Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 10 hours ago
48,622 skills
- get-pr-commentsmichael-denyer/pstack-claudeFetch and summarize review comments from the active pull requestEngineeringNo warnings★ 3.7K↓ —
- kiro-steeringgotalab/cc-sddManage {{KIRO_DIR}}/steering/ as persistent project knowledgeOtherNo warnings★ 3.7K↓ —Also in 5 other repos
- kiro-implgotalab/cc-sddImplement approved tasks using TDD with subagent dispatch. Runs all pending tasks autonomously or selected tasks manually.TestingNo warnings★ 3.7K↓ —
- principle-model-the-domainmichael-denyer/pstack-claudeApply when writing stateful logic, or when code branches a lot or repeats a shape assumption across files.WritingNo warnings★ 3.7K↓ —
- doca-aes-gcmNVIDIA/skillsUse this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or "AEAD" — typical implicit phrasings: "decrypt completion IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.SecurityNo warnings★ 3.8K↓ —
- blast-radiusbacknotprop/pstackFind what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', or reviewing a small diff you don't trust.WritingNo warnings★ 3.3K↓ —
- miro-rate-limitsjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side Miro REST traffic controls from credit weights, supplied headers, bounded queues, and reset-aware retries. Use when preventing or recovering from Miro 429 responses. Trigger with "Miro rate limit".DesignNo warnings★ 2.9K↓ —
- skill-channels-uploadZJU-REAL/Easel微信视频号发布：把竖版短视频发布到微信视频号（channels.weixin.qq.com）。当用户说 "发视频号""上传视频号""视频号发布""发到微信视频号""视频号投稿"时使用。基于通用浏览器 发布框架（Playwright + 登录态持久化），微信扫码登录。TestingNo warnings★ 4.3K↓ —
- markdown-mermaid-writingforyourhealth111-pixel/Vibe-SkillsComprehensive markdown and Mermaid diagram writing skill that establishes text-based diagrams as the DEFAULT documentation standard. Use this skill when creating ANY scientific document, report, analysis, or visualization — it ensures all outputs are in version-controlled, token-efficient markdown with embedded Mermaid diagrams as the source of truth, with clear pathways to downstream Python or AI-generated images. Includes full style guides (markdown + mermaid), 24 diagram type references, and 9 document templates ready to use.WritingNo warnings★ 3.8K↓ —
- trailmark-review-gatetrailofbits/skillsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.EngineeringNo warnings★ 7.9K↓ —
- json-canvasdavepoon/buildwithclaudeCreate and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.WritingNo warnings★ 3.7K↓ —Also in 1 other repo
- golang-swaggersamber/cc-skills-golangGolang OpenAPI/Swagger documentation with swaggo/swag — annotation comments (@Summary, @Param, @Success, @Router, @Security), swag init code generation, framework integrations (gin, echo, fiber, chi, net/http), security definitions (Bearer/JWT, OAuth2, API key), and struct tags (swaggertype, enums, example, swaggerignore). Apply when adding or maintaining Swagger/OpenAPI docs in a Go project, or when the codebase imports github.com/swaggo/swag, github.com/swaggo/gin-swagger, github.com/swaggo/echo-swagger, github.com/swaggo/http-swagger, or github.com/swaggo/files.SecurityNo warnings★ 3.7K↓ —
- ai-video-genZJU-REAL/EaselAI 视频生成：文生视频 / 图生视频 / 数字人首帧驱动。通过可插拔 provider（通义万相 Wan / 火山 Seedance / 快手可灵 / OpenAI 兼容）异步生成视频，用户自备 API key。当用户说 AI 视频生成、文生视频、图生视频、AI 生成视频、AI 短视频、让图片动起来、数字人视频、生成一段视频 时使用。与 video-strategy（选型/策略）、video-editing（剪辑处理）、clipify（切片）区别：本 SKILL 是从 0 用 AI 生成新视频。MediaNo warnings★ 4.3K↓ —
- golang-stay-updatedsamber/cc-skills-golangGolang ecosystem watch list — official sources (go.dev/blog, pkg.go.dev, tour.golang.org, golang-nuts), newsletters (Golang Weekly, Awesome Go Newsletter), communities (r/golang, gophers.slack.com, Go Forum, go.dev/wiki), blogs (Dave Cheney, Ardan Labs, Rob Pike), YouTube channels (Gopher Academy, GopherCon EU/UK), conferences, and Go contributors to follow on GitHub, X and Bluesky. Use when seeking Golang learning resources, discovering new libraries or tools, finding community channels or meetups, picking Go people to follow, or keeping up with Go language changes and releases. Not for querying a specific module's versions, docs, or vulnerabilities from the CLI (→ See `samber/cc-skills-golang@golang-pkg-go-dev` skill).SecurityNo warnings★ 3.7K↓ —
- nemo-retrieverNVIDIA/skillsUse when searching, extracting, ingesting, or querying a document collection with the NeMo Retriever 26.8.1 CLI, including local LanceDB indexes and deployed Retriever services. Use for PDFs, images, Office files, HTML, text, audio, and video; not for editing documents or web search.DevOpsNo warnings★ 3.8K↓ —
- video-scriptZJU-REAL/Easel生成视频脚本，覆盖短视频（7-60秒）到中长视频（1-30分钟）全时长。 短视频：Hook 变体评分、分秒计时、字幕文案、封面方案。 中长视频：留存率优化、节奏中断点、前向钩子、章节结构。 适用于抖音、视频号、小红书视频、B站、YouTube 等平台。 当用户说"视频脚本"、"短视频脚本"、"抖音脚本"、"B站脚本"、 "视频号脚本"、"竖版视频"、"Reel 脚本"、"写个视频文案"时使用。 和 video-strategy 的区别：video-strategy 做视频内容规划和系列策划， video-script 写具体某一条视频的脚本。MediaNo warnings★ 4.3K↓ —
- paid-ads-chatgptnowork-studio/notfair-pluginPlan and review ChatGPT Ads experiments without assuming ad inventory, account access, or platform capabilities. Use for ChatGPT advertising, OpenAI ads, conversational ad concepts, ChatGPT campaign plans, or performance reviews from a verified export.MarketingNo warnings★ 4.1K↓ —
- ai-image-genZJU-REAL/Easel通用 AI 生图：文生图 / 图生图 / 图像变体。当用户说 AI 生图、AI 画图、文生图、图生图、生成图片、生成配图、图像生成、AI 出图、AI 作图、换图、改图、图像编辑、给我画一张、生成一张图 时使用。支持 OpenAI 兼容 API 与 apimart 异步 API，用户自备 API key。MediaNo warnings★ 4.3K↓ —
- skyverndavepoon/buildwithclaudeAI-powered browser automation — navigate sites, fill forms, extract structured data, log in with stored credentials, and build reusable multi-step workflows using natural language. Install: pip install skyvern && skyvern setupBrowserNo warnings★ 3.7K↓ —
- rust-reviewtrailofbits/skillsPerforms comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS, FFI safety, and async runtime mistakes. Use when auditing Rust crates, services, or libraries — particularly those with `unsafe`, FFI, or concurrent code.EngineeringNo warnings★ 7.9K↓ —
- gsd:session-reportdavepoon/buildwithclaudeGenerate a session report with token usage estimates, work summary, and outcomesProductivityNo warnings★ 3.7K↓ —
- doca-uromNVIDIA/skillsHost-side DOCA UROM library (doca_urom_*): offload an HPC / UCX / MPI application's remote memory operations (puts, gets, atomics, collectives) from the host CPU onto a BlueField DPU. Trigger on "MPI all-reduce burning host CPU", "push UCX traffic onto the BlueField", "first doca_urom call returns NOT_PERMITTED", or "host library and DPU service look out of sync", even without naming DOCA UROM. An offload needs both halves: this host library and the UROM Service on the DPU (doca-urom-svc), which owns deploying that container. Covers creating UROM Service contexts (doca_urom_service_*) and Worker contexts (doca_urom_worker_*) that run plugins on the DPU, discovering plugins via doca_urom_service_get_plugins_list, progressing completions, and DOCA_ERROR_* from doca_urom_* calls. Route elsewhere for UROM Service deployment on the DPU side, MPI / UCX collective algorithm design, and RDMA / RoCE / IB substrate bring-up.DevOpsNo warnings★ 3.8K↓ —
- pulumi-automation-apipulumi/agent-skillsLoad this skill when a user asks how to run Pulumi programmatically, embed Pulumi in an application, orchestrate multiple stacks in code, build a self-service infrastructure portal, replace pulumi CLI shell scripts with code, or use the Pulumi Automation API (LocalWorkspace, createOrSelectStack, inline programs). Also load for questions about multi-stack sequencing, parallel deployments, or passing outputs between stacks via code.OfficialEngineeringNo warnings★ 78↓ —
- speckit-planforyourhealth111-pixel/Vibe-SkillsGenerate technical implementation plans from feature specifications. Use after creating a spec to define architecture, tech stack, and implementation phases. Creates plan.md with detailed technical design.PlanningNo warnings★ 3.8K↓ —
agentic-actions-auditor
trailofbits/skills
SecurityUpdated 4 days ago
From the author
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
Install
npx skills add trailofbits/skills --skill agentic-actions-auditor -a claude-code
Installs to .claude/skills/agentic-actions-auditor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (15)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/action-profiles.md
- references/cross-file-resolution.md
- references/foundations.md
- references/vector-a-env-var-intermediary.md
- references/vector-b-direct-expression-injection.md
- references/vector-c-cli-data-fetch.md
- references/vector-d-pr-target-checkout.md
- references/vector-e-error-log-injection.md
- references/vector-f-subshell-expansion.md
- +3 more