Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
47,891 skills from 2,309 repositories · updated 25 minutes ago
46,780 skills
- adobe-common-errorsjeremylongshore/tons-of-skills-marketplaceClassify Adobe failures from redacted response evidence and select the smallest bounded recovery. Use across auth, Firefly, Photoshop, PDF Services, Events, and App Builder. Use when the task requires adobe response-led error triage. Trigger with "fix Adobe error", "Adobe 403", or "Adobe API failed".DocumentsNo warnings★ 2.9K↓ —
- ena-databaseforyourhealth111-pixel/Vibe-SkillsAccess European Nucleotide Archive via API/FTP. Retrieve DNA/RNA sequences, raw reads (FASTQ), genome assemblies by accession, for genomics and bioinformatics pipelines. Supports multiple formats.DataNo warnings★ 3.8K↓ —Also in 1 other repo
- perqNewdavepoon/buildwithclaudeFind verified free AI credits, free tiers, startup programs and student perks for LLM APIs, GPUs, voice, databases and dev tools through Perq's read-only search API or hosted MCP server. Use when the user asks what free credits they can get, the cheapest way to try a model or API, or which startup or student programs apply. Every answer carries the vendor's source link and a last-verified date.EngineeringNo warnings★ 3.7K↓ —
- exa-known-pitfallsjeremylongshore/tons-of-skills-marketplaceAudit an Exa integration for stale search types, unsafe secrets, ignored partial failures, unbounded content work, weak citations, and orphaned asynchronous resources. Use when operating or reviewing this Exa boundary. Trigger with "Exa known pitfalls", "review Exa known pitfalls", or "fix Exa known pitfalls".EngineeringNo warnings★ 2.9K↓ —
- gsd:add-backlogdavepoon/buildwithclaudeAdd an idea to the backlog parking lot (999.x numbering)OtherNo warnings★ 3.7K↓ —
- speak-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Speak API rate limits with exponential backoff, request queuing, and optimization strategies. Use when implementing rate limits features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak rate limits", "speak rate limits".EngineeringNo warnings★ 2.9K↓ —
- ramp-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a small typed Ramp Developer API adapter with secure token management, pagination, structured errors, rate control, idempotency, and schema drift checks. Use when replacing scattered raw requests in application code. Trigger with "Ramp API client" or "Ramp SDK patterns".EngineeringNo warnings★ 2.9K↓ —
- thermo-nuclear-reviewmichael-denyer/pstack-claudeComprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.EngineeringNo warnings★ 3.7K↓ —
- preference-frequency-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build a preference center", "set up a frequency opt-down ladder", "give people a step-down instead of unsubscribe", or "design a topic/cadence preference page"; produces a preference-center field spec, a frequency/topic opt-down ladder (down-tier paths that substitute for a hard unsubscribe), a preference-to-suppression mapping, and a SEND N-dimension sub-item note on preference-center / frequency options offered. Not for the lifecycle flow map or cadence governance — use email-sequence-designer; not for the consent/suppression record itself — use consent-registry; not for computing EQS or ruling the N1 unsubscribe veto — use email-quality-auditor. 邮件偏好中心/降频阶梯设计/退订替代降档DesignNo warnings★ 3K↓ —
- i4h-workflow-setupNVIDIA/skillsPreflight and set up the root-level workflow runtime. Use for installation, missing component environments, or third-party failures; do not use for rollout validation.ProductivityNo warnings★ 3.8K↓ —
- aflpptrailofbits/skillsSets up and runs AFL++ for multi-core fuzzing of C/C++ projects built with afl-clang-fast or afl-gcc-fast. Covers instrumentation modes, parallel main and secondary campaigns, persistent mode, corpus minimization, and crash triage. Use when scaling fuzzing across cores, fuzzing a mature C/C++ codebase, reading the afl-fuzz status screen, or moving on after libFuzzer has plateaued.OtherNo warnings★ 7.9K↓ —
- channel-portfolio-planneraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "pick which social channels to run", "should we be on X platform or 小红书", or "plan our organic social channel portfolio"; produces an audience/objective-first portfolio with capability/access matrix, cadence-budget reality check, declared ECHO operating profile, boundary routing, and proposed-state registry events. Not for recording canonical channel facts — use channel-registry. 社媒渠道选择/渠道组合规划/平台能力矩阵/自然社媒PlanningNo warnings★ 3K↓ —
- sympyforyourhealth111-pixel/Vibe-SkillsUse this skill when working with symbolic mathematics in Python. This skill should be used for symbolic computation tasks including solving equations algebraically, performing calculus operations (derivatives, integrals, limits), manipulating algebraic expressions, working with matrices symbolically, physics calculations, number theory problems, geometry computations, and generating executable code from mathematical expressions. Apply this skill when the user needs exact symbolic results rather than numerical approximations, or when working with mathematical formulas that contain variables and parameters.ScienceNo warnings★ 3.8K↓ —Also in 1 other repo
- constant-time-testingtrailofbits/skillsMeasures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.TestingNo warnings★ 7.9K↓ —
- gsd:add-tododavepoon/buildwithclaudeCapture idea or task as todo from current conversation contextProductivityNo warnings★ 3.7K↓ —
- doca-telemetryUpdatedNVIDIA/skillsUse this skill to read DOCA hardware-counter events from a `doca_dev` through the per-domain Telemetry reader libraries: `doca_telemetry_pcc`, `_dpa`, `_diag`, `_adp_retx`, `_phy`, and `_pci`. It covers capability checks, context creation, startup, and per-domain reads or samples. Trigger for implicit requests such as "read PCC counters from my BlueField app", "sample DPA counter exports", or "expose PHY, PCI, or DIAG counters from this doca_dev". This is the counter-reader surface, not a NetFlow, IPFIX, or local-socket collector. Route publishing and export to `doca-telemetry-exporter`; route the deployed DOCA Telemetry Service to `doca-dts`, and collectors and plain stdout logging elsewhere.DevOpsNo warnings★ 3.8K↓ —
- navan-cost-tuningjeremylongshore/tons-of-skills-marketplaceAnalyze Navan travel, expense, integration, and operating costs without freezing mutable prices. Use when setting budgets or evaluating workflow tradeoffs. Trigger with "reduce Navan cost", "Navan budget", or "control travel spend".ProductivityNo warnings★ 2.9K↓ —
- keeping-git-repos-cleankajisho5/ffmpeg-skillPrevents, detects, and remediates files that should never be committed — secrets (.env, API tokens, hardcoded credentials) and dev artifacts (build output, scratch databases, editor/OS files). Covers .gitignore (and why it does not untrack), git rm --cached, auditing tracked files, history scrubbing, and credential rotation. Use when a repo has committed secrets or junk, when setting up a new repo's ignore rules, or when reviewing what a repo actually tracks.EngineeringNo warnings★ 4.1K↓ —
- make-automationdavepoon/buildwithclaudeAutomate Make (Integromat) tasks via Rube MCP (Composio): operations, enums, language and timezone lookups. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- clade-rate-limitsjeremylongshore/tons-of-skills-marketplaceHandle Anthropic rate limits — understand tiers, implement backoff, Use when working with rate-limits patterns. optimize throughput, and monitor usage. Trigger with "anthropic rate limit", "claude 429", "anthropic throttling", "anthropic usage limits", "claude tokens per minute".OtherNo warnings★ 2.9K↓ —
- ketchupmichael-denyer/pstack-claudeCatch the user up on what changed in this chat since their last message, in plain words and small visuals. List every item waiting on them with what they need to decide it from the reply alone. Use for /ketchup.OtherNo warnings★ 3.7K↓ —
- design-codeplugin87/ux-ui-agent-skillsGenerate production-ready, accessible, token-driven component code for ANY framework (React+Tailwind, Next.js, SwiftUI, Vue, Svelte, Angular, Solid, Web Components/Lit, React Native, Flutter, Jetpack Compose, vanilla CSS, or CSS-in-JS). Use when the user wants working UI code for a component or screen in a specific stack.DesignNo warnings★ 3.1K↓ —
- gsd:validate-phasedavepoon/buildwithclaudeRetroactively audit and fill Nyquist validation gaps for a completed phaseOtherNo warnings★ 3.7K↓ —
- gsd:check-todosdavepoon/buildwithclaudeList pending todos and select one to work onOtherNo warnings★ 3.7K↓ —
spec-to-code-compliance
trailofbits/skills
LegalUpdated 2 days ago
From the author
Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.
Install
npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-code
Installs to .claude/skills/spec-to-code-compliance/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (7)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- resources/ANALYSIS_FORMAT.md
- resources/DIVERGENCE_RUBRIC.md
- resources/DOMAIN_NOTES.md
- resources/WORKED_EXAMPLE.md