Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 9 hours ago
48,622 skills
- campaign-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "plan an influencer campaign", "build a campaign blueprint", "track or close a creator campaign", or "record a late campaign correction"; produces the plan and, when requested, a non-canonical evidence tracker with scoped identity, publication, reconciliation, close, and reopen receipts. Not for individual creator briefs — use brief-generator; not for overall product launches without creators — use launch-tier-planner; not for sending, publishing, amplifying, or paying — use the owning execution workflow. 达人营销策划/种草方案/活动追踪与关账MarketingNo warnings★ 3K↓ —
- rag-evalNVIDIA/skillsFilesystem RAG benchmarks: corpus/, train.json, evaluate_rag.py (RAGAS quality). Not for prod monitoring, latency/throughput benchmarking (use rag-perf), or evals outside this repo layout.OtherNo warnings★ 3.8K↓ —
- omomomocode-yeongyu/oh-my-openagentEaster egg command - about oh-my-opencode. Triggers: omomomo, about, easter egg.OtherNo warnings★ 70.6K↓ —
- skill-strategy-advisorZJU-REAL/Easel基于现有内容数据和画像迭代优化内容策略。分析过去一段时间的内容表现、画像信息、 行业趋势，给出下一阶段的内容方向调整、新赛道建议、内容形式优化、发布节奏调整、 画像微调等策略建议。当用户说"下一步怎么做"、"策略建议"、"怎么调整"、"内容方向"、 "下个月策略"、"优化建议"、"迭代方向"时触发。 和 skill-content-strategy 的区别：content-strategy 从零制定策略， strategy-advisor 基于现有数据做迭代优化。OtherNo warnings★ 4.3K↓ —
- miro-rate-limitsjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side Miro REST traffic controls from credit weights, supplied headers, bounded queues, and reset-aware retries. Use when preventing or recovering from Miro 429 responses. Trigger with "Miro rate limit".DesignNo warnings★ 2.9K↓ —
- constant-time-analysistrailofbits/skillsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.SecurityNo warnings★ 7.9K↓ —
- data-context-extractoranthropics/knowledge-work-pluginsGenerate or improve a company-specific data analysis skill by extracting tribal knowledge from analysts. BOOTSTRAP MODE - Triggers: "Create a data context skill", "Set up data analysis for our warehouse", "Help me create a skill for our database", "Generate a data skill for [company]" → Discovers schemas, asks key questions, generates initial skill with reference files ITERATION MODE - Triggers: "Add context about [domain]", "The skill needs more info about [topic]", "Update the data skill with [metrics/tables/terminology]", "Improve the [domain] reference" → Loads existing skill, asks targeted questions, appends/updates reference files Use when data analysts want Claude to understand their company's specific data warehouse, terminology, metrics definitions, and common query patterns.OfficialProductivityNo warnings★ 34.3K↓ —Also in 1 other repo
- what-did-i-get-donemichael-denyer/pstack-claudeSummarize authored commits over a user-specified time period into a concise updatePlanningNo warnings★ 3.7K↓ —
- meta-ads-creativenowork-studio/notfair-pluginCreate evidence-based Meta ad creative briefs, copy angles, and testable asset concepts for Facebook and Instagram. Use when asked for Meta ad creative, Facebook ads copy, Instagram ad assets, UGC concepts, creative briefs, new ad concepts, or creative refreshes.MarketingNo warnings★ 4.1K↓ —
- doca-dtsNewNVIDIA/skillsDeploy and configure the NVIDIA DOCA Telemetry Service (DTS) as it is actually run: (A) BlueField (built-in static pod), (B) Host (docker) on x86_64 / aarch64, or (C) DPF (DPUService / helm chart) — plus the shared configuration layer (`dts_config.ini`, providers, exporters, level labels) that all three share. The user's DEPLOYMENT TYPE decides everything; pick it first. Trigger even without "DTS" for "prometheus on the DPU shows nothing on 9100", "telemetry container exits right after start", "add ethtool counters to the telemetry DPUService", "how do I upgrade the built-in telemetry on BlueField", or "level labels per rack/pod". Refuse and route elsewhere for installing DOCA itself, the `doca_telemetry` / `doca_telemetry_exporter` library API, installing the DPF cluster, Grafana / Prometheus server setup or dashboard / PromQL authoring, and BFB / BSP imaging — those belong to other skills or to external products.DevOpsNo warnings★ 3.8K↓ —
- skill-brand-onboardingZJU-REAL/Easel创作者/品牌入驻：通过结构化访谈收集视觉风格、内容调性、受众画像和运营目标，生成完整的账号画像档案。 当用户说"账号入驻""建档案""新账号建立画像""品牌入驻""从零建号""完善账号信息""onboarding"时使用。 产出覆盖多维度的完整账号档案；只建声音画像用 skill-voice-builder，只建受众画像用 skill-audience-profiler。OtherNo warnings★ 4.3K↓ —
- lindy-sdk-patternsjeremylongshore/tons-of-skills-marketplaceLindy integration patterns for webhook handling, HTTP actions, and Run Code. Use when building integrations, calling Lindy agents from code, or implementing the Run Code action with Python/JavaScript. Trigger with phrases like "lindy integration patterns", "lindy best practices", "lindy webhook patterns", "lindy Run Code", "lindy HTTP Request".EngineeringNo warnings★ 2.9K↓ —
- product-feed-optimizeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "optimize my Shopping feed", "fix product disapprovals", "improve product titles/attributes", or "build feed-driven PMax asset groups"; audits and rewrites the Shopping/Performance Max product feed — title/description patterns, required and recommended attributes, GTIN/availability/price hygiene, disapproval triage, and feed-driven asset-group / listing-group structure — informing the ROAS O (Offer) dimension. Not for text ad copy — use ad-creative-builder; not for scoring the account or the RQS — use ad-account-auditor. 商品Feed优化/购物广告Feed/商品标题优化/商品禁投修复MarketingNo warnings★ 3K↓ —
- skill-channels-uploadZJU-REAL/Easel微信视频号发布：把竖版短视频发布到微信视频号（channels.weixin.qq.com）。当用户说 "发视频号""上传视频号""视频号发布""发到微信视频号""视频号投稿"时使用。基于通用浏览器 发布框架（Playwright + 登录态持久化），微信扫码登录。TestingNo warnings★ 4.3K↓ —
- gsd:insert-phasedavepoon/buildwithclaudeInsert urgent work as decimal phase (e.g., 72.1) between existing phasesOtherNo warnings★ 3.7K↓ —
- speak-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Speak API rate limits with exponential backoff, request queuing, and optimization strategies. Use when implementing rate limits features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak rate limits", "speak rate limits".EngineeringNo warnings★ 2.9K↓ —
- paid-ads-tiktoknowork-studio/notfair-pluginAudit, diagnose, and safely operate connected TikTok Ads accounts through the NotFair MCP. Use for TikTok advertising, Spark Ads, short-form video ads, campaign or ad-group analysis, spend, conversions, targeting, creative, budgets, bids, creator briefs, campaign setup, or approved TikTok Ads changes.MarketingNo warnings★ 4.1K↓ —
- cooper-emaildavepoon/buildwithclaudeGive Claude its own email inbox with Cooper Email to send, receive, reply, and wait for replies or verification codes over a hosted MCP server or HTTP. Use when the user wants the agent to have its own email address, not access to the user's mailbox.ProductivityNo warnings★ 3.7K↓ —
- property-based-testingtrailofbits/skillsWrites, reviews, and debugs property-based tests — Hypothesis, fast-check, proptest, jqwik, rapid, and Echidna or Medusa for Solidity invariants. Use whenever tests should cover a whole input domain instead of a hand-picked list of examples: encode/decode and serialize/deserialize pairs, parsers, canonicalizers and normalizers, validators, numeric and Decimal types, comparators and sort order, data structures, and smart-contract state invariants. Also use when adding cases to an existing @given, fast-check, or proptest suite, when judging whether existing property tests assert anything real, and when a generator has shrunk a counterexample and you need to tell a wrong property from a genuine bug. Not for coverage-guided binary fuzzing (libFuzzer, AFL), mutation-testing campaigns, static analysis, benchmarking, or end-to-end UI tests.TestingNo warnings★ 7.9K↓ —
- distilldavepoon/buildwithclaudeSynthesize wiki pages from related memories. One endpoint, one flow: daemon clusters and synthesizes what it can; agent finishes whatever the daemon couldn't (no LLM or cluster too big). Invoked as `/distill [target]`.OtherNo warnings★ 3.7K↓ —
- trailmark-variant-neighborhoodtrailofbits/skillsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.SecurityNo warnings★ 7.9K↓ —
- launch-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "log this launch", query a launch date/embargo, record a stage transition, or update submissions/outcomes; curates launch facts through the append-only launches event stream with optimistic revisions and derived dossier/calendar views. Not for RAMP scoring — use launch-readiness-auditor; not for planning tier/window — use launch-tier-planner. 发布台账/发布日历/阶段与禁运期记录PlanningNo warnings★ 3K↓ —
- gsd:add-testsdavepoon/buildwithclaudeGenerate tests for a completed phase based on UAT criteria and implementationTestingNo warnings★ 3.7K↓ —
- jetson-init-targetNVIDIA/skillsAuthor a new Jetson target-platform profile (reference_devkit + optional custom_carrier) and update the active pointer. Use to create a target; not for switching existing profiles.OtherNo warnings★ 3.8K↓ —
constant-time-analysis
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
Install
npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
Installs to .claude/skills/constant-time-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (12)
- README.md
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/compiled.md
- references/javascript.md
- references/kotlin.md
- references/php.md
- references/python.md
- references/ruby.md
- references/swift.md
- references/vm-compiled.md