ —
- paid-ads-optimizenowork-studio/notfair-pluginDiagnose wasted paid-ad spend, pacing, and allocation, then propose safe evidence-backed optimizations. Use for waste, negatives, budgets, bid changes, poor CPA or ROAS, underpacing, overspend, or scaling decisions.MarketingNo warnings★ 4.1K↓ —
- tao-train-nvdinov2NVIDIA/skillsNVDINOv2 for self-supervised visual representation learning. Trains vision transformers via self-distillation (teacher-student) without labels and produces general-purpose visual features. Use when training, exporting, or running inference for a TAO NVDINOv2 backbone. Trigger phrases include "train NVDINOv2", "self-supervised ViT pretraining", "DINOv2 backbone", "visual representation learning".OtherNo warnings★ 3.8K↓ —
- principle-redesign-from-first-principlesbacknotprop/pstackApply when integrating a new requirement into an existing design.DesignNo warnings★ 3.5K↓ —Also in 1 other repo
- contract-reviewjeremylongshore/tons-of-skills-marketplaceUse when reviewing a supplied contract for clause meaning, obligations, risks, missing protections, and regulatory questions. Produces an evidence-linked executive report with actual document coverage. Trigger with /contract-review or review this contract.LegalNo warnings★ 2.9K↓ —
- wiki-rebuildAr9av/obsidian-wikiArchive and rebuild wiki knowledge from source, or restore a prior archive. Use for full restart/recovery when incremental repair is inappropriate; this is broader and more destructive than ordinary update or lint.OtherNo warnings★ 3.7K↓ —
- budget-pacing-monitoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "check pacing", "am I over/under-spending", "is this campaign on track to hit budget", or "why did spend spike/stall mid-flight"; returns a spend-vs-target-curve read, learning-phase status, an over/under-delivery call, and a reallocation trigger. Not for initial budget allocation — use budget-optimizer; not for choosing the bid strategy — use bid-strategy-planner; not for the RQS gate — use ad-account-auditor. 付费广告预算节奏监控/跑量过快过慢/在途配速MarketingNo warnings★ 3.1K↓ —
- short-drama-knowhowzenstory-ai/drama-skills维护者专用的短剧 know-how 学习、验证与生命周期治理。仅在维护者明确要求从其当前会话提供的授权只读文本源学习完整短剧项目链，并把私有观察逐步转成去标识、去复刻、经盲测与独立审查的公共 reference、rubric 或 synthetic fixture 候选时使用；不用于普通创作、公开运行时取数、媒体生成或粗略数据分析。OtherNo warnings★ 3.7K↓ —
- kiro-steering-customgotalab/cc-sddCreate custom steering documents for specialized project contextsPlanningNo warnings★ 3.8K↓ —Also in 6 other repos
- neon-realtimeneondatabase/agent-skillsNeon Realtime makes any SQL query live. Build realtime, reactive apps and agents on Lakebase Postgres with live SQL queries and reactivity primitives. Use when app UI or agent state must update live from database rows (dashboards, feeds, collaboration, multi-user or multi-device sync), for optimistic mutations, or to replace polling or other realtime sync systems. Triggers include "live query", "subscribe", "sync engine", "useLiveQuery", "TanStack DB", "optimistic updates", "@neon/realtime". For push that doesn't come from database rows (presence, typing, LLM streams), use neon-functions.OfficialDataNo warnings★ 111↓ —Also in 1 other repo
- placement-exclusion-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build my brand-safety exclusion lists", "set placement / topic / content exclusions before launch", "add network and audience exclusions", or "prep the A1 brand-safety evidence for the auditor"; produces a placement/network exclusion list, a content-suitability & sensitive-topic block list, an audience/negative-audience exclusion set, and a packaged A1 brand/placement-safety evidence file for the gate. Not for building the audiences you target — use audience-segment-builder; not for computing the RQS or issuing the A1 verdict — use ad-account-auditor. 品牌安全/排除位置/否定受众列表MarketingNo warnings★ 3.1K↓ —
- offsite-signal-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze backlinks", "analyze my off-site signals", or "track AI traffic / ChatGPT / Perplexity referrals"; profiles referring domains, anchor-text mix, toxic links, and disavow candidates (backlinks mode) or isolates AI-assistant referral sessions in GA4/GSC/logs and reports their trend, landing pages, and AI-vs-organic conversion (ai-referrals mode). Not for internal links — use site-structure-optimizer; not for keyword positions — use rank-tracker; not for multi-metric stakeholder reports — use performance-monitor. 外链分析/反向链接/AI流量/AI引荐/ChatGPT流量/AI转化MarketingNo warnings★ 3.1K↓ —
- doca-socket-relayNVIDIA/skillsUse this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint, walking the bind → connect → round-trip → admit-fleet smoke, or diagnosing a stuck/silent relay. Trigger even when the user does not explicitly mention "DOCA Socket Relay" — typical implicit phrasings include "move my socket app onto the BlueField without rewriting it", "host app gets ECONNREFUSED on the relay", "relay accepts the connection but bytes never arrive on the DPU side", "first round-trip works, the rest hang", "bridge an AF_UNIX (UDS) socket to a DPU peer over Comch", or "I want a sidecar that forwards my socket to the BlueField". Refuse and route elsewhere for the comch programming API, line-rate raw packet I/O via doca-eth, and DOCA install/bring-up — those belong to other skills.DevOpsNo warnings★ 3.8K↓ —
- dynamic-content-personalizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "personalize the email", "add merge tags / dynamic content", "set up conditional blocks per segment", or "make first-name and product-recommendation fields fall back safely"; produces a merge-tag map with per-tag fallbacks, conditional-block rules with per-segment variations, a fallback-safety audit, and a PII guard on what may render, informing the SEND E (Engagement/personalization) dimension. Not for building the segments — use list-segment-builder; not for writing the base copy — use email-creative-builder; not for scoring EQS or running vetoes — use email-quality-auditor. 邮件个性化/合并标签/条件内容块/兜底默认值MediaNo warnings★ 3.1K↓ —
- orbit-cardheygen-com/hyperframesA single feature card orbits a dot sphere on approved Blender camera motion. HyperFrames block, 1920×1080, 10s, 4 variables.OfficialOtherNo warnings★ 78.1K↓ —
- sales-enablement-kitaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build battle cards", "prep the sales team for launch", or "write the internal launch FAQ"; produces the internal enablement kit for a sales-led launch — battle cards vs each named alternative (where we win / where they win / trap questions, every fact traceable), a sales talk track derived from the PR-FAQ spine, an objection-handling table (objection → response → evidence), internal FAQ + CS macros, and an internal launch announcement with embargo discipline. Not for the external message house — use message-house-builder; not for competitor tracking itself — use competitor-tracker or competitor-analysis; not for outbound sequences — use cold-outbound-sequencer. 销售赋能/battle card/销售叙事/异议处理/内部FAQWritingNo warnings★ 3.1K↓ —
- proposal-drafterdavepoon/buildwithclaudeDraft a tailored freelance proposal or platform profile bio from a real job posting/brief and the freelancer's actual background. Use when responding to a listing on Contra/Upwork/etc, or writing/updating a freelance profile. Never invents experience, clients, or credentials that weren't provided.WritingNo warnings★ 3.7K↓ —
kiro-spec-batch
gotalab/cc-sdd
PlanningUpdated Oct 22, 2026
From the author
Create complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.
Install
npx skills add gotalab/cc-sdd --skill kiro-spec-batch -a claude-code
Installs to .claude/skills/kiro-spec-batch/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md