Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,105 skills from 2,358 repositories · updated 18 hours ago
49,105 skills
- howbacknotprop/pstackUse for "how does X work", code walkthroughs before changing something, and placement / ownership / layering questions ("where should this live", "which package owns this", "is this the right layer"). Explains subsystem architecture, runtime flow, onboarding mental models. Use why for motivation.PlanningNo warnings★ 3.4K↓ —
- i4h-workflow-createNVIDIA/skillsCreate a minimal blank Workflow scaffold with a Scene containing ground and light plus an idle run mode. Use for fast new Workflow scaffolding.ProductivityNo warnings★ 3.8K↓ —
- speckit-analyzeforyourhealth111-pixel/Vibe-SkillsPerform cross-artifact consistency analysis across spec.md, plan.md, and tasks.md. Use after task generation to identify gaps, duplications, and inconsistencies before implementation.PlanningNo warnings★ 3.8K↓ —
- solve-challengeljagiello/ctf-skillsSolves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a remote service, a suspicious file, or only a vague challenge description and you must determine where to start. Do not use it when the category is already clear and a specialized skill can be invoked directly; this is the dispatcher and recon entrypoint, not the deepest reference for category-specific techniques.PlanningNo warnings★ 3.6K↓ —
- blast-radiusmichael-denyer/pstack-claudeFind what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', reviewing a small diff you don't trust, or a brief that asserts something about existing code ('make X public', 'X already handles Y') before you design against that assertion.DesignNo warnings★ 3.8K↓ —
- ops-speedupdavepoon/buildwithclaudeCross-platform, hardware-adaptive system optimizer. Auto-detects macOS / Linux / WSL / Windows (MINGW/Cygwin/MSYS2) and CPU/RAM/disk/GPU profile, then picks the right cleanup strategy. Scans reclaimable disk space, memory pressure, runaway processes, startup bloat, network issues. CleanMyMac built into Claude Code.EngineeringNo warnings★ 3.7K↓ —
- stsslennney/stop-that-shitReduce defensive disclaimers, stacked hedging, and self-protective narration when drafting, rewriting, or auditing proposals, articles, case studies, captions, and other reader-facing prose. Use when defensive wording is requested for review or appears in a draft, including wording the assistant adds. Preserve meaningful limits; do not perform general style cleanup or ordinary code work.WritingNo warnings★ 3.5K↓ —Also in 2 other repos
- golang-continuous-integrationsamber/cc-skills-golangGitHub Actions CI/CD pipeline configuration for Golang projects — workflow files for test, lint, SAST, coverage and vulnerability-scan jobs, Dependabot and Renovate config files, GoReleaser release pipelines, Docker build/push, repository security settings, and AI-driven PR review. Use when setting up or improving Go project CI, writing or fixing `.github/workflows/*.yml`, adding a linter or security scanner as a pipeline job, wiring automated dependency-update bots, or adding quality gates. Covers wiring tools into a pipeline, not the analysis they perform: do NOT use for choosing or interpreting security findings (→ See `samber/cc-skills-golang@golang-security` skill) or for choosing, upgrading, or auditing dependency versions (→ See `samber/cc-skills-golang@golang-dependency-management` skill).SecurityNo warnings★ 3.8K↓ —
- ctf-malwareljagiello/ctf-skillsProvides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.SecurityNo warnings★ 3.6K↓ —
- placement-exclusion-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build my brand-safety exclusion lists", "set placement / topic / content exclusions before launch", "add network and audience exclusions", or "prep the A1 brand-safety evidence for the auditor"; produces a placement/network exclusion list, a content-suitability & sensitive-topic block list, an audience/negative-audience exclusion set, and a packaged A1 brand/placement-safety evidence file for the gate. Not for building the audiences you target — use audience-segment-builder; not for computing the RQS or issuing the A1 verdict — use ad-account-auditor. 品牌安全/排除位置/否定受众列表MarketingNo warnings★ 3.1K↓ —
- datamodel-code-generatordatamodel-code-generator/datamodel-code-generatorUse this skill when the user wants Python data models, Pydantic models, dataclasses, TypedDicts, msgspec structs, or type-safe Python classes generated from OpenAPI, AsyncAPI, JSON Schema, GraphQL, JSON/YAML/CSV sample data, MCP tool schemas, Protocol Buffers, XML Schema, Apache Avro, or existing Python model objects. Use it for requests such as "Pydantic models from this schema", "types for this API", "parse this JSON into classes", or "convert this spec into Python models". Prefer the datamodel-codegen CLI over hand-written model code whenever an input schema, API spec, sample data file, or Python model object exists.EngineeringNo warnings★ 4K↓ —
- hypothesis-testerjeremylongshore/tons-of-skills-marketplaceStructured hypothesis formulation, experiment design, and results interpretation for Product Managers. Use when the user needs to validate an assumption, design an A/B test, or evaluate results. Trigger with "hypothesis", "A/B test", "experiment", "validate assumption", "test this", or "should we ship".TestingNo warnings★ 2.9K↓ —
- kiro-spec-requirementsgotalab/cc-sddGenerate comprehensive requirements for a specificationPlanningNo warnings★ 3.7K↓ —
- similarity-search-patternsforyourhealth111-pixel/Vibe-SkillsImplement efficient similarity search with vector databases. Use when building semantic search, implementing nearest neighbor queries, or optimizing retrieval performance.OtherNo warnings★ 3.8K↓ —
- atheristrailofbits/skillsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.EngineeringNo warnings★ 8K↓ —
- golang-samber-losamber/cc-skills-golangFunctional programming helpers for Golang using samber/lo — 500+ type-safe generic functions for slices, maps, channels, strings, math, tuples, and concurrency (Map, Filter, Reduce, GroupBy, Chunk, Flatten, Find, Uniq, etc.). Core immutable package (lo), concurrent variants (lo/parallel aka lop), in-place mutations (lo/mutable aka lom), lazy iterators (lo/it aka loi for Go 1.23+), and experimental SIMD (lo/exp/simd). Apply when using or adopting samber/lo, when the codebase imports github.com/samber/lo, or when implementing functional-style data transformations in Go. Not for streaming pipelines (→ See `samber/cc-skills-golang@golang-samber-ro` skill).OtherNo warnings★ 3.8K↓ —
- image-to-codeplugin87/ux-ui-agent-skillsTurn a reference image, screenshot, or mockup into token-driven, accessible code. Infer the design system from the reference (palette, type scale, spacing, radius, layout archetype), map it to the 3-tier tokens, rebuild it, then verify with the kit's gates. Use when the user provides a design/screenshot and wants matching UI code.MediaNo warnings★ 3.1K↓ —
- teachmichael-denyer/pstack-claudeExplain a body of work plainly so a person actually understands it. Runs the `how` and `why` skills and weaves what they find into one clear explanation. Use for 'teach me this', 'help me really understand X', 'explain this change or subsystem to me'.OtherNo warnings★ 3.8K↓ —
- principle-fix-root-causesbacknotprop/pstackApply when debugging. Trace each symptom back to the first place the system went wrong and fix it there. A guard is a fix only when the state it handles is legitimate.EngineeringNo warnings★ 3.4K↓ —Also in 1 other repo
- image-enhancerdavepoon/buildwithclaudeImproves the quality of images, especially screenshots, by enhancing resolution, sharpness, and clarity. Perfect for preparing images for presentations, documentation, or social media posts.MediaNo warnings★ 3.7K↓ —
- offensive-data-exfiltrationSnailSploit/Claude-RedDense methodology covering DNS exfiltration (dnscat2, iodine, dns2tcp), HTTPS tunneling (domain fronting, CDN abuse, legitimate service channels), ICMP tunneling (icmpsh, ptunnel-ng), cloud storage dead drops (S3 presigned URLs, Azure Blob SAS tokens, GCS signed URLs), email-based exfil (SMTP, EWS, draft method), steganography (image, audio, document metadata), encoding/encryption (base64 chunking, XOR, AES), covert channels (custom protocol tunneling, HTTP header encoding, timing channels), and data staging (compression, splitting, encryption). Tools: dnscat2, iodine, dns2tcp, PacketWhisper, chisel, stunnel, icmpsh, ptunnel-ng, steghide, zsteg, OpenStego. MITRE ATT&CK: T1048 (Exfiltration Over Alternative Protocol), T1041 (Exfiltration Over C2 Channel), T1567 (Exfiltration Over Web Service), T1029 (Scheduled Transfer), T1030 (Data Transfer Size Limits), T1132 (Data Encoding), T1001 (Data Obfuscation). Use when planning or executing data exfiltration during authorized red team engagements or post-exploitationDevOpsNo warnings★ 10.2K↓ —
- gsd:settingsdavepoon/buildwithclaudeConfigure GSD workflow toggles and model profileProductivityNo warnings★ 3.7K↓ —
- validate-pluginjeremylongshore/tons-of-skills-marketplaceValidate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard. Runs structural validation (plugin.json fields, file references, permissions) and content validation (SKILL.md grading, command/agent frontmatter). Use when building a new plugin, preparing for marketplace submission, or auditing existing plugins. Trigger with "validate this plugin", "check plugin structure", "grade my plugin", "/validate-plugin".PlanningNo warnings★ 2.9K↓ —
- kiro-spec-quickgotalab/cc-sddQuick spec generation with interactive or automatic modePlanningNo warnings★ 3.7K↓ —
offensive-wps
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-wps -a claude-code
Installs to .claude/skills/offensive-wps/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md