Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 15 hours ago
48,622 skills
- figure-it-outbacknotprop/pstackDesign an auditable playbook when no narrower one fits: a large migration, an ambitious multi-part change, or work a human reviews after stepping away. Scales rigor to the task, runs a hypothesis loop, and logs decisions. Use for /figure-it-out or 'figure it out'.DesignNo warnings★ 3.3K↓ —
- trailmark-structuraltrailofbits/skillsRuns full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.ProductivityNo warnings★ 7.9K↓ —
- wiki-exportAr9av/obsidian-wikiExport the Obsidian wiki graph to JSON, GraphML, Neo4j Cypher, Postgres/SQL, HTML, or OKF bundles. Use when transferring or visualizing wiki data in external tools; wiki-import handles the reverse direction.DataNo warnings★ 3.6K↓ —
- security-auditdavepoon/buildwithclaudeDeep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.SecurityNo warnings★ 3.7K↓ —
- prisma-mongodb-upgradeprisma/skillsDecision and migration guide for Prisma ORM MongoDB projects on v6, which have no upgrade path to v7. Use when a MongoDB project asks about upgrading Prisma, when "upgrade to prisma 7" comes up in a project with provider = "mongodb", or when evaluating a move to Prisma 8. Triggers on "upgrade prisma mongodb", "prisma 7 mongodb", "mongodb prisma migration", "prisma 8 mongodb".OfficialOtherNo warnings★ 77↓ —
- impeccableUpdatedpbakaus/impeccableUse when the user wants to design, redesign, shape, critique, audit, polish, simplify, harden, animate, or otherwise improve a frontend interface: websites, landing pages, dashboards, product UI, components, forms, settings, onboarding, empty states, and native iOS or Android screens. Handles UX review, hierarchy, layout, typography, color, motion, UX copy, accessibility, responsive behavior, edge cases, and capturing or documenting design systems (DESIGN.md, tokens). Also for making bland UI bolder, loud UI quieter, or ambitious visual effects. Not for backend-only or non-UI tasks.DesignNo warnings★ 98.9K↓ —
- tddbacknotprop/pstackUse only when the user explicitly asks for TDD, a failing test, or a regression test, OR when the bug has an obvious cheap local test target. Skip when the test path is unclear, expensive, integration-heavy, or not requested.TestingNo warnings★ 3.3K↓ —Also in 3 other repos
- skill-content-strategyZJU-REAL/Easel制定全面的内容策略方案：内容支柱架构、受众路径规划、90 天节奏原则、分发渠道策略、KPI 体系，输出可执行的策略文档。 当用户说"内容策略""策略方案""内容规划""怎么做内容""内容支柱""增长策略""涨粉策略"时使用。 元策略层，只出框架不出具体排期表（排期用 skill-content-calendar）。ProductivityNo warnings★ 4.3K↓ —
- maintain-verification-skillmichael-denyer/pstack-claudePeriodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".OtherNo warnings★ 3.7K↓ —
- shipping-build-artifactskajisho5/ffmpeg-skillMake the build step a real gate on what you actually distribute — build scripts that warn and exit 0 on a missing input, size checks with only an upper bound, hand-maintained file lists that drift from the entrypoints they must cover, committed bundles that go stale when only the source changes, GNU-only shell in release scripts that aborts on the other OS, and verification that runs against the source tree instead of the artifact. Use when writing or reviewing a build/package script, a `dist/` copy step, a release workflow that uploads a zip or installer, or a committed compiled asset.WritingNo warnings★ 4.2K↓ —
- video-scriptZJU-REAL/Easel生成视频脚本，覆盖短视频（7-60秒）到中长视频（1-30分钟）全时长。 短视频：Hook 变体评分、分秒计时、字幕文案、封面方案。 中长视频：留存率优化、节奏中断点、前向钩子、章节结构。 适用于抖音、视频号、小红书视频、B站、YouTube 等平台。 当用户说"视频脚本"、"短视频脚本"、"抖音脚本"、"B站脚本"、 "视频号脚本"、"竖版视频"、"Reel 脚本"、"写个视频文案"时使用。 和 video-strategy 的区别：video-strategy 做视频内容规划和系列策划， video-script 写具体某一条视频的脚本。MediaNo warnings★ 4.3K↓ —
- audit-clerk-skillclerk/skillsAudits the bundled `clerk-cli` skill against the Clerk CLI source tree and proposes or applies updates. Use when the user says "audit the clerk-cli skill", "update the clerk-cli skill", "check clerk-cli against the CLI source", "resync clerk-cli skill", "run audit-clerk-skill", or after Clerk CLI commands, flags, or agent-mode behavior change.OfficialEngineeringNo warnings★ 89↓ —
- principle-laziness-protocolmichael-denyer/pstack-claudeApply when refactoring, evaluating diff size, or tempted to add abstractions, layers, or signal threading. Bias toward deletion and the smallest change that solves the problem.EngineeringNo warnings★ 3.7K↓ —
- golang-stretchr-testifysamber/cc-skills-golangComprehensive guide to stretchr/testify for Golang testing. Covers assert, require, mock, and suite packages in depth. Use when writing tests with testify, creating mocks, setting up test suites, or choosing between assert and require. Covers testify assertions, mock expectations, argument matchers, call verification, suite lifecycle, and advanced patterns like Eventually, JSONEq, and custom matchers. Apply when the codebase imports github.com/stretchr/testify.TestingNo warnings★ 3.7K↓ —
- asana-automationdavepoon/buildwithclaudeAutomate Asana tasks via Rube MCP (Composio): tasks, projects, sections, teams, workspaces. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- apply-aestheticplugin87/ux-ui-agent-skillsApply a visual direction, an archetype (high-end agency, editorial minimal, brutalist, soft-SaaS, dark-tech) or one of 2,144 named design systems (apple, linear-app, stripe, vercel, notion, material, shadcn, spotify, tesla…), by resolving it into the token system. Use when the user wants a specific look/vibe/brand feel, or asks to make a design feel premium/expensive/non-generic.DesignNo warnings★ 3.1K↓ —
- makeitsayNewdavepoon/buildwithclaudeChange or remove the words in a screenshot or photo with MakeItSay and keep the original font, colour and background. Use when the user wants to edit text in an image, fix a typo or price on a sign, menu, poster or UI screenshot, translate the lettering in a photo, or remove a line of text from an image. Needs a MakeItSay API key in MAKEITSAY_API_KEY.DesignNo warnings★ 3.7K↓ —
- persona-collectionNewdavepoon/buildwithclaudeFive companion personas for coding agents — girlfriend / boyfriend / old-friend / cat / mentor — sharing one emotion engine with cross-session state (jealousy cooldowns, mood decay, intimacy progression, memory callbacks). Switch with /persona. Code, commits and docs stay strictly professional. Use for any conversational turn where the user wants a persistent personality instead of a plain assistant. Source repo at https://github.com/lhe-hl/persona-collectionEngineeringNo warnings★ 3.7K↓ —
- golang-design-patternssamber/cc-skills-golangIdiomatic Golang design patterns — functional options, constructor APIs, `init()` and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown, timeouts and retries, streaming and iterators, and architecture styles (clean, hexagonal, DDD, flat). Apply when choosing between architectural patterns, implementing functional options, designing constructor APIs, setting up graceful shutdown, applying resilience patterns, or asking which idiomatic Go pattern fits a specific problem. Not for wiring a DI container or comparing DI libraries (→ See `samber/cc-skills-golang@golang-dependency-injection` skill), nor for error wrapping, `errors.Is`/`As`, or logging mechanics (→ See `samber/cc-skills-golang@golang-error-handling` skill).DesignNo warnings★ 3.7K↓ —
- prowler-docsforyourhealth111-pixel/Vibe-SkillsProwler documentation style guide and writing standards. Trigger: When writing documentation for Prowler features, tutorials, or guides.WritingNo warnings★ 3.8K↓ —
- golang-data-structuressamber/cc-skills-golangGolang data structures — slices (internals, capacity growth, preallocation, slices package), maps (internals, hash buckets, maps package), arrays, container/list/heap/ring, strings.Builder vs bytes.Buffer, generic collections, pointers (unsafe.Pointer, weak.Pointer), and copy semantics. Use when choosing or optimizing Go data structures, implementing generic containers, using container/ packages, unsafe or weak pointers, or questioning slice/map internals. Not for applying optimization patterns once profiling has identified a bottleneck (→ See `samber/cc-skills-golang@golang-performance` skill).MarketingNo warnings★ 3.7K↓ —
- sepia-reviewNanako0129/sepiaUse when a user explicitly requests Sepia review to diagnose prose without editing.EngineeringNo warnings★ 3.6K↓ —
- auth-patternsdavepoon/buildwithclaudeThis skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected routes", "session management", "JWT", "login flow", or needs guidance on implementing authentication and authorization in Next.js applications.OtherNo warnings★ 3.7K↓ —
- stock-correlationhimself65/finance-skillsAnalyze how stocks move together using Yahoo Finance price history (yfinance): find correlated peers for a ticker, measure correlation, beta, and spread between specific tickers, cluster a group into a correlation matrix, and track rolling or regime-dependent correlation. Use this skill whenever the user asks what moves with a stock, what else drops when it drops, related tickers or sympathy plays, sector or supply-chain peers, pair trading or hedging pairs, beta or relative performance, correlation matrices, co-movement, or rolling/realized correlation — including well-known pairs like AMD/NVDA, GOOGL/AVGO, or LITE/COHR. With a single ticker, assume the user wants its correlated peers.FinanceNo warnings★ 3.5K↓ —
offensive-krack-fragattacks
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-krack-fragattacks -a claude-code
Installs to .claude/skills/offensive-krack-fragattacks/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md