Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,105 skills from 2,358 repositories · updated 19 hours ago
49,105 skills
- ib-check-deckanthropics/financial-servicesInvestment banking presentation quality checker. Reviews a pitch deck or client-ready presentation for (1) number consistency across slides, (2) data-narrative alignment, (3) language polish against IB standards, (4) visual and formatting QC. Use whenever the user asks to review, check, QC, proof, or do a final pass on a deck, pitch, or client materials — including requests like "check my numbers", "reconcile figures across slides", "is this client-ready", or "what am I missing before I send this out".OfficialDocumentsNo warnings★ 41K↓ —Also in 1 other repo
- writing-lean-proofstrailofbits/skillsWrites and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions. Use when proving theorems in Lean, formalizing mathematics or specifications in Lean 4, defining new types or definitions in a Lean library, reviewing Lean proofs for readability and maintainability, refactoring long tactic proofs into lemmas, filling in sorry placeholders in a Lean development, setting up CI or linters for a Lean project, diagnosing slow proofs or maxHeartbeats timeouts, or writing custom tactics, macros, or linters.WritingNo warnings★ 8K↓ —
- clari-install-authjeremylongshore/tons-of-skills-marketplaceConfigure a least-privilege Clari identity and validate Revenue API or Copilot credentials without exposing secrets. Use when starting an integration or rotating access. Trigger with: "set up Clari auth", "configure a Clari token", "test Copilot credentials".TestingNo warnings★ 2.9K↓ —
- foundationpose-pipelineNVIDIA/skillsAdapt BOP datasets, run the FoundationPose perception pipeline with TAO depth, and evaluate or re-score pose results. Use for dataset runs and result comparisons; environment installation belongs to foundationpose-setup.OtherNo warnings★ 3.8K↓ —
- make-pr-easy-to-reviewmichael-denyer/pstack-claudePrepare PRs for review by cleaning noisy history, improving PR descriptions, and adding reviewer guidance without changing code behavior. Use for "make this easy to review", "tidy this PR", "clean up commits", or "annotate the diff".EngineeringNo warnings★ 3.8K↓ —
- unmergeNewdavepoon/buildwithclaudeSplit a flat image (PNG, JPG or WebP) into separate transparent PNG layers with Unmerge, with the hidden parts behind objects filled in. Use when the user wants to separate an image into layers, pull a subject or text off its background as its own layer, make an editable layered version of a poster, illustration or screenshot, or "unflatten" an image. Needs an Unmerge API key in UNMERGE_API_KEY.MediaNo warnings★ 3.7K↓ —
- audit-context-buildingtrailofbits/skillsUnderstand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vulnerability-hunting pass.ProductivityNo warnings★ 8K↓ —
- fuzzing-dictionarytrailofbits/skillsBuilds and applies fuzzing dictionaries so a fuzzer can produce the keywords, magic bytes, and tokens a target expects. Covers extracting tokens from source, headers, binaries, and specifications, dictionary syntax, and wiring one into libFuzzer or AFL++. Use when fuzzing a parser, protocol, or file format, when coverage stalls at input validation, or when a target compares against fixed strings.PlanningNo warnings★ 8K↓ —
- triage-issue-reportsbacknotprop/pstackTriage Slack issue reports with one thread-only verdict, evidence review, cause-aware routing, tracker dedupe, and fail-closed ticket creation. Use only from the configured Benny triage automation.EngineeringNo warnings★ 3.4K↓ —
- docs-reviewforyourhealth111-pixel/Vibe-SkillsReview documentation changes for compliance with the Metabase writing style guide. Use when reviewing pull requests, files, or diffs containing documentation markdown files.EngineeringNo warnings★ 3.8K↓ —
- similarity-search-patternsforyourhealth111-pixel/Vibe-SkillsImplement efficient similarity search with vector databases. Use when building semantic search, implementing nearest neighbor queries, or optimizing retrieval performance.OtherNo warnings★ 3.8K↓ —
- package-usagepulumi/agent-skillsTrack which stacks across a Pulumi organization use a specific package and at what versions. Use for cross-stack audits, identifying outdated or unmaintained package versions across many stacks, finding affected stacks before publishing breaking changes to a component package, or planning coordinated upgrade rollouts. Do NOT use for upgrading a cloud provider package (pulumi-aws, pulumi-azure-native, pulumi-gcp, pulumi-kubernetes, etc.) in a single project — use skill `provider-upgrade` instead. Do NOT use for general infrastructure creation, resource provisioning, or how-to questions about a package.OfficialDevOpsNo warnings★ 78↓ —
- jetson-customize-uphyNVIDIA/skillsConfigure Jetson UPHY lane allocation (uphy0/uphy1-config) on Orin/Thor custom carriers. Do NOT use for pinmux or PCIe-only edits.WritingNo warnings★ 3.8K↓ —
- doca-mgmtNVIDIA/skillsUse this skill when the user is doing hands-on DOCA Management programming against BlueField / ConnectX devices — standing up a management or representor context (doca_mgmt_dev_ctx / doca_mgmt_dev_rep_ctx), querying device caps (data-direct, caps-general), toggling congestion-control global status, modifying diagnostics-data, setting ICM quotas, or issuing a raw firmware command via doca_mgmt_raw_cmd with the right scope (CONFIGURATION / DEBUG_READ_ONLY / DEBUG_WRITE / DEBUG_WRITE_FULL). Trigger even when the user does not say "DOCA Management" — typical implicit phrasings include "fleet tool that walks every BlueField and reads device state", "toggle data-direct on a VF", "set an ICM quota per representor", "send a raw firmware command from C", "DOCA_ERROR_IO_FAILED from raw_cmd", or "fwctl ioctl is failing". Refuse and route elsewhere for mlxconfig direct operation, BFB / firmware reflash, streaming telemetry, doca_caps CLI snapshots, or DOCA install itself — those belong to other skills.EngineeringNo warnings★ 3.8K↓ —
- mutation-testingtrailofbits/skillsConfigures mewt or muton campaigns, analyzes surviving mutants, and investigates bugs exposed by testing gaps. Use when setting up mutation testing, reviewing campaign results, identifying equivalent mutants, or finding bugs from surviving mutations.TestingNo warnings★ 8K↓ —
- provider-upgradepulumi/agent-skillsUpgrade any Pulumi provider to a newer version and reconcile the resulting diff. Use when users want to upgrade or update a provider (including editing package.json, requirements.txt, pyproject.toml, go.mod, or Pulumi.yaml to bump a provider SDK), check for breaking changes before or during an upgrade, fix resources that broke after a provider upgrade, or resolve unexpected replacements, creates, or deletes in a post-upgrade preview, including pulumi-gcp v10 errors such as a missing gcp.notebooks or gcp.iap.Brand type or a required secretDataWoVersion. Applies to all providers (aws, azure-native, gcp, kubernetes, aws-native, cloudflare, datadog, etc.) — not just Tier 1. Do NOT use for querying which stacks use what package versions; use skill `package-usage` for cross-stack audits. Do NOT use for general infrastructure tasks.OfficialDevOpsNo warnings★ 78↓ —
- yt-packagingjeremylongshore/tons-of-skills-marketplaceDevelop title and thumbnail concept pairs from an approved YouTube brief and record the user selection. Use when preparing packaging before outlining. Trigger with "package this video", "title ideas" or "thumbnail concepts".MediaNo warnings★ 2.9K↓ —
- pulumi-context-apipulumi/agent-skillsQuery the Pulumi Context API, a graph query interface over an organization's infrastructure in Pulumi Cloud. Use when a question is about relationships or reachability across resources and stacks: the impact of a change ("what breaks if I change this?", blast radius), what depends on a resource or a stack's outputs, which provider instances manage which resources and at what versions, orphaned or unreferenced resources, or references that cross stacks and cloud accounts, including resources Pulumi doesn't manage. Don't load it for finding a single resource by name, type, or property (Resource Search covers that), or for update history and failure debugging (use skill `pulumi-debug-failed-operation`).OfficialEngineeringNo warnings★ 78↓ —
- navigating-githubjeremylongshore/tons-of-skills-marketplaceFirst-time GitHub setup and interactive git learning. Walks users from zero to a working GitHub repo, then teaches git through 9 hands-on lessons on their actual project. Adapts language and depth to skill level — inferred from environment, not questionnaires. Two modes: Setup (guided onboarding) and Learn (progressive curriculum from commits to CI/CD). Use when the user asks to set up GitHub, learn git, or says "teach me github". Trigger with "set up my repo", "help me with github", "teach me github", "learn git", "what are branches", "teach me PRs", or "how do I use github".DevOpsNo warnings★ 2.9K↓ —
- managing-api-cachejeremylongshore/tons-of-skills-marketplaceImplement intelligent API response caching with Redis, Memcached, and CDN integration. Use when optimizing API performance with caching. Trigger with phrases like "add caching", "optimize API performance", or "implement cache layer".EngineeringNo warnings★ 2.9K↓ —
- figure-it-outbacknotprop/pstackDesign an auditable playbook when no narrower one fits: a large migration, an ambitious multi-part change, or work a human reviews after stepping away. Scales rigor to the task, runs a hypothesis loop, and logs decisions. Use for /figure-it-out or 'figure it out'.DesignNo warnings★ 3.4K↓ —
- hexanon-x402-apisdavepoon/buildwithclaudePay-per-call access to the Hexanon family of eight x402 APIs for autonomous agents — no signup, no API keys, USDC on Base. Covers US/Canada vehicle & VIN intelligence (Vindex), e-commerce demand signals (Demandex), Polymarket whale intelligence (OrcaTrace), GitHub trending-repo digests (gitBeacon), narrative intelligence (Signalis), Moltbook community digests (Moltalyzer), x402 seller conformance scanning (x402lint), and Polymarket weather-market signals (Isocast).EngineeringNo warnings★ 3.7K↓ —
- castai-rate-limitsjeremylongshore/tons-of-skills-marketplaceBuild a CAST AI REST client that respects endpoint-specific throttling, bounded retries, and an explicit request budget. Use when a job receives 429 responses, polls CAST AI, or fans out across clusters and organizations. Trigger with: "handle CAST AI rate limits", "stop CAST AI 429s", "make CAST AI polling safe".PlanningNo warnings★ 2.9K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.PlanningNo warnings★ 3.7K↓ —
offensive-wps
SnailSploit/Claude-Red
SecurityUpdated Oct 12, 2026
From the author
WPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.
Install
npx skills add SnailSploit/Claude-Red --skill offensive-wps -a claude-code
Installs to .claude/skills/offensive-wps/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 90
Security95
Provenance87
Maintenance100
Licence100
Adoption61
Files (1)
- SKILL.md