Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 8 hours ago
48,622 skills
- gsd:scandavepoon/buildwithclaudeRapid codebase assessment — lightweight alternative to /gsd:map-codebaseOtherNo warnings★ 3.7K↓ —
- gsd:quickdavepoon/buildwithclaudeExecute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agentsProductivityNo warnings★ 3.7K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 10.2K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10.2K↓ —
- narrative-cascade-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "plan how our narrative lands on every surface", "write per-surface message-match specs", or "brief each creative builder from the canon"; maps the narrative-registry canon onto every flagship surface (homepage, pricing, store listing, sales deck, social bio, docs, email) as a per-surface message-match spec — what claim, pillar, proof, and objection reframe each surface must carry — and cuts a handoff brief to each discipline's creative builder (content-writer, ad-creative-builder, email-creative-builder, social-creative-builder, message-house-builder), so the same story lands consistently everywhere. Not for writing the finished surface copy — use each discipline creative builder; not for the tier-scoped launch asset manifest — use launch-asset-packager; not for scoring cross-surface consistency — use narrative-quality-auditor; not for claim adjudication — use offer-claims-registry. 叙事落地/逐面消息一致/创意交接简报/画布传导PlanningNo warnings★ 3K↓ —
- finta-install-authjeremylongshore/tons-of-skills-marketplaceSet up Finta fundraising CRM account and configure integrations. Use when onboarding to Finta, connecting email/calendar, or configuring investor pipeline automation. Trigger with phrases like "install finta", "setup finta", "finta onboarding", "configure finta crm".FinanceNo warnings★ 2.9K↓ —
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.TestingNo warnings★ 10.2K↓ —
- cairo-vulnerability-scannertrailofbits/skillsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.SecurityNo warnings★ 7.9K↓ —
- quit-sponsorjeremylongshore/tons-of-skills-marketplaceTurns an AI agent with persistent memory into a quit-smoking sponsor. Use when a person asks for help quitting smoking (cigarettes or other smoked tobacco), announces they are quitting, reports a craving, a slip, or a relapse, goes silent mid-quit, or asks the agent to witness and track a quit. Provides evidence-based protocols (immediate execution of the quit decision, urge surfing, slip attribution coaching, withdrawal timelines, nutrition and alcohol rules, NRT guidance, a two-year aftercare cadence) plus a sponsor decision tree with an order-of-operations for colliding rules, a three-clause contract, purge ritual, graded live-crisis ladder for a pack already in hand, wave protocol, slip and post-relapse protocols, recurrence escalation, silence protocol, a Ulysses pact, a red-flag medical playbook, high-risk situation mapping, if-then plans, and a timestamped logbook. Includes a low-verbal client mode and an optional module for cannabis co-use and tobacco-mixed joints. Not a medical device.ScienceNo warnings★ 2.9K↓ —
- golang-goplssamber/cc-skills-golangGolang semantic code intelligence via `gopls`, the official Go language server — go-to-definition, find references, call/implementation hierarchy, workspace symbol search, package API discovery, diagnostics, safe rename, refactors (extract/inline/fill/rewrite code actions), formatting, and generated tests. Reaches an agent via gopls's own MCP server (`go_*` tools), Claude Code's native `LSP` tool, or the `gopls` CLI. Use when navigating or refactoring Go code — jumping to a definition, finding call sites before a rename, understanding a file's or package's dependencies, running diagnostics after an edit, or extracting/inlining/renaming. Not for the published ecosystem — packages not in your `go.mod`, versions, licenses, importers — → See `samber/cc-skills-golang@golang-pkg-go-dev` skill (`godig`). Not for a whole-tree vulnerability audit → See `samber/cc-skills-golang@golang-security` skill (`govulncheck`).SecurityNo warnings★ 3.7K↓ —
- offensive-wpa-enterpriseSnailSploit/Claude-RedWPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.MarketingNo warnings★ 10.2K↓ —
- doca-dpaNVIDIA/skillsUse this skill when the user is doing hands-on DOCA DPA host-side work on a BlueField — creating the `doca_dpa` Core context, loading a DPACC-compiled DPA app image (`doca_dpa_app`), creating DPA threads, launching kernels via `doca_dpa_kernel_launch_update_*`, draining `doca_dpa_completion`, running `doca_dpa_cap_*` discovery, choosing between the DPA comm component (inter-DPA messaging) and the DPA verbs component (in-kernel RDMA), or debugging `DOCA_ERROR_*` from `doca_dpa_*`. Trigger even without "DOCA DPA" or "Data-Path Accelerator": "run compute on the DPA from my host", "DPA kernel hangs, no completion", "DOCA_ERROR_DRIVER on launch", "DOCA/DPACC version skew", or "does this BlueField expose a DPA". Route elsewhere for DPA-side kernel programming itself, DPACC compiler internals, host↔DPU messaging (doca-comch), host-side RDMA (doca-rdma), and GPU-initiated networking (doca-gpunetio).MediaNo warnings★ 3.8K↓ —
- offensive-network-attacksSnailSploit/Claude-RedDense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.TestingNo warnings★ 10.2K↓ —
- no-commentsmichael-denyer/pstack-claudeSpawn the comment-sicko subagent, fix accepted findings, and offer encodings for claimed constraints.OtherNo warnings★ 3.7K↓ —
- bromichael-denyer/pstack-claudeRestate the last message in plain human language, with no jargon. Use for /bro or when asked to say it plainly.OtherNo warnings★ 3.7K↓ —
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 10.2K↓ —
- clerk-testingclerk/skillsE2E testing for Clerk apps. Use with Playwright or Cypress for auth flow tests.OfficialTestingNo warnings★ 89↓ —
- security-researchcode-yeongyu/oh-my-openagentTeam Mode security research skill. Orchestrates 3 vulnerability hunters and 2 PoC engineers to audit a codebase in parallel, prove exploitability, classify root causes, and calibrate severity by actual exploitability. Use for security review, vulnerability research, exploitability audit, pre-release security check, threat model validation, and `/security-research`. Triggers: 'security-research', 'security research', 'security review', 'vulnerability audit', 'exploitability audit', '보안 리뷰', '취약점 감사'.SecurityNo warnings★ 70.6K↓ —
- clerk-sdk-patternsjeremylongshore/tons-of-skills-marketplaceCommon Clerk SDK patterns and best practices. Use when implementing authentication flows, accessing user data, or integrating Clerk SDK methods in your application. Trigger with phrases like "clerk SDK", "clerk patterns", "clerk best practices", "clerk API usage".EngineeringNo warnings★ 2.9K↓ —
- maintain-verification-skillbacknotprop/pstackPeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.3K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- gsd:dodavepoon/buildwithclaudeRoute freeform text to the right GSD command automaticallyOtherNo warnings★ 3.7K↓ —
- cc-sdd-new-agentgotalab/cc-sddAdd or extend coding-agent support in cc-sdd by executing the SOP in docs/cc-sdd/sop-new-agent.md end-to-end. Use when introducing a new agent, adding a subagent-capable variant, or evaluating migration of an existing supported agent to skills-based templates.EngineeringNo warnings★ 3.7K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
directions-lab
paperclipai/paperclip
NewDesignUpdated 10 hours ago
From the author
Scaffold a directions lab that shows shipped UI (Today) beside 2-3 design directions, with surface tabs, theme and animation toggles and the V1 MVP hover motion, registered in design-proposals Storybook. Use for a directions page or lab, or to explore design directions next to production.
Install
npx skills add paperclipai/paperclip --skill directions-lab -a claude-code
Installs to .claude/skills/directions-lab/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Runs bundled scriptsNo network use seenLicence: MIT
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 90
Security85
Provenance95
Maintenance100
Licence100
Adoption77
Files (70)
- SKILL.md
- agents/openai.yaml
- assets/PRECEDENT
- assets/motion/v1-mvp-motion.css
- assets/templates/api-routes.ts.mjs
- assets/templates/api-stub.ts.mjs
- assets/templates/build-info.ts.mjs
- assets/templates/define-lab.ts.mjs
- assets/templates/direction/MotionSpecimen.tsx.mjs
- assets/templates/direction/SlotBody.tsx.mjs
- assets/templates/direction/index.tsx.mjs
- assets/templates/direction/tokens.css.mjs
- +58 more