Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 19 hours ago
48,622 skills
- exa-observabilityjeremylongshore/tons-of-skills-marketplaceInstrument Exa calls with content-free metrics, traces, cost, and asynchronous lifecycle signals that support diagnosis without logging retrieved text. Use when operating or reviewing this Exa boundary. Trigger with "Exa observability", "review Exa observability", or "fix Exa observability".DevOpsNo warnings★ 2.9K↓ —
- validate-pluginjeremylongshore/tons-of-skills-marketplaceValidate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard. Runs structural validation (plugin.json fields, file references, permissions) and content validation (SKILL.md grading, command/agent frontmatter). Use when building a new plugin, preparing for marketplace submission, or auditing existing plugins. Trigger with "validate this plugin", "check plugin structure", "grade my plugin", "/validate-plugin".PlanningNo warnings★ 2.9K↓ —
- modern-cpptrailofbits/skillsGuides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE with concepts, printf with std::print, error codes with std::expected.SecurityNo warnings★ 7.9K↓ —
- variant-analysistrailofbits/skillsHunts for the other instances of a bug already found — the variants of one root cause across a codebase. Use immediately after a vulnerability, logic bug, or bad pattern turns up in a specific file and the question becomes where else it occurs, including the bare conversational form ("are there others like this?", "is this the same bug?"). Also for generalizing one known instance into a CodeQL or Semgrep query for its whole pattern family, and for triaging a set of look-alike candidates against a known root cause. Not for initial discovery with no bug in hand.SecurityNo warnings★ 7.9K↓ —
- offensive-lateral-movementSnailSploit/Claude-RedComprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.TestingNo warnings★ 10.2K↓ —
- openclaw-history-ingestAr9av/obsidian-wikiIngest OpenClaw session/history data into Obsidian as distilled knowledge. Use for importing or mining ~/.openclaw sessions, memory files, or logs; use wiki-agent for targeted topic-only cross-agent recall.ProductivityNo warnings★ 3.6K↓ —
- attribution-reconcileraaron-he-zhu/aaron-marketing-skillsUse when platform-reported conversions disagree with GA4/ecommerce, when you suspect Meta and Google are double-counting the same sales, or for a standing (monthly) reconciliation workbook that de-dups stacked credit against an order-ID truth set, normalizes attribution windows and currency, compares attribution models, and reads incrementality from a geo/holdout test. Not for the point-in-time R2 veto or RQS gate — use ad-account-auditor; not for the ROI/ROAS ratio math itself — use roi-calculator; not for organic dark-social share attribution or GA4 direct-traffic decomposition — use dark-social-attributor. 付费广告归因对账/去重/增量TestingNo warnings★ 3K↓ —
- principle-fix-root-causesmichael-denyer/pstack-claudeApply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.EngineeringNo warnings★ 3.7K↓ —
- skill-creatorhimself65/finance-skillsCreate, improve, and evaluate agent skills (SKILL.md plus reference files). Use this skill whenever the user wants to build, scaffold, or design a new skill, improve or fix an existing skill that isn't working well, score or benchmark a skill's quality or run evals on it, or turn a repeated manual workflow into a skill ("I keep doing X manually", "can you remember how to do X", "turn this into a skill").DesignNo warnings★ 3.5K↓ —
- jetson-download-bspNVIDIA/skillsDownload NVIDIA Jetson Linux BSP artifacts (BSP tarball, sample rootfs, public_sources, x-tools, guides) for the active target. Use for Auto Setup; not for extraction or profile edits.WritingNo warnings★ 3.8K↓ —
- internal-commsdavepoon/buildwithclaudeA set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).WritingNo warnings★ 3.7K↓ —
- principle-test-behavior-not-implementationbacknotprop/pstackApply when you write, change, or keep a test. Assert what the code's users can observe, so that the test fails when that behavior breaks and keeps passing when only the internals change.TestingNo warnings★ 3.3K↓ —Also in 1 other repo
- wiki-switchAr9av/obsidian-wikiList, create, or switch named Obsidian wiki vault profiles under the global config directory. Use when changing the active vault, checking which vault is active, or managing multi-vault profiles.ProductivityNo warnings★ 3.6K↓ —
- skill-content-calendar-logZJU-REAL/Easel统一内容日历底座。记录每次发布（发布页/对话页均自动落库）、用户排期、平台活动/节日/特殊日期到 一个时间线，并供 Agent 规划前读回。当用户说"内容日历""日历里有什么""接下来发什么""这周发了啥" "把这个活动记到日历""最近的发布节奏""哪个平台该更新了"时触发。是发布时间线的权威底座， 与 skill-publish-log（指标底座）互补：本底座管"何时发什么/该做什么"，publish-log 管"每条数据表现"。ProductivityNo warnings★ 4.3K↓ —
- solve-challengeljagiello/ctf-skillsSolves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.PlanningNo warnings★ 3.6K↓ —
- howmichael-denyer/pstack-claudeUse for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Use why for motivation.PlanningNo warnings★ 3.7K↓ —
- principle-redesign-from-first-principlesbacknotprop/pstackApply when integrating a new requirement into an existing design.DesignNo warnings★ 3.3K↓ —Also in 1 other repo
- refactorcode-yeongyu/oh-my-openagentGuides a refactor, cleanup, or restructure with the right decomposition. Use when the user asks to refactor, simplify, extract, or modernize code.EngineeringNo warnings★ 70.6K↓ —
- geo-optimizernowork-studio/notfair-pluginGenerative Engine Optimization (GEO) — make content rank in AI search answers from ChatGPT, Claude, Perplexity, Gemini, and Google AI Overviews. Audits existing content, rewrites for AI citation, and produces per-engine strategy. Use when asked to "optimize for AI search", "rank in ChatGPT", "GEO audit", "improve AI citations", "rank in Perplexity", "AI Overview optimization", "AI Overview ranking", "LLM SEO", "answer engine optimization", "AEO", "get cited by AI", "GEO", "generative engine optimization", "show up in ChatGPT", "appear in AI answers", "be cited by Perplexity", "SGE optimization", "Search Generative Experience", or "make my content show up in AI answers". Distinct from regular SEO — this targets generative engines, not traditional Google rankings.MarketingNo warnings★ 4.1K↓ —
- provider-actionshashicorp/agent-skillsImplement Terraform Provider actions using the Plugin Framework. Use when developing imperative operations that execute at lifecycle events (before/after create, update, destroy).OfficialDevOpsNo warnings★ 911↓ —
- prowler-docsforyourhealth111-pixel/Vibe-SkillsProwler documentation style guide and writing standards. Trigger: When writing documentation for Prowler features, tutorials, or guides.WritingNo warnings★ 3.8K↓ —
- trailmark-structuraltrailofbits/skillsRuns full Trailmark structural analysis by building a graph, running `preanalysis()`, and reporting hotspots, taint, blast radius, privilege boundaries, attack surface, and version-gated Trailmark 0.4+/0.5+ data such as proxy counts, subgraph edges, type/reference summaries, and entrypoint attributes. Use when vivisect needs detailed structural data for a target. Triggers: structural analysis, blast radius, taint analysis, complexity hotspots, proxy nodes, type references.ProductivityNo warnings★ 7.9K↓ —
- cursor-ai-chatjeremylongshore/tons-of-skills-marketplaceMaster Cursor AI Chat with @-mentions, inline edit, and conversation patterns. Triggers on "cursor chat", "cursor ai chat", "ask cursor", "cursor conversation", "chat with cursor", "Cmd+L", "inline edit".WritingNo warnings★ 2.9K↓ —
- cairo-vulnerability-scannertrailofbits/skillsScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.SecurityNo warnings★ 7.9K↓ —
gsd:secure-phase
davepoon/buildwithclaude
OtherUpdated yesterday
From the author
Retroactively verify threat mitigations for a completed phase
Install
npx skills add davepoon/buildwithclaude --skill gsd:secure-phase -a claude-code
Installs to .claude/skills/gsd-secure-phase/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance83
Maintenance100
Licence100
Adoption57
Files (1)
- SKILL.md