Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 20 hours ago
45,010 skills
- yaml-masterjeremylongshore/tons-of-skills-marketplaceExecute proactive YAML intelligence: automatically activates when working with YAML files. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- figma-install-authjeremylongshore/tons-of-skills-marketplaceSet up Figma REST API authentication with personal access tokens or OAuth 2.0. Use when connecting to the Figma API, generating tokens, configuring scopes, or setting up OAuth flows for Figma integrations. Trigger with phrases like "install figma", "setup figma API", "figma auth", "figma personal access token", "figma OAuth".DesignNo warnings★ 2.9K↓ —
- vercel-hello-worldjeremylongshore/tons-of-skills-marketplaceCreate a minimal working Vercel deployment with a serverless API route. Use when starting a new Vercel project, testing your setup, or learning basic Vercel deployment and API route patterns. Trigger with phrases like "vercel hello world", "vercel example", "vercel quick start", "simple vercel project", "first vercel deploy".TestingNo warnings★ 2.9K↓ —
- i4h-workflow-validateNVIDIA/skillsRun the root-level workflow runtime policy or rule-based rollouts and verify simulator success. Use for evaluation, checkpoints, or local controllers; do not use for replay or dataset annotation.ProductivityNo warnings★ 3.8K↓ —
- writing-docsforyourhealth111-pixel/Vibe-SkillsGuides for writing and editing Remotion documentation. Use when adding docs pages, editing MDX files in packages/docs, or writing documentation content.WritingNo warnings★ 3.8K↓ —
- clade-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Anthropic API costs — model selection, prompt caching, batches, Use when working with cost-tuning patterns. token reduction, and usage monitoring. Trigger with "anthropic pricing", "claude cost", "reduce anthropic spend", "anthropic billing", "claude cheaper".EngineeringNo warnings★ 2.9K↓ —
- adobe-load-scalejeremylongshore/tons-of-skills-marketplaceDerive a safe Adobe workload envelope from synthetic load, queue/backpressure behavior, current service constraints, spend, and output correctness. Use when the task requires adobe capacity and load envelope. Trigger with "load test Adobe", "scale Firefly jobs", or "Adobe capacity plan".TestingNo warnings★ 2.9K↓ —
- google-ads-assetsnowork-studio/notfair-pluginPlan, validate, and safely publish Google Ads assets, including sitelinks, callouts, structured snippets, image assets, and Performance Max asset briefs. Use when asked for Google Ads assets, ad extensions, sitelinks, callouts, snippets, image assets, Performance Max assets, PMax creative, or an asset audit.MarketingNo warnings★ 4.1K↓ —
- paid-ads-integrationsnowork-studio/notfair-pluginDiscover, connect, and verify NotFair paid-ad integrations and their actual capabilities. Use when asked to connect an ad account, configure an ads MCP, check available tools, troubleshoot access, or determine whether NotFair can read or change a platform.MarketingNo warnings★ 4.1K↓ —
- consent-registryUpdatedaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "log this subscriber's opt-in", record unsubscribes/complaints, or query lawful basis; curates pseudonymous consent facts through the append-only consent stream and applies suppression/erasure tombstones immediately. Not for SEND scoring — use email-quality-auditor; not for building segments — use list-segment-builder. 订阅同意台账/实时退订抑制/合法性依据登记ProductivityNo warnings★ 3K↓ —
- html-pptnexu-io/open-designFor consulting delivery work: turn diagnosis, frameworks, and project work into a client-adoptable action plan. Built around the core query "consulting-final-deck", with engagement manager judgment, buyer-ready proof, and this outcome: accept the recommendation and commit owners to the roadmap.DocumentsNo warnings★ 104.8K↓ —
- doca-debugUpdatedNVIDIA/skillsUse this skill when the user is debugging any DOCA symptom — a build that won't compile, a link step that can't resolve a doca_* symbol, a runtime call returning DOCA_ERROR_*, a silent service or tool, or a stack trace / valgrind / core dump — and needs the layered ladder (install → version → build → link → runtime → program → driver), verbosity controls (--sdk-log-level, DOCA_LOG_LEVEL, the doca-{lib}-trace flavor), container-debug constraints, or how to capture state for a Developer Forum post. Trigger even when the user does not say "DOCA debug" — implicit phrasings include "undefined reference to doca_*", "how do I get more logs", "packets aren't reaching the wire", "doca_caps returned nothing", or "hugepages empty in the container". Refuse and route elsewhere for library-specific debug (Flow pipe trace, RDMA QP, Comch stats), env-class pkg-config or hugepages symptoms, the DOCA_ERROR_* taxonomy and lifecycle interpretation, and performance or incident-response work — those belong to other skills.EngineeringNo warnings★ 3.8K↓ —
- meta-ads-auditnowork-studio/notfair-pluginMeta Ads (Facebook + Instagram) account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my Meta ads", "audit my Facebook ads", "Meta ads audit", "set up my Meta ads", "onboard Meta", "Meta account overview", "how's my Meta account", "Meta health check", "what should I fix in my Facebook ads", or when the user is new to NotFair Meta and hasn't run an audit before.MarketingNo warnings★ 4.1K↓ —
- kiro-discoverygotalab/cc-sddEntry point for new work. Determines the best action path or work decomposition (update existing spec, create new spec, mixed decomposition, or no spec needed) and refines ideas through structured dialogue.PlanningNo warnings★ 3.7K↓ —
- narrative-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to record/query the brand narrative canon, tagline, message hierarchy, voice/naming rules, or a canon re-version; curates complete versioned canon events through the append-only narrative stream and derived views. Not for TALE scoring — use narrative-quality-auditor; not for authoring the system — use message-system-architect. 品牌叙事台账/canon 记录/语气与命名规范PlanningNo warnings★ 3K↓ —
- wiki-stage-commitAr9av/obsidian-wikiReview staged wiki writes and promote accepted pages to final locations when WIKI_STAGED_WRITES is enabled. Use for staging approval/commit; rejected pages return to _raw/ for editing.EngineeringNo warnings★ 3.6K↓ —
- video-to-articleZJU-REAL/Easel把口播、讲座、直播或 Vlog 转录并改写成小红书笔记、公众号文章或知乎内容，同时抽帧配图。当用户说“视频转图文/文章/笔记、视频扒文案、口播转文章、视频内容复用”时使用。只生成字幕文件用 auto-subtitle；翻译已有字幕用 subtitle-translate。MediaNo warnings★ 4.2K↓ —
- exa-sdk-patternsjeremylongshore/tons-of-skills-marketplaceIsolate exa-js or exa-py behind an application-owned adapter that preserves current request semantics and safe evidence. Use when operating or reviewing this Exa boundary. Trigger with "Exa sdk patterns", "review Exa sdk patterns", or "fix Exa sdk patterns".EngineeringNo warnings★ 2.9K↓ —
- tao-run-dinov3-ssl-deftNVIDIA/skillsRun iterative DINOv3 SSL DEFT data selection and retraining from an unlabeled pool, using GRIT or multi-task weakness and fixed-encoder retrieval. Use for active-learning-style DINOv3 mining, not plain pretraining/fine-tuning (tao-train-dinov3) or AOI/PAS DEFT.ProductivityNo warnings★ 3.8K↓ —
- opencli-readerhimself65/finance-skillsGeneric read-only fallback for sources opencli supports but no dedicated skill covers: finance sites (Yahoo Finance, Bloomberg, Reuters, Barchart, Eastmoney, Xueqiu, Sinafinance), communities (Reddit, HackerNews, Weibo, Zhihu, Xiaohongshu, Bilibili), newsletters and blogs (Substack, Medium), research (arXiv, Google Scholar), podcasts and video (Apple Podcasts, Xiaoyuzhou, Spotify, YouTube), Weixin, Amazon, and more. Use it when the user asks to read or fetch from such a site — for example r/wallstreetbets, the HackerNews front page, Eastmoney hot stocks, the Xueqiu feed, Bloomberg markets headlines, or an arXiv search — or says "use opencli to read". Prefer twitter-reader, linkedin-reader, discord-reader, telegram-reader, or yc-reader when the source matches. Read-only: never runs write commands.MediaNo warnings★ 3.5K↓ —
- skill-carousel-plannerZJU-REAL/Easel规划轮播图/多图笔记的分页结构：封面 Hook、内容节奏、每页文案和视觉方向、CTA 设计，附互动评分。 当用户说"轮播图策划""多图笔记""图集结构""分页设计""九宫格怎么排""每页写什么""carousel"时使用。 本 SKILL 出分页结构与文案规划（策划层）；实际渲染卡片图用 card-xiaohongshu / xhs-note-creator。PlanningNo warnings★ 4.2K↓ —
- speak-install-authjeremylongshore/tons-of-skills-marketplaceSet up Speak language learning API integration and authentication. Use when configuring Speak API access, setting up OAuth with OpenAI Realtime API for speech, or initializing a language tutoring application. Trigger with phrases like "install speak", "setup speak", "speak auth", "configure speak API", "speak language learning setup".EngineeringNo warnings★ 2.9K↓ —
- estimate-analysishimself65/finance-skillsAnalyze sell-side analyst estimates and how they are changing, using Yahoo Finance data (yfinance): EPS and revenue consensus by period, estimate ranges and dispersion, revision trends over 7/30/60/90 days and up/down revision breadth, growth estimates vs industry, sector, and the S&P 500, and historical estimate accuracy. Use this skill when the user wants more than a single estimate lookup: estimate revisions or momentum, EPS trend, consensus changes, forward or next-quarter and annual estimates, the bull vs bear estimate spread, or growth projections across periods.FinanceNo warnings★ 3.5K↓ —
- wiki-researchAr9av/obsidian-wikiPerform multi-round web research on a topic, synthesize the findings, and file structured results into the Obsidian wiki. Use for comprehensive web-sourced research intended to become wiki knowledge.ScienceNo warnings★ 3.6K↓ —
variant-analysis
trailofbits/skills
SecurityUpdated 2 days ago
From the author
Hunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.
Install
npx skills add trailofbits/skills --skill variant-analysis -a claude-code
Installs to .claude/skills/variant-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (18)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- references/reporting.md
- references/root-cause.md
- references/searching.md
- references/triage.md
- resources/codeql/cpp.ql
- resources/codeql/go.ql
- resources/codeql/java.ql
- resources/codeql/javascript.ql
- resources/codeql/python.ql
- +6 more