Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,395 skills from 2,375 repositories · updated 35 minutes ago
49,395 skills
- devil-advocatejeremylongshore/tons-of-skills-marketplaceConstructive critic and stress-tester for ideas and proposals. Use when the user needs to challenge assumptions, find weaknesses, anticipate objections, or strengthen an argument. Trigger with "challenge", "critique", "push back", "poke holes", "stress test", "what am I missing", or "play devil's advocate".TestingNo warnings★ 2.9K↓ —
- gsd:extract-learningsdavepoon/buildwithclaudeExtract decisions, lessons, patterns, and surprises from completed phase artifactsOtherNo warnings★ 3.7K↓ —
- performanceplugin87/ux-ui-agent-skillsOptimize UI performance against Core Web Vitals (LCP, INP, CLS) with loading/code-split strategy, layout-shift prevention, and animation performance rules. Use when the user wants to improve speed, fix jank or layout shift, hit Web Vitals budgets, or make a UI feel fast on low-end devices.DesignNo warnings★ 3.1K↓ —
- dev-browsercode-yeongyu/oh-my-openagentBrowser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website", "log into", or any browser interaction request.BrowserNo warnings★ 70.7K↓ —
- gsd:quickdavepoon/buildwithclaudeExecute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agentsProductivityNo warnings★ 3.7K↓ —
- json-canvasdavepoon/buildwithclaudeCreate and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.WritingNo warnings★ 3.7K↓ —Also in 1 other repo
- gsd:fastdavepoon/buildwithclaudeExecute a trivial task inline — no subagents, no planning overheadPlanningNo warnings★ 3.7K↓ —
- ops-triagedavepoon/buildwithclaudeCross-platform issue triage. Pulls from Sentry (MCP), Linear (MCP), GitHub Issues (gh). Cross-references against code to find already-fixed issues. Auto-resolves fixed ones. Dispatches agents for active issues.EngineeringNo warnings★ 3.7K↓ —
- constant-time-analysistrailofbits/skillsDetects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.SecurityNo warnings★ 8K↓ —
- comment-checkercode-yeongyu/oh-my-openagentUse when Codex needs to understand or respond to automatic comment-checker feedback emitted after an edit-like PostToolUse hook.WritingNo warnings★ 70.7K↓ —
- quit-sponsorjeremylongshore/tons-of-skills-marketplaceTurns an AI agent with persistent memory into a quit-smoking sponsor. Use when a person asks for help quitting smoking (cigarettes or other smoked tobacco), announces they are quitting, reports a craving, a slip, or a relapse, goes silent mid-quit, or asks the agent to witness and track a quit. Provides evidence-based protocols (immediate execution of the quit decision, urge surfing, slip attribution coaching, withdrawal timelines, nutrition and alcohol rules, NRT guidance, a two-year aftercare cadence) plus a sponsor decision tree with an order-of-operations for colliding rules, a three-clause contract, purge ritual, graded live-crisis ladder for a pack already in hand, wave protocol, slip and post-relapse protocols, recurrence escalation, silence protocol, a Ulysses pact, a red-flag medical playbook, high-risk situation mapping, if-then plans, and a timestamped logbook. Includes a low-verbal client mode and an optional module for cannabis co-use and tobacco-mixed joints. Not a medical device.ScienceNo warnings★ 2.9K↓ —
- gsd:dodavepoon/buildwithclaudeRoute freeform text to the right GSD command automaticallyOtherNo warnings★ 3.7K↓ —
- setup-bennybacknotprop/pstackConfigure Benny and prepare its triage and repro automations. Use when installing Benny or changing its Slack, tracker, repository, routing, control, model, or budget settings.OtherNo warnings★ 3.5K↓ —
- file-organizerdavepoon/buildwithclaudeIntelligently organizes your files and folders across your computer by understanding context, finding duplicates, suggesting better structures, and automating cleanup tasks. Reduces cognitive load and keeps your digital workspace tidy without manual effort.ProductivityNo warnings★ 3.7K↓ —
- frost-sequence-camera-orbitheygen-com/hyperframesAn orbiting camera follows an ice logo as it breaks apart, reforms into two text moments, and fades. HyperFrames block, 1920×1080, 22.5s, 216 variables.OfficialOtherNo warnings★ 78.1K↓ —
- pixelfxNewpatch-gg/pixelfxMake pixel art effects and sprite animations in code with the pixelfx library, which has 244 ready-made ones, acted out by a character who winds up, freezes on contact and recovers (fire, explosions, water, ice, lightning, sci-fi, melee, impacts, projectiles, spawn and death, arcane, holy, shadow, status, nature, weather, UI, pickups, transitions, critters) to drop into a game, recolor, export as sprite sheets or remix, plus a draft, render, look, refine loop that makes new ones look hand-animated. Use when someone wants pixel art VFX, sprite animations or sprite sheets, game juice, a specific effect ("a frost nova for my mage", "a coin pickup sparkle"), wants to use or export a pixelfx effect in Godot, Unity, Phaser or a canvas game, or wants their pixel effects to look better.DesignNo warnings★ 3.9K↓ —
- gsd:join-discorddavepoon/buildwithclaudeJoin the GSD Discord communityOtherNo warnings★ 3.7K↓ —
- report-regressionstrailofbits/skillsUse when assembling or refreshing an evidence-linked regression report from saved campaign decisions.MarketingNo warnings★ 8K↓ —
- vector-forgetrailofbits/skillsMutation-driven test vector generation. Finds implementations of a cryptographic algorithm or protocol, runs mutation testing to identify escaped mutants, then generates new test vectors that deliberately exercise the uncovered code paths. Compares before/after mutation kill rates to prove vector effectiveness. Use when generating cryptographic test vectors, measuring Wycheproof coverage gaps, finding escaped mutants via mutation testing, creating cross-implementation test suites, or improving test vector coverage for crypto primitives.TestingNo warnings★ 8K↓ —
- yaml-masterjeremylongshore/tons-of-skills-marketplaceExecute proactive YAML intelligence: automatically activates when working with YAML files. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.ProductivityNo warnings★ 2.9K↓ —
- doca-compressNVIDIA/skillsHardware compression offload with DOCA Compress on a BlueField DPU, ConnectX NIC, or host: DEFLATE compress and decompress, plus LZ4 decompress (stream and block; LZ4 encode is NOT supported), instead of CPU zlib / zstd. Trigger on "offload this gzip", "decompress incoming network data on the NIC", "compress task returns INVALID_VALUE on alloc_init", "submitted a task but no completion arrives", or "decompress LZ4 on the BlueField", even without naming DOCA Compress. Covers enabling compress-deflate, decompress-deflate, decompress-lz4-stream and decompress-lz4-block tasks on a doca_compress context, sizing source / destination doca_buf against the per-task cap query, mmap permissions, offload vs CPU decisions, a round-trip smoke, and DOCA_ERROR_* from Compress calls. Refuse and route elsewhere for zstd / Snappy / brotli, LZ4 encode (a CPU LZ4 library), pure mmap-to-mmap copies (doca-dma), or DOCA Core lifecycle internals.ProductivityNo warnings★ 3.8K↓ —
- miro-rate-limitsjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side Miro REST traffic controls from credit weights, supplied headers, bounded queues, and reset-aware retries. Use when preventing or recovering from Miro 429 responses. Trigger with "Miro rate limit".DesignNo warnings★ 2.9K↓ —
- seo-pagenowork-studio/notfair-pluginSingle-page SEO audit: content quality under Google's E-E-A-T framework and Helpful Content guidelines, on-page factors, search intent, technical signals and readability. Pulls GSC data for the page, crawls the live HTML, checks metadata, schema, internal linking and depth, and produces a scored report with fixes. Use whenever the user wants to analyze a specific page or URL, not the whole site. Trigger on: "analyze this page", "audit this URL", "how is this page doing", "evaluate my blog post", "check this landing page", "page SEO", "content quality check", "is this page good enough", "review this page's SEO", "what's wrong with this page", "how can I improve this page", "page analysis", "single page audit", "content audit for [URL]", or any request naming a specific URL/page for SEO evaluation. If the user provides a specific URL (not just a domain), this is likely the right skill; use /seo-analysis for full-site audits instead.MarketingNo warnings★ 4.1K↓ —
- reproduce-bugtrailofbits/skillsUse when a named runtime or compiler bug in a local repository needs independent reproduction.OtherNo warnings★ 8K↓ —
spec-to-code-compliance
trailofbits/skills
LegalUpdated 21 hours ago
From the author
Check code against the documentation that specifies it - which requirements hold, which the code contradicts, which are absent, and what the code does that no document mentions. Use when comparing an implementation against a whitepaper, protocol spec, or design document.
Install
npx skills add trailofbits/skills --skill spec-to-code-compliance -a claude-code
Installs to .claude/skills/spec-to-code-compliance/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (7)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- resources/ANALYSIS_FORMAT.md
- resources/DIVERGENCE_RUBRIC.md
- resources/DOMAIN_NOTES.md
- resources/WORKED_EXAMPLE.md