Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 10 hours ago
48,622 skills
- splitting-datasetsjeremylongshore/tons-of-skills-marketplaceProcess split datasets into training, validation, and testing sets for ML model development. Use when requesting "split dataset", "train-test split", or "data partitioning". Trigger with relevant phrases based on skill purpose.TestingNo warnings★ 2.9K↓ —
- principle-outcome-oriented-executionbacknotprop/pstackApply during planned rewrites and migrations with explicit phase boundaries. Converge on the target architecture; don't preserve smooth intermediate states with throwaway compatibility code.PlanningNo warnings★ 3.3K↓ —Also in 2 other repos
- embedding-strategiesforyourhealth111-pixel/Vibe-SkillsSelect and optimize embedding models for semantic search and RAG applications. Use when choosing embedding models, implementing chunking strategies, or optimizing embedding quality for specific domains.PlanningNo warnings★ 3.8K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 10.2K↓ —
- data-storytellingforyourhealth111-pixel/Vibe-SkillsTransform data into compelling narratives using visualization, context, and persuasive structure. Use when presenting analytics to stakeholders, creating data reports, or building executive presentations.DataNo warnings★ 3.8K↓ —
- trailmarktrailofbits/skillsBuilds and queries multi-language source and binary code graphs for security analysis. Includes pre-analysis passes for blast radius, taint propagation, privilege boundaries, entry point enumeration, proxy/unresolved-call tracking, type/reference queries, structural traversal, graph diffs, audit augmentation, declared cross-language/FFI/external links via `.trailmark/links.toml`, and SQL schema graphs. Use when analyzing call paths, mapping attack surface, finding complexity hotspots, enumerating entry points, tracing taint propagation, measuring blast radius, importing SARIF/weAudit/binary findings, linking source graphs across language or RPC boundaries, or building a code graph for audit prioritization. Feature-gate version-specific Trailmark APIs before using them; prefer `trailmark.parse.detect_languages()` or `--language auto` when the target language is unknown or polyglot.SecurityNo warnings★ 7.9K↓ —
- cursor-team-setupjeremylongshore/tons-of-skills-marketplaceSet up Cursor for teams: plan selection, member management, shared rules, admin dashboard, and onboarding. Triggers on "cursor team", "cursor organization", "cursor business", "cursor enterprise setup", "cursor admin".PlanningNo warnings★ 2.9K↓ —
- wiki-exportAr9av/obsidian-wikiExport the Obsidian wiki graph to JSON, GraphML, Neo4j Cypher, Postgres/SQL, HTML, or OKF bundles. Use when transferring or visualizing wiki data in external tools; wiki-import handles the reverse direction.DataNo warnings★ 3.6K↓ —
- offensive-wifi-reconSnailSploit/Claude-RedWi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving with Kismet/airodump-ng/Wigle, and structured airspace data capture for downstream attacks. Use at the start of any wireless engagement to build the target map before active attacks; covers 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E) bands and adapter compatibility for each.LegalNo warnings★ 10.2K↓ —
- offensive-wpa-enterpriseSnailSploit/Claude-RedWPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.MarketingNo warnings★ 10.2K↓ —
- figma-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Figma API usage to minimize costs and stay within plan limits. Use when analyzing request volumes, reducing unnecessary API calls, or choosing the right Figma plan for your integration needs. Trigger with phrases like "figma cost", "figma pricing", "reduce figma API calls", "figma plan limits", "figma budget".DesignNo warnings★ 2.9K↓ —
- no-commentsmichael-denyer/pstack-claudeSpawn the comment-sicko subagent, fix accepted findings, and offer encodings for claimed constraints.OtherNo warnings★ 3.7K↓ —
- scvi-toolsanthropics/knowledge-work-pluginsDeep learning for single-cell analysis using scvi-tools. This skill should be used when users need (1) data integration and batch correction with scVI/scANVI, (2) ATAC-seq analysis with PeakVI, (3) CITE-seq multi-modal analysis with totalVI, (4) multiome RNA+ATAC analysis with MultiVI, (5) spatial transcriptomics deconvolution with DestVI, (6) label transfer and reference mapping with scANVI/scArches, (7) RNA velocity with veloVI, or (8) any deep learning-based single-cell method. Triggers include mentions of scVI, scANVI, totalVI, PeakVI, MultiVI, DestVI, veloVI, sysVI, scArches, variational autoencoder, VAE, batch correction, data integration, multi-modal, CITE-seq, multiome, reference mapping, latent space.OfficialOtherNo warnings★ 34.3K↓ —
- hedgefundmonitorforyourhealth111-pixel/Vibe-SkillsQuery the OFR (Office of Financial Research) Hedge Fund Monitor API for hedge fund data including SEC Form PF aggregated statistics, CFTC Traders in Financial Futures, FICC Sponsored Repo volumes, and FRB SCOOS dealer financing terms. Access time series data on hedge fund size, leverage, counterparties, liquidity, complexity, and risk management. No API key or registration required. Use when working with hedge fund data, systemic risk monitoring, financial stability research, hedge fund leverage or leverage ratios, counterparty concentration, Form PF statistics, repo market data, or OFR financial research data.ScienceNo warnings★ 3.8K↓ —
- agentic-actions-auditortrailofbits/skillsAudits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.SecurityNo warnings★ 7.9K↓ —
- bromichael-denyer/pstack-claudeRestate the last message in plain human language, with no jargon. Use for /bro or when asked to say it plainly.OtherNo warnings★ 3.7K↓ —
- kiro-discoverygotalab/cc-sddEntry point for new work. Determines the best action path or work decomposition (update existing spec, create new spec, mixed decomposition, or no spec needed) and refines ideas through structured dialogue.PlanningNo warnings★ 3.7K↓ —
- golang-observabilitysamber/cc-skills-golangGolang everyday observability — the always-on signals in production. Covers structured logging with slog, Prometheus metrics, OpenTelemetry distributed tracing, continuous profiling with pprof/Pyroscope, server-side RUM event tracking, alerting, and Grafana dashboards. Apply when instrumenting Go services for production monitoring, setting up metrics or alerting, adding OpenTelemetry tracing, correlating logs with traces, migrating legacy loggers (zap/logrus/zerolog) to slog, adding observability to new features, or implementing GDPR/CCPA-compliant tracking with Customer Data Platforms (CDP). Not for temporary deep-dive performance investigation (→ See `samber/cc-skills-golang@golang-benchmark` and `samber/cc-skills-golang@golang-performance` skills).DevOpsNo warnings★ 3.7K↓ —
- cdf-augmentationNVIDIA/skillsUse when authoring or validating Cosmos Data Factory (CDF) augmentation YAML configs, or running remote Cosmos Transfer (including Cosmos3 WSM controls), Cosmos Predict, image-edit, or image-to-video inference.MediaNo warnings★ 3.8K↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 10.2K↓ —
- artifact-creatorjeremylongshore/tons-of-skills-marketplaceCreate or revise Agent Skills, host plugins and subagents, MCP servers and client configurations, hooks, and marketplace catalogs against their actual specifications. Use when building reusable agent capabilities or consolidating creator tooling without inventing a universal host format. Trigger with "create an agent skill", "build a plugin", "create an MCP server", "add a subagent", or "scaffold an agent integration".PlanningNo warnings★ 2.9K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md sequentially by dependency wave in Cascade.PlanningNo warnings★ 3.7K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
gsd:autonomous
davepoon/buildwithclaude
PlanningUpdated 16 hours ago
From the author
Run all remaining phases autonomously — discuss→plan→execute per phase
Install
npx skills add davepoon/buildwithclaude --skill gsd:autonomous -a claude-code
Installs to .claude/skills/gsd-autonomous/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md