Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 16 hours ago
48,622 skills
- nvmolkit-usageNVIDIA/skillsUse when writing or debugging nvMolKit Python code for GPU-accelerated RDKit fingerprints, similarity, conformers, clustering, and molecular searches.WritingNo warnings★ 3.8K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10.2K↓ —
- pulumi-componentpulumi/agent-skillsGuide for authoring Pulumi ComponentResource classes. Use when creating reusable infrastructure components, designing component interfaces, setting up multi-language support, or distributing component packages.OfficialDevOpsNo warnings★ 78↓ —
- kiro-validate-designgotalab/cc-sddInteractive technical design quality review and validationDesignNo warnings★ 3.7K↓ —
- gsd:complete-milestonedavepoon/buildwithclaudeArchive completed milestone and prepare for next versionOtherNo warnings★ 3.7K↓ —
- sepia-writeNanako0129/sepiaUse when a user explicitly requests Sepia write to create new prose.WritingNo warnings★ 3.6K↓ —
- hypothesis-testingforyourhealth111-pixel/Vibe-SkillsProperty-based testing with Hypothesis for discovering edge cases and validating invariants. Use when implementing comprehensive test coverage, testing complex logic with many inputs, or validating mathematical properties and invariants across input domains. Triggered by: hypothesis, property-based testing, @given, strategies, generative testing.TestingNo warnings★ 3.8K↓ —
- offensive-iotSnailSploit/Claude-RedIoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.SecurityNo warnings★ 10.2K↓ —
- prepare-regressiontrailofbits/skillsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.FinanceNo warnings★ 7.9K↓ —
- golang-databasesamber/cc-skills-golangComprehensive guide for Go database access — parameterized queries, struct scanning, NULLable columns, transactions, isolation levels, SELECT FOR UPDATE, connection pool, batch processing, context propagation, and migration tooling. Use when writing, reviewing, or debugging Golang code that interacts with PostgreSQL, MariaDB, MySQL, or SQLite; for database testing; or for questions about database/sql, sqlx, or pgx. Does NOT generate database schemas or migration SQL.DataNo warnings★ 3.7K↓ —
- golang-testingsamber/cc-skills-golangProduction-ready Golang tests — table-driven tests, testify suites and mocks, parallel tests, fuzzing, fixtures, goroutine leak detection with goleak, snapshot testing, code coverage, integration tests, idiomatic test naming. Use when writing or reviewing Go tests, choosing a testing approach, setting up Go test CI, or debugging flaky/slow tests. For testify-specific APIs see `samber/cc-skills-golang@golang-stretchr-testify`; for measurement methodology see `samber/cc-skills-golang@golang-benchmark`.TestingNo warnings★ 3.7K↓ —
- image-editingZJU-REAL/Easel通用图像处理加工：改尺寸/缩放、裁剪、补边适配平台尺寸、格式转换（png/jpg/webp）、 压缩到目标大小、加文字或图片水印、圆角、多图拼接、生成缩略图、读图片信息。 基于 image_ops.py 确定性处理。 使用时机：用户说"改尺寸"、"缩放图片"、"裁剪"、"压缩图片"、"加水印"、"转格式"、 "圆角"、"拼图/多图联排"、"缩略图"、"适配小红书/朋友圈尺寸"、"把图 pad 成 1:1"。 和 card-*（卡片类）的区别：card-* 是"HTML 设计→渲染出图"， image-editing 只加工已有图片，不负责视觉设计。MediaNo warnings★ 4.3K↓ —
- verification-before-completionforyourhealth111-pixel/Vibe-SkillsCompletion-evidence route used before claiming work is complete, fixed, passing, committed, or PR-ready. Requires fresh verification output before success claims. Do not use for root-cause debugging, TDD implementation, test-report packaging, or review-feedback triage.TestingNo warnings★ 3.8K↓ —
- jetson-generate-kbNVIDIA/skillsBuild a per-target knowledge-base markdown next to the active profile by walking the BSP root and source tree. Use after init-image / init-source; not for editing profile fields.MediaNo warnings★ 3.8K↓ —
- gh-clitrailofbits/skillsEnforces authenticated gh CLI workflows over unauthenticated curl, WebFetch, and MCP fetch patterns. Use when working with GitHub URLs, API access, pull requests, or issues.EngineeringNo warnings★ 7.9K↓ —
- doca-flow-tuneNVIDIA/skillsUse this skill when the user is tuning a live or captured `doca-flow` pipeline with `doca_flow_tune` — snapshotting pipe / counter / KPI state, picking a tuning axis (rule placement, resource hints / table sizing, HW-offload mode) and a matching measurement (rule-install rate, lookup latency, hardware-counter delta), running offline or online (read-only or state-changing) modes, reading the dumper CSV / analyze JSON / visualize mermaid, or applying a recommendation back into the Flow program. Trigger even when the user does not explicitly mention "doca_flow_tune" — typical implicit phrasings include "Flow rule-install rate is low on BlueField", "table sizing looks wrong for this pipe", "tune visualize step is empty", "before/after counters don't move", or "which doca-flow knob does this recommendation hit". Refuse and route elsewhere for writing the doca-flow application, DOCA install, or streaming Flow telemetry — those belong to other skills.DataNo warnings★ 3.8K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 7.9K↓ —
- no-commentsmichael-denyer/pstack-claudeSpawn the comment-sicko subagent, fix accepted findings, and offer encodings for claimed constraints.OtherNo warnings★ 3.7K↓ —
- ops-orchestratedavepoon/buildwithclaudeAutonomous multi-project orchestration engine. Audits all registered projects, structures work into dependency-wired tasks, dispatches parallel agents (subagents or Agent Teams), audits completions, and ships PRs. Registry-driven — works for any user with a configured project registry.ProductivityNo warnings★ 3.7K↓ —
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.TestingNo warnings★ 10.2K↓ —
- jetson-video-benchmarkNVIDIA/skillsUse when measuring Jetson Video Codec SDK or PyNvVideoCodec encode/decode throughput, comparing presets or surfaces, testing codec-worker capacity with authenticated samples and user media, or producing a clearly labeled documentation-derived planning estimate when representative media is absent. Also use for a video request limited to PSNR or SSIM, to apply the terminal scope response.MediaNo warnings★ 3.8K↓ —
- launch-registryaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "log this launch", query a launch date/embargo, record a stage transition, or update submissions/outcomes; curates launch facts through the append-only launches event stream with optimistic revisions and derived dossier/calendar views. Not for RAMP scoring — use launch-readiness-auditor; not for planning tier/window — use launch-tier-planner. 发布台账/发布日历/阶段与禁运期记录PlanningNo warnings★ 3K↓ —
- clerk-custom-uiclerk/skillsCustom authentication flows and component appearance - hooks (useSignIn, useSignUp), themes, colors, fonts, CSS. Use for custom sign-in/sign-up flows, appearance styling, visual customization, branding.OfficialDesignNo warnings★ 89↓ —
- paid-ads-amazonnowork-studio/notfair-pluginPlan and review Amazon Ads with margin-aware ACoS, product, and search-term guardrails. Use for Amazon advertising, Sponsored Products, Sponsored Brands, Sponsored Display, ASIN targeting, Amazon ACoS, or Amazon Ads performance exports.MarketingNo warnings★ 4.1K↓ —
testing-handbook-generator
trailofbits/skills
TestingUpdated 5 days ago
From the author
Generates Claude Code skills from the Trail of Bits Testing Handbook (appsec.guide), analyzing handbook pages and emitting SKILL.md files with the structure each skill type requires. Use when creating or refreshing a skill from handbook content, or when the user names the testing handbook or appsec.guide. Not for answering security testing questions — the generated skills cover those.
Install
npx skills add trailofbits/skills --skill testing-handbook-generator -a claude-code
Installs to .claude/skills/testing-handbook-generator/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (10)
- SKILL.md
- agent-prompt.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- discovery.md
- templates/domain-skill.md
- templates/fuzzer-skill.md
- templates/technique-skill.md
- templates/tool-skill.md
- testing.md