Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 16 hours ago
48,622 skills
- groq-observabilityjeremylongshore/tons-of-skills-marketplaceSet up observability for Groq integrations: latency histograms, token throughput, rate limit gauges, cost tracking, and Prometheus alerts. Use when instrumenting Groq API calls, building a metrics dashboard, or wiring latency/cost/rate-limit alerts. Trigger with phrases like "groq monitoring", "groq metrics", "groq observability", "monitor groq", "groq alerts", "groq dashboard".DevOpsNo warnings★ 2.9K↓ —
- critiqueplugin87/ux-ui-agent-skillsAdversarial design critique of the current work. Render it, look at it, and argue for rejection. Run after the gates are green, never instead of them.DesignNo warnings★ 3.1K↓ —
- brief-generatoraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "create an influencer brief" or "write a campaign brief"; produces a structured creator brief with deliverables, key messages, creative direction, timeline, disclosure rules, and compensation terms. Not for choosing how to split spend across creators — use budget-optimizer. 达人合作简报/创作者BFMarketingNo warnings★ 3K↓ —
- ctf-ai-mlljagiello/ctf-skillsProvides AI and machine learning techniques for CTF challenges. Use when attacking ML models, crafting adversarial examples, performing model extraction, prompt injection, membership inference, training data poisoning, fine-tuning manipulation, neural network analysis, LoRA adapter exploitation, LLM jailbreaking, or solving AI-related puzzles.OtherNo warnings★ 3.6K↓ —
- golang-dependency-managementsamber/cc-skills-golangDependency management for Golang projects — go.mod and go.sum, `go get` install and upgrade flows, Minimal Version Selection, conflict resolution with replace/exclude/retract, `govulncheck` scanning of the module tree, outdated dependency and binary size auditing, vendoring, `tool` directives, and go.work workspaces. Use when adding, removing, or upgrading Go dependencies, deciding whether to take on a package, resolving version conflicts, or auditing what a module pulls in. Covers choosing and upgrading dependency versions, not the surrounding tooling: do NOT use for fixing an exploitable vulnerability in code (→ See `samber/cc-skills-golang@golang-security` skill) or for wiring Dependabot/Renovate update bots into CI workflows (→ See `samber/cc-skills-golang@golang-continuous-integration` skill).SecurityNo warnings★ 3.7K↓ —
- pulumi-upgrade-providerpulumi/agent-skillsAutomate Pulumi provider repo upgrades with the `upgrade-provider` tool. Use when upgrading a pulumi provider repository to a new upstream version, running `upgrade-provider`, and addressing its common failure modes like patch conflicts or missing module mappings.OfficialOtherNo warnings★ 78↓ —
- fondo-install-authjeremylongshore/tons-of-skills-marketplaceSet up Fondo account and configure integrations with Gusto, QuickBooks, and bank accounts for automated startup bookkeeping and R&D tax credits. Trigger: "setup fondo", "fondo account", "fondo integrations", "connect fondo".FinanceNo warnings★ 2.9K↓ —
- contribute-publishjeremylongshore/tons-of-skills-marketplacePublish one prepared OSS contribution action to GitHub after a fresh human approval boundary. Shows the exact target, content, command, commit, and test evidence before any mutation. Use when local preparation is complete and the user explicitly asks to post a claim, create a Design Issue, comment, push a branch, or open a pull request. Trigger with "/contribute-publish" or "publish this prepared contribution".TestingNo warnings★ 2.9K↓ —
- golang-spf13-vipersamber/cc-skills-golangGolang configuration library using spf13/viper — layered precedence (flag > env > file > KV > default), BindPFlag/BindPFlags, SetEnvPrefix + SetEnvKeyReplacer + AutomaticEnv, ReadInConfig + ConfigFileNotFoundError, Unmarshal + mapstructure struct tags, Sub for sub-trees, WatchConfig + OnConfigChange for hot reload, viper.New() for test isolation, and remote KV integration. Apply when using or adopting spf13/viper, or when the codebase imports `github.com/spf13/viper`. For CLI command structure alongside viper, see the `samber/cc-skills-golang@golang-spf13-cobra` skill. For general CLI architecture, see `samber/cc-skills-golang@golang-cli`.TestingNo warnings★ 3.7K↓ —
- golang-uber-digsamber/cc-skills-golangImplements dependency injection in Golang using uber-go/dig — reflection-based container, Provide/Invoke, dig.In/dig.Out parameter and result objects, named values, value groups, optional dependencies, scopes, and Decorate. Apply when using or adopting uber-go/dig, when the codebase imports `go.uber.org/dig`, or when wiring an application graph at startup. For higher-level lifecycle and modules, see `samber/cc-skills-golang@golang-uber-fx` skill.OtherNo warnings★ 3.7K↓ —
- jetson-set-targetNVIDIA/skillsSwitch the active Jetson target-platform pointer to an existing profile YAML. Use before customize/build/flash to change target; not for authoring profiles — use jetson-init-target instead.OtherNo warnings★ 3.8K↓ —
- load-testing-apisjeremylongshore/tons-of-skills-marketplaceExecute comprehensive load and stress testing to validate API performance and scalability. Use when validating API performance under load. Trigger with phrases like "load test the API", "stress test API", or "benchmark API performance".TestingNo warnings★ 2.9K↓ —
- media-useUpdatedheygen-com/hyperframesGet or make any media for a HyperFrames video - music, sound effects, images, icons, logos, voiceover, avatar and generated video, transcripts, cutouts, colour grades and looks - with HeyGen or free local tools, and mix placed audio. Also for footage that looks dark, flat or dull, or should be stylized or hidden.OfficialMediaNo warnings★ 76.9K↓ —
- principle-explain-the-numbermichael-denyer/pstack-claudeApply before you measure, and before you trust, report, or act on a number you measured: a speedup, a regression, a throughput, a latency, or an eval result. Find what limits it, and rule out that it measured something other than the work you think.OtherNo warnings★ 3.7K↓ —
- adobe-load-scalejeremylongshore/tons-of-skills-marketplaceDerive a safe Adobe workload envelope from synthetic load, queue/backpressure behavior, current service constraints, spend, and output correctness. Use when the task requires adobe capacity and load envelope. Trigger with "load test Adobe", "scale Firefly jobs", or "Adobe capacity plan".TestingNo warnings★ 2.9K↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 10.2K↓ —
- node-zombie-guardianforyourhealth111-pixel/Vibe-SkillsUse when diagnosing stale or orphaned Node.js processes launched by VCO, auditing ownership/liveness, or safely simulating cleanup without touching external Node workloads.OtherNo warnings★ 3.8K↓ —
- youtube-fulldavepoon/buildwithclaudeUse when YouTube is or could be relevant — video/channel/playlist links, video IDs, @handles, creator lookups, summaries, quotes, topic research, tutorials, talks, product reviews, or anywhere video content is fresher or richer than text search. Covers transcripts, video/channel search, channel browsing, playlists, and in-channel search.MediaNo warnings★ 3.7K↓ —
- planejeremylongshore/tons-of-skills-marketplacePlane is a team behavior observatory — synthesize Plane API data into observations about how teams actually behave under pressure, not just ticket state. Five compound commands surface cycle velocity vs. plan, stale-ticket ownership churn, reviewer gate strength, stated-vs-actual priority drift, and cross-project workload concentration. Reads from the live mcp__plane MCP server when present; documentation-only otherwise. Use when investigating "why is this team's plan diverging from reality", auditing cycle health, finding orphan tickets, identifying review bottlenecks, or onboarding to a new project. Trigger with "/plane-cycle-velocity", "/plane-stale-tickets", "/plane-reviewer-gate-strength", "/plane-priority-drift", "/plane-cross-project-load", "audit Plane cycle", "team behavior plane", "how is my team behaving".PlanningNo warnings★ 2.9K↓ —
- principle-prove-it-worksmichael-denyer/pstack-claudeApply after completing a task, before declaring done. Verify against the real artifact (run the feature, read the actual value, inspect the diff), not a proxy, self-report, or 'it compiles.'ProductivityNo warnings★ 3.7K↓ —
- secure-workflow-guidetrailofbits/skillsGuides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas. Use when securing a smart contract end to end rather than hunting one bug, checking a project on every check-in or before deployment, triaging a Slither report, or asking where to start on smart contract security.ProductivityNo warnings★ 7.9K↓ —
- mass-ulwcode-yeongyu/oh-my-openagentDrives dependency-ordered child work through the native workflow tool, each phase's stages defined up front in one run, with retry/amend/send recovery. Use when the user asks for mass-ulw, a DAG of tasks, or fan-out work where some tasks must wait on others.ProductivityNo warnings★ 70.6K↓ —
- gsd:complete-milestonedavepoon/buildwithclaudeArchive completed milestone and prepare for next versionOtherNo warnings★ 3.7K↓ —
- technical-seo-checkeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "check technical SEO"; audits crawlability, indexing, Core Web Vitals, robots.txt, sitemaps, canonicals, redirects, and migrations. Not for on-page tags or content — use on-page-seo-checker. 技术SEO/网站速度MarketingNo warnings★ 3K↓ —
constant-time-testing
trailofbits/skills
TestingUpdated 5 days ago
From the author
Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.
Install
npx skills add trailofbits/skills --skill constant-time-testing -a claude-code
Installs to .claude/skills/constant-time-testing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg