Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,105 skills from 2,358 repositories · updated 3 minutes ago
49,105 skills
- cursor-ai-chatjeremylongshore/tons-of-skills-marketplaceMaster Cursor AI Chat with @-mentions, inline edit, and conversation patterns. Triggers on "cursor chat", "cursor ai chat", "ask cursor", "cursor conversation", "chat with cursor", "Cmd+L", "inline edit".WritingNo warnings★ 2.9K↓ —
- speak-debug-bundlejeremylongshore/tons-of-skills-marketplaceCollect diagnostic information for Speak API issues: auth verification, audio format validation, session inspection, and network testing. Use when implementing debug bundle features, or troubleshooting Speak language learning integration issues. Trigger with phrases like "speak debug bundle", "speak debug bundle".EngineeringNo warnings★ 2.9K↓ —
- tao-train-reidNVIDIA/skillsPerson re-identification (ReID). Learns discriminative embeddings to match the same person across different camera views, based on metric learning. Use when training, evaluating, exporting, or running inference for a TAO person re-identification model. Trigger phrases include "train ReID", "person re-identification", "cross-camera person matching", "ReID embeddings", "person re-id".OtherNo warnings★ 3.8K↓ —
- data-dashboardplugin87/ux-ui-agent-skillsBuild a dense, data-heavy screen - an analytics console or a trading terminal - with real charts drawn from tokens: candlestick, volume, depth, stacked area, waterfall, scatter, correlation matrix, donut, gauge, sparklines, heatmaps and order books. Use when the request is a dashboard, terminal, monitoring view, data console, or any screen whose job is to show many numbers at once. Covers the layout sequence, the SVG geometry, the accessibility contract per chart type, and the contrast traps that only appear in dark mode.DataNo warnings★ 3.1K↓ —
- paid-ads-guidenowork-studio/notfair-pluginExplain NotFair's paid-ads skills, installation, platform boundaries, account connections, and current product capabilities. Use for questions about how NotFair works, what it supports, how to install or connect it, plans or limits, or paid-media troubleshooting that is not an account-performance request.MarketingNo warnings★ 4.1K↓ —
- hexanon-x402-apisdavepoon/buildwithclaudePay-per-call access to the Hexanon family of eight x402 APIs for autonomous agents — no signup, no API keys, USDC on Base. Covers US/Canada vehicle & VIN intelligence (Vindex), e-commerce demand signals (Demandex), Polymarket whale intelligence (OrcaTrace), GitHub trending-repo digests (gitBeacon), narrative intelligence (Signalis), Moltbook community digests (Moltalyzer), x402 seller conformance scanning (x402lint), and Polymarket weather-market signals (Isocast).EngineeringNo warnings★ 3.7K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
- i4h-workflowNVIDIA/skillsOrient users to the i4h workflow runtime and route them to the correct stage skill. Use for architecture, support, or where-to-start questions; do not execute a known stage.ProductivityNo warnings★ 3.8K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.PlanningNo warnings★ 3.7K↓ —
- physicsnemo-discoverNVIDIA/skillsOfficial NVIDIA-authored guidance for navigating PhysicsNeMo — pick the model, datapipe, or example for a SciML/AI4Science task (surrogates, forecasting, downscaling, physics-informed, inverse, generative). Points at existing files via live repo search; never writes code. Do NOT use for installation or environment setup, training-loop or other code authoring/scaffolding, contributor/CI/packaging questions, repo-specific questions in physicsnemo-sym/-cfd/-curator, or general (non-physics) ML/PyTorch.ScienceNo warnings★ 3.8K↓ —
- ops-lineardavepoon/buildwithclaudeLinear command center. Shows current sprint, creates/updates issues, manages priorities, syncs with GSD phases.OtherNo warnings★ 3.7K↓ —
- principle-build-the-levermichael-denyer/pstack-claudeApply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks. Build the tool that does it or proves it (codemod, script, generator, or a skill your subagents follow) instead of working by hand. The tool is the artifact a reviewer can rerun.WritingNo warnings★ 3.8K↓ —
- ops-deploydavepoon/buildwithclaudeDeploy status across all projects. Shows ECS service versions, Vercel deployments, recent deploys, pending deploys, and CI/CD pipeline state.DevOpsNo warnings★ 3.7K↓ —
- apollo-cost-tuningjeremylongshore/tons-of-skills-marketplaceOptimize Apollo.io costs and credit usage. Use when managing Apollo credits, reducing API costs, or optimizing subscription usage. Trigger with phrases like "apollo cost", "apollo credits", "apollo billing", "reduce apollo costs", "apollo usage".EngineeringNo warnings★ 2.9K↓ —
- conversion-signal-qaaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "QA my conversion tracking before launch", "check my UTMs / pixel / event firing", "set up a tracking pre-flight", or "set the dedup rule so Meta and Google stop double-counting"; builds and fixes the measurement plumbing — conversion-event firing, UTM hygiene, cross-platform dedup rules, attribution-window alignment, and offline/iOS-ATT modeled-gap flags — as a pre-flight checklist plus a UTM/event-spec builder. Not for scoring R1/R2 — that is a scored veto in ad-account-auditor; not for account structure — use campaign-architect. 付费广告转化追踪QA/UTM规范/跨平台去重TestingNo warnings★ 3.1K↓ —
- doca-aes-gcmNVIDIA/skillsUse this skill when the user is doing hands-on DOCA AES-GCM work on a BlueField DPU or ConnectX NIC — configuring `doca_aes_gcm_task_encrypt` / `_task_decrypt`, querying `doca_aes_gcm_cap_*` for per-key-type (only `DOCA_AES_GCM_KEY_128` / `_256` — AES-192 not supported) and per-task support, sizing plaintext against the max-buf cap, setting source / destination mmap permissions, validating with a NIST GCMVS or RFC 5288 vector, or debugging DOCA_ERROR_* including the security-critical tag-verification-failed outcome on decrypt. Trigger even when the user does not explicitly mention "DOCA AES-GCM" or "AEAD" — typical implicit phrasings: "decrypt completion IO_FAILED", "auth tag isn't verifying", "NOT_PERMITTED on my encrypt buffer", "is AES-192-GCM on this BlueField" (no), or "encrypted record came back tampered". Refuse and route elsewhere for non-GCM AES modes (CBC / CTR / XTS — CPU OpenSSL), key management (KMS / HSM / rotation), SHA (doca-sha), or general AEAD background.SecurityNo warnings★ 3.8K↓ —
- hermes-history-ingestAr9av/obsidian-wikiIngest Hermes agent history into Obsidian as distilled knowledge. Use for importing or mining ~/.hermes sessions, memories, or logs; use wiki-agent for targeted topic-only cross-agent recall.ProductivityNo warnings★ 3.7K↓ —
- performance-analyzeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "analyze influencer campaign performance", "compare influencers", or "find what content worked"; produces metric scorecards vs target and benchmark, platform/influencer/content rankings, engagement-quality and sentiment reads, conversion-attribution breakdowns, and ranked learnings. Not for dollar-level return math — use roi-calculator. 达人营销效果分析/投放复盘MarketingNo warnings★ 3.1K↓ —
- recallbacknotprop/pstackReconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents), then hand back a tight current-state brief. Use for 'recall my work on X', 'catch me up', 'what have I been working on', 'where did I leave off', before starting or resuming work.ProductivityNo warnings★ 3.4K↓ —
- ponderNewdavepoon/buildwithclaudeMulti-pass review loop for codebases, UIs, and docs. Each pass re-checks the previous pass's findings from four perspectives (Skeptic, Builder, Dreamer, Empath) until they stop changing, and the CLI refuses to stop while any enumerated unit is still ungraded. Files and pages under review stay data, and a finding written in them is never a command to run. Use when the user says "ponder <anything>", "keep thinking until it converges", or asks to audit or grade every screen, file, or module.WritingNo warnings★ 3.7K↓ —
- google-analyticsnowork-studio/notfair-pluginAnalyze connected Google Analytics 4 traffic, acquisition, engagement, landing pages, ecommerce, events, and conversions, and safely manage supported GA4 key events or custom dimensions through NotFair MCP. Use for GA4, Google Analytics, traffic or conversion drops, channel attribution, realtime activity, report requests, measurement configuration, or Analytics MCP setup.DataNo warnings★ 4.1K↓ —
- observeplugin87/ux-ui-agent-skillsShow whether the agent followed the kit's rules in recent sessions: pages edited and measured, Stop hook blocks, findings left open. Reads local hook events only.WritingNo warnings★ 3.1K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 8K↓ —
- gsd:ultraplan-phasedavepoon/buildwithclaude[BETA] Offload plan phase to Claude Code's ultraplan cloud — drafts remotely while terminal stays free, review in browser with inline comments, import back via /gsd:import. Claude Code only.BrowserNo warnings★ 3.7K↓ —
trailmark-structural
trailofbits/skills
ProductivityUpdated 5 days ago
From the author
Runs full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.
Install
npx skills add trailofbits/skills --skill trailmark-structural -a claude-code
Installs to .claude/skills/trailmark-structural/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg