Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 10 hours ago
48,622 skills
- sharpenmichael-denyer/pstack-claudeMake a task deeper, not bigger, then rewrite the prompt. Use for /sharpen.ProductivityNo warnings★ 3.7K↓ —
- offsite-signal-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze backlinks", "analyze my off-site signals", or "track AI traffic / ChatGPT / Perplexity referrals"; profiles referring domains, anchor-text mix, toxic links, and disavow candidates (backlinks mode) or isolates AI-assistant referral sessions in GA4/GSC/logs and reports their trend, landing pages, and AI-vs-organic conversion (ai-referrals mode). Not for internal links — use site-structure-optimizer; not for keyword positions — use rank-tracker; not for multi-metric stakeholder reports — use performance-monitor. 外链分析/反向链接/AI流量/AI引荐/ChatGPT流量/AI转化MarketingNo warnings★ 3K↓ —
- nvshmem-tune-performanceNVIDIA/skillsRoute NVSHMEM tuning to data collection, remote transport, NIC-to-PE mapping, or TMA. Do not use for unrelated CUDA, NCCL, or application tuning.OtherNo warnings★ 3.8K↓ —
- anti-ui-slopdavepoon/buildwithclaudeStop coding agents from shipping generic UI. Use UIZZE's 800,000+ real web and iOS screens to build product-specific interfaces, define a design contract, cover required states, and run a hard finish gate. Use for web or iOS UI design, implementation, redesign, critique, and pre-ship review in Codex, Claude Code, Cursor, Copilot, and other coding agents.DesignNo warnings★ 3.7K↓ —
- principle-fix-root-causesmichael-denyer/pstack-claudeApply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.EngineeringNo warnings★ 3.7K↓ —
- nemotron-customizeNVIDIA/skillsPlan, configure, and chain repo-native Nemotron customization steps into single-step or multi-step pipelines: curation, translation, SFT/PEFT (AutoModel or Megatron-Bridge), pretraining/CPT, RL alignment (DPO/RLVR/GRPO/RLHF), BYOB/MCQ benchmarks, checkpoint conversion, ModelOpt optimization, env profiles, and evaluation of trained checkpoints or existing/hosted endpoints. Use when a request names a Nemotron step or workflow, or asks to clean, translate, train, fine-tune, align, convert, optimize, evaluate, or compose these into a pipeline. Do NOT use for frontend/dashboard/visualization work, generic ML advice, billing/access, or non-Nemotron coding tasks.DesignNo warnings★ 3.8K↓ —
- jetson-generate-kbNVIDIA/skillsBuild a per-target knowledge-base markdown next to the active profile by walking the BSP root and source tree. Use after init-image / init-source; not for editing profile fields.MediaNo warnings★ 3.8K↓ —
- golang-design-patternssamber/cc-skills-golangIdiomatic Golang design patterns — functional options, constructor APIs, `init()` and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown, timeouts and retries, streaming and iterators, and architecture styles (clean, hexagonal, DDD, flat). Apply when choosing between architectural patterns, implementing functional options, designing constructor APIs, setting up graceful shutdown, applying resilience patterns, or asking which idiomatic Go pattern fits a specific problem. Not for wiring a DI container or comparing DI libraries (→ See `samber/cc-skills-golang@golang-dependency-injection` skill), nor for error wrapping, `errors.Is`/`As`, or logging mechanics (→ See `samber/cc-skills-golang@golang-error-handling` skill).DesignNo warnings★ 3.7K↓ —
- speckit-taskstoissuesforyourhealth111-pixel/Vibe-SkillsConvert tasks from tasks.md into GitHub issues. Use after task breakdown to track work items in GitHub project management.PlanningNo warnings★ 3.8K↓ —
- clerkclerk/skillsClerk authentication router. Use when user asks about Clerk CLI operations, adding authentication, setting up Clerk, custom sign-in flows, Swift or native iOS auth, native Android auth, Next.js patterns, React patterns, Vue patterns, Nuxt patterns, Astro patterns, TanStack Start patterns, Expo patterns, React Router patterns, Chrome Extension patterns, organizations, billing, subscriptions, payments, pricing, plans, seat-based pricing, feature entitlements, syncing users, testing, impersonating a user, or testing webhooks locally. Automatically routes to the specific skill based on their task.OfficialTestingNo warnings★ 89↓ —
- gsd:cleanupdavepoon/buildwithclaudeArchive accumulated phase directories from completed milestonesOtherNo warnings★ 3.7K↓ —
- tao-train-centerposeNVIDIA/skillsCenterPose for keypoint / pose estimation. Detects object centers and regresses keypoint locations for 6-DoF object pose estimation. Use when training, evaluating, exporting, or running inference for a TAO CenterPose model. Trigger phrases include "train CenterPose", "6-DoF object pose", "keypoint estimation", "object pose regression".OtherNo warnings★ 3.8K↓ —
- clade-install-authjeremylongshore/tons-of-skills-marketplaceInstall and configure the Anthropic SDK for Claude API access. Use when setting up Claude integration, configuring API keys, or initializing the Anthropic client in your project. Trigger with phrases like "install anthropic", "setup claude api", "anthropic auth", "configure anthropic API key".EngineeringNo warnings★ 2.9K↓ —
- gsd:review-backlogdavepoon/buildwithclaudeReview and promote backlog items to active milestoneEngineeringNo warnings★ 3.7K↓ —
- doca-telemetryNVIDIA/skillsUse this skill to read DOCA hardware-counter events from a `doca_dev` through the per-domain Telemetry reader libraries: `doca_telemetry_pcc`, `_dpa`, `_diag`, `_adp_retx`, `_phy`, and `_pci`. It covers capability checks, context creation, startup, and per-domain reads or samples. Trigger for implicit requests such as "read PCC counters from my BlueField app", "sample DPA counter exports", or "expose PHY, PCI, or DIAG counters from this doca_dev". This is the counter-reader surface, not a NetFlow, IPFIX, or local-socket collector. Route publishing and export to `doca-telemetry-exporter`; route the deployed DOCA Telemetry Service to `doca-dts`, and collectors and plain stdout logging elsewhere.DevOpsNo warnings★ 3.8K↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 98.9K↓ —
- golang-samber-mosamber/cc-skills-golangMonadic types for Golang using samber/mo — Option, Result, Either, Future, IO, Task, and State types for type-safe nullable values, error handling, and functional composition with pipeline sub-packages. Apply when using or adopting samber/mo, when the codebase imports `github.com/samber/mo`, or when considering functional programming patterns as a safety design for Golang. Not for nil-safety and zero-value design without this library (→ See `samber/cc-skills-golang@golang-safety` skill), nor for native error wrapping with fmt.Errorf, errors.Is and errors.As (→ See `samber/cc-skills-golang@golang-error-handling` skill).DesignNo warnings★ 3.7K↓ —
- gsd:eval-reviewdavepoon/buildwithclaudeRetroactively audit an executed AI phase's evaluation coverage — scores each eval dimension as COVERED/PARTIAL/MISSING and produces an actionable EVAL-REVIEW.md with remediation planEngineeringNo warnings★ 3.7K↓ —
- thermosmichael-denyer/pstack-claudeLaunch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.SecurityNo warnings★ 3.7K↓ —
- ctf-osintljagiello/ctf-skillsProvides open source intelligence techniques for CTF challenges. Use when gathering information from public sources, social media, geolocation, DNS records, username enumeration, reverse image search, Google dorking, Wayback Machine, Tor relays, FEC filings, or identifying unknown data like hashes and coordinates.MediaNo warnings★ 3.6K↓ —
- gsd:ultraplan-phasedavepoon/buildwithclaude[BETA] Offload plan phase to Claude Code's ultraplan cloud — drafts remotely while terminal stays free, review in browser with inline comments, import back via /gsd:import. Claude Code only.BrowserNo warnings★ 3.7K↓ —
- wiki-digestAr9av/obsidian-wikiProduce a day/week/month knowledge digest summarizing what was learned, updated, and connected in the wiki. Use for readable recent-learning summaries; wiki-status reports source and ingestion state instead.ProductivityNo warnings★ 3.6K↓ —
- htmlplannotator/effective-htmlCreate or redesign self-contained single-file HTML artifacts with a visual direction shaped by the user's brief, project, and subject. Use when HTML is the deliverable for a report, explainer, landing page, presentation, tool, mixed artifact, or broad request. This is the collection's only implicit router. Route clear wireframe, prototype, mockup, plan, or diagram requests to the matching direct-invocation specialist when available. Do not use for ordinary application implementation when a standalone HTML file is not the deliverable.DesignNo warnings★ 3.8K↓ —
- principle-explain-the-numbermichael-denyer/pstack-claudeApply before you measure, and before you trust, report, or act on a number you measured: a speedup, a regression, a throughput, a latency, or an eval result. Find what limits it, and rule out that it measured something other than the work you think.OtherNo warnings★ 3.7K↓ —
variant-analysis
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.
Install
npx skills add trailofbits/skills --skill variant-analysis -a claude-code
Installs to .claude/skills/variant-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (18)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/reporting.md
- references/root-cause.md
- references/searching.md
- references/triage.md
- resources/codeql/cpp.ql
- resources/codeql/go.ql
- resources/codeql/java.ql
- resources/codeql/javascript.ql
- resources/codeql/python.ql
- +6 more