Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,395 skills from 2,375 repositories · updated 20 minutes ago
49,395 skills
- ton-vulnerability-scannertrailofbits/skillsScans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and forward TON without gas checks. Use when auditing FunC contracts.SecurityNo warnings★ 8K↓ —
- red-handed-auditdavepoon/buildwithclaudeCheck whether the tests the agent said passed actually ran. Reads the Claude Code session transcript and git state locally, then reports each gap with a timestamp and the quoted line. No model calls, nothing leaves the machine.TestingNo warnings★ 3.7K↓ —
- scientific-reportingforyourhealth111-pixel/Vibe-SkillsWrite research/technical reports with strong structure + figure standards. Supports Markdown/HTML/PDF outputs (Quarto optional), executive summary, methods, results, discussion, and reproducibility appendix.ScienceNo warnings★ 3.8K↓ —
- azure-image-builderhashicorp/agent-skillsBuild Azure managed images and Azure Compute Gallery images with Packer. Use when creating custom images for Azure VMs.OfficialDevOpsNo warnings★ 911↓ —
- doca-dmsNVIDIA/skillsOperate NVIDIA DOCA Management Service on a BlueField, Arm/x86 host, or Kubernetes pod: from DOCA 3.5 the local `dms-cli` (one command per YANG path, no server), and the `dmsd` + `dmspe` service: choose deployment and authentication, configure `-allowed_users` and `dmsgroup`, use gNMI Get/Set, run supported gNOI workflows, and debug frontend/backend failures. Trigger even without "DMS" for "manage a remote BlueField over gRPC", "gNOI reboot from orchestrator", or fleet-management requests. SAFETY: reboot, OS install, factory-reset, and managed-file deletion are destructive and require target-bound explicit confirmation; never invoke them speculatively. Route installation and library/API build questions elsewhere, and route telemetry streaming and aggregation to doca-dts (DOCA Telemetry Service).DevOpsNo warnings★ 3.8K↓ —
- gsd:pr-branchdavepoon/buildwithclaudeCreate a clean PR branch by filtering out .planning/ commits — ready for code reviewPlanningNo warnings★ 3.7K↓ —
- gsd:complete-milestonedavepoon/buildwithclaudeArchive completed milestone and prepare for next versionOtherNo warnings★ 3.7K↓ —
- meta-adsnowork-studio/notfair-pluginManage Meta Ads (Facebook + Instagram) — performance, ROAS, CPM, frequency, audience overlap, learning phase, creative fatigue, budgets, ad sets, campaigns, ads. Use for any mention of Meta Ads, Facebook Ads, Instagram Ads, ROAS, CPM, ad spend, or campaign settings on Meta.MarketingNo warnings★ 4.1K↓ —
- exa-rate-limitsjeremylongshore/tons-of-skills-marketplaceBudget Exa throughput per endpoint and distinguish caller rate limiting from vendor overload and billing exhaustion. Use when operating or reviewing this Exa boundary. Trigger with "Exa rate limits", "review Exa rate limits", or "fix Exa rate limits".EngineeringNo warnings★ 2.9K↓ —
- ops-firesdavepoon/buildwithclaudeProduction incidents dashboard. Reads ECS health, Sentry errors, CI failures. Offers to dispatch fix agents for active fires.OtherNo warnings★ 3.7K↓ —
- ramp-install-authjeremylongshore/tons-of-skills-marketplaceSelect and configure the correct Ramp OAuth grant, scopes, environments, and secret lifecycle. Use when bootstrapping an internal server integration or a third-party multi-tenant application. Trigger with "set up Ramp OAuth" or "Ramp client credentials".OtherNo warnings★ 2.9K↓ —
- gsd:research-phasedavepoon/buildwithclaudeResearch how to implement a phase (standalone - usually use /gsd:plan-phase instead)ScienceNo warnings★ 3.7K↓ —
- gsd:session-reportdavepoon/buildwithclaudeGenerate a session report with token usage estimates, work summary, and outcomesProductivityNo warnings★ 3.7K↓ —
- gsd:plan-phasedavepoon/buildwithclaudeCreate detailed phase plan (PLAN.md) with verification loopPlanningNo warnings★ 3.7K↓ —
- principle-build-the-levermichael-denyer/pstack-claudeApply to any non-trivial work, not just bulk work: edits, migrations, analyses, checks. Build the tool that does it or proves it (codemod, script, generator, or a skill your subagents follow) instead of working by hand. The tool is the artifact a reviewer can rerun.WritingNo warnings★ 3.9K↓ —
- lamindbforyourhealth111-pixel/Vibe-SkillsThis skill should be used when working with LaminDB, an open-source data framework for biology that makes data queryable, traceable, reproducible, and FAIR. Use when managing biological datasets (scRNA-seq, spatial, flow cytometry, etc.), tracking computational workflows, curating and validating data with biological ontologies, building data lakehouses, or ensuring data lineage and reproducibility in biological research. Covers data management, annotation, ontologies (genes, cell types, diseases, tissues), schema validation, integrations with workflow managers (Nextflow, Snakemake) and MLOps platforms (W&B, MLflow), and deployment strategies.DevOpsNo warnings★ 3.8K↓ —Also in 1 other repo
- tddNewwesammustafa/Claude-Code-Everything-You-Need-to-KnowBuilds a requested feature test-first, one behavior at a time, and stops at a diff for review. Use when the user asks for a new function or feature, or says test-first or TDD.TestingNo warnings★ 3.5K↓ —
- gsd:graphifydavepoon/buildwithclaudeBuild, query, and inspect the project knowledge graph in .planning/graphs/PlanningNo warnings★ 3.7K↓ —
- ctf-malwareljagiello/ctf-skillsProvides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.SecurityNo warnings★ 3.6K↓ —
- clawringdavepoon/buildwithclaudePhone calling skill for OpenClaw: agent makes real outbound phone calls to users for alerts, briefings, reminders, and urgent notifications. Managed service, no Twilio setup needed. 100+ countries, 70+ voices.OtherNo warnings★ 3.7K↓ —
- no-commentsmichael-denyer/pstack-claudeSpawn the comment-sicko subagent, fix accepted findings, and offer encodings for claimed constraints.OtherNo warnings★ 3.9K↓ —
- feedbackdavepoon/buildwithclaudeTurn post-task feedback—even blunt or angry feedback—into an evidence-based, approval-gated improvement plan for the agent/user workflow. Use after agent work goes wrong, misses expectations, creates friction, or should improve in future. Never mutate during the feedback turn.PlanningNo warnings★ 3.7K↓ —
- jetson-customize-usbNVIDIA/skillsEnable/disable Jetson USB2/USB3 SS ports via kernel-DT overlay. Do NOT use for UPHY lane allocation or ODMDATA edits.WritingNo warnings★ 3.8K↓ —
- unmergeNewdavepoon/buildwithclaudeSplit a flat image (PNG, JPG or WebP) into separate transparent PNG layers with Unmerge, with the hidden parts behind objects filled in. Use when the user wants to separate an image into layers, pull a subject or text off its background as its own layer, make an editable layered version of a poster, illustration or screenshot, or "unflatten" an image. Needs an Unmerge API key in UNMERGE_API_KEY.MediaNo warnings★ 3.7K↓ —
report-regressions
trailofbits/skills
MarketingUpdated 21 hours ago
From the author
Use when assembling or refreshing an evidence-linked regression report from saved campaign decisions.
Install
npx skills add trailofbits/skills --skill report-regressions -a claude-code
Installs to .claude/skills/report-regressions/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (1)
- SKILL.md