Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
46,100 skills from 2,198 repositories · updated 6 hours ago
16,444 skills
- automate-memichael-denyer/pstack-claudeUse for "automate me", "create/update/refresh my -mode skill", "turn/capture my preferences or working style into a skill", or wanting agents to follow how the user works. Drafts or revises a personal -mode skill via plugin-dev:skill-development + unslop, optionally pulling fresh evidence from recent transcripts.OtherNo warnings★ 3.6K↓ —
- documentation-lookupforyourhealth111-pixel/Vibe-SkillsUse when the user needs current library, framework, or API documentation and version-specific code examples.PlanningNo warnings★ 3.8K↓ —
- skill-collab-proposalZJU-REAL/Easel品牌合作方案与联名策划。当用户提到"品牌合作"、"商单方案"、"合作报价"、"联名"、"联动方案"、 "博主合作"、"品牌植入"、"商务合作"、"合作提案"时触发。支持两种模式：商单方案（品牌找上门， 基于 KOL 定价表生成报价、内容形式、排期、KPI 预估）和联名策划（与博主/品牌联动，生成双方 优势互补、内容分工、互推策略）。OtherNo warnings★ 4.2K↓ —
- offensive-exploit-developmentSnailSploit/Claude-Redclaude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.SecurityNo warnings★ 9.8K↓ —
- skill-trend-riderZJU-REAL/Easel给定一个热点事件或话题，结合创作者账号定位，输出蹭热点的具体内容方案。 包含切入角度、内容形式、标题建议、风险提醒。 当用户说"这个热点怎么蹭"、"蹭热点"、"怎么结合"、"热点和我有关吗"、 "追热点"、"热点方案"、"借势"、"怎么追这个热点"、"热点怎么切"时触发。 和 skill-trending-topics 的区别：trending-topics 发现和筛选热点， trend-rider 拿到一个具体热点后规划怎么蹭、怎么切内容。OtherNo warnings★ 4.2K↓ —
- offensive-bluetooth-classicSnailSploit/Claude-RedBluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.MediaNo warnings★ 9.8K↓ —
- recallmichael-denyer/pstack-claudeReconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents), then hand back a tight current-state brief. Use for 'recall my work on X', 'catch me up', 'what have I been working on', 'where did I leave off', before starting or resuming work, and before telling the user that something was never recorded.ProductivityNo warnings★ 3.6K↓ —
- poteto-helpmichael-denyer/pstack-claudeGuides users through pstack setup, /poteto-mode, and picking the skill, playbook, or principle for a task. Type /poteto-help with a question.ProductivityNo warnings★ 3.6K↓ —
- offensive-deauth-disassocSnailSploit/Claude-RedDeauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.TestingNo warnings★ 9.8K↓ —
- hyperliquid-readerhimself65/finance-skillsRead Hyperliquid (app.hyperliquid.xyz) perp and spot market data through opencli and Hyperliquid's public info API: mark, oracle, and mid prices, 24h change, funding rates (hourly and annualized APR), open interest, volume, the L2 order book, OHLCV candles, funding history, and cross-venue funding comparisons (Hyperliquid vs Binance vs Bybit) for funding arbitrage. Use this skill whenever the user mentions Hyperliquid (HL, HL DEX, hyperliquid.xyz) or asks about its perps, spot pairs such as PURR, funding, open interest, order book, or candles. Read-only market data: no account, order, or transfer operations.EngineeringNo warnings★ 3.5K↓ —
- skill-zhihu-answerZJU-REAL/Easel知乎问答回答发布：在知乎问题下发布原创回答——搜热门问题、检查可答性、写内容、 Playwright 发布（绕 header 遮挡 + JS 遍历发布按钮）。当用户说"回答知乎问题""在知乎问答下回答" "发知乎回答""知乎答题""帮我回答这个知乎问题""批量回答知乎"时使用。与 skill-zhihu-publisher 区别：那个发**专栏文章**（zhuanlan），本 SKILL 专发**问答区的回答**；回答内容写作用制作层 SKILL （novel-writer / copywriting）。TestingNo warnings★ 4.2K↓ —
- skill-publish-checklistZJU-REAL/Easel发布前完整性检查：逐项检查标题、封面、标签、格式、合规标记、链接、CTA 是否齐全， 确保内容没有遗漏就能发布。当用户说"检查一下能不能发"、"发布前检查"、"checklist"、 "查漏补缺"、"发之前看一眼"、"发布清单"、"漏了什么没"、"能发了吗"时触发。 和 skill-quality-gate 的区别：quality-gate 做深度合规审核和质量评分， publish-checklist 只做"有没有漏东西"的快速完整性检查。OtherNo warnings★ 4.2K↓ —
- trailmark-review-gatetrailofbits/skillsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.EngineeringNo warnings★ 7.9K↓ —
- bio-database-evidenceforyourhealth111-pixel/Vibe-SkillsUnified biological database evidence owner. Use for gene annotation, variant clinical significance, cancer mutation evidence, GWAS trait associations, pathway mapping, target-disease evidence, protein structures, protein interaction networks, reference single-cell census queries, and cross-database biological ID mapping. Do not use for full single-cell analysis, bulk RNA-seq differential expression, BAM/VCF processing, protein embedding models, metabolic flux modeling, genomic interval ML, or flow-cytometry file parsing.DataNo warnings★ 3.8K↓ —
- ops-orchestratedavepoon/buildwithclaudeAutonomous multi-project orchestration engine. Audits all registered projects, structures work into dependency-wired tasks, dispatches parallel agents (subagents or Agent Teams), audits completions, and ships PRs. Registry-driven — works for any user with a configured project registry.ProductivityNo warnings★ 3.7K↓ —
- hive-mind-advancedforyourhealth111-pixel/Vibe-SkillsAdvanced Hive Mind collective intelligence system for queen-led multi-agent coordination with consensus mechanisms and persistent memoryProductivityNo warnings★ 3.8K↓ —
- skill-xhs-comment-replyZJU-REAL/Easel小红书评论互动运营：列出我的笔记、抓取某条笔记下的评论、按画像语气逐条回复、以及删除评论 （含自己发的回复）。基于 Playwright + 持久化登录态，headless 即可运行，与 skill-xhs-publisher 共用同一登录态。评论抓取走接口响应拦截（稳）；回复/删除走 DOM 文本定位（无坐标）+ 逐字符输入反检测； 带已回复去重、逐条间隔防风控、dry-run 预演。用 notes 列笔记或 fetch --url 贴链接，免手动拆 token。 触发：抓小红书评论 / 回复评论 / 删除评论 / 删评 / 维护评论区 / 看我某条笔记的评论。TestingNo warnings★ 4.2K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsNo warnings★ 9.8K↓ —
- skill-risk-scannerZJU-REAL/Easel内容原创度与版权风险评估：分析文案是否存在洗稿/搬运嫌疑，评估素材版权风险， 检查引用规范。基于 LLM 文本分析，不包含技术查重。 当用户说"查重"、"原创度"、"是不是抄的"、"版权风险"、"能不能用这张图"、 "音乐版权"、"原创检测"、"有没有侵权"、"素材版权"、"会不会被投诉"时触发。 和 skill-quality-gate 的区别：quality-gate 查敏感词和平台规则合规， risk-scanner 专注原创度和版权侵权风险。OtherNo warnings★ 4.2K↓ —
- offensive-wpa2-pskSnailSploit/Claude-RedWPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.MarketingNo warnings★ 9.8K↓ —
- skill-profile-builderZJU-REAL/Easel首次使用引导：从社媒链接分析、从零生成账号画像 Profile。收集社媒链接+运营意图，分析已发内容与收藏喜好，生成 6 维 Profile。当用户说 创建画像/第一次用/帮我建个人设/分析我的账号建画像/从链接生成画像 时使用。与 skill-profile-manager 的区别：本 SKILL 专做首次从零分析生成；已有画像的编辑/记忆更新/导出/对比/切换找 profile-manager。OtherNo warnings★ 4.2K↓ —
- holoscan-install-containerNVIDIA/skillsInstall and verify the Holoscan SDK 5.x CUDA 13 development container after checking release availability and host compatibility.OtherNo warnings★ 3.8K↓ —
- offensive-wpa3-saeSnailSploit/Claude-RedWPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.SecurityNo warnings★ 9.8K↓ —
- skill-article-outlineZJU-REAL/Easel生成长文大纲：基于搜索分析生成 H2/H3 标题结构、段落字数目标、图表位置和 FAQ 规划，适用于公众号文章、知乎专栏、博客。 当用户说"文章大纲""长文结构""公众号大纲""知乎回答框架""写作提纲""文章框架""H2/H3 结构"时使用。WritingNo warnings★ 4.2K↓ —
c-review
trailofbits/skills
EngineeringUpdated yesterday
From the author
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.
Install
npx skills add trailofbits/skills --skill c-review -a claude-code
Installs to .claude/skills/c-review/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (1)
- SKILL.md