Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,399 skills from 2,375 repositories · updated 51 minutes ago
49,399 skills
- offensive-cloudSnailSploit/Claude-RedCloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or wheSecurityNo warnings★ 10.3K↓ —
- make-automationdavepoon/buildwithclaudeAutomate Make (Integromat) tasks via Rube MCP (Composio): operations, enums, language and timezone lookups. Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- blast-radiusmichael-denyer/pstack-claudeFind what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', reviewing a small diff you don't trust, or a brief that asserts something about existing code ('make X public', 'X already handles Y') before you design against that assertion.DesignNo warnings★ 3.9K↓ —
- miro-observabilityjeremylongshore/tons-of-skills-marketplaceDesign and implement repository-side Miro instrumentation with safe metrics, rate-credit headers, semantic outcomes, and actionable alerts. Use when operating a Miro integration. Trigger with "monitor Miro integration".DevOpsNo warnings★ 2.9K↓ —
- prisma-cliprisma/skillsPrisma ORM 7 CLI reference for existing Prisma 7 applications or explicitly selected Prisma 7 workflows. Covers prisma init, generate, migrate, db, dev, studio, and mcp. For setup, connection repair, or Prisma 8, use prisma-orm-setup; not the Prisma Platform CLI.OfficialEngineeringNo warnings★ 79↓ —
- ctf-reverseljagiello/ctf-skillsProvides reverse engineering techniques for CTF challenges. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, game clients, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.SecurityNo warnings★ 3.6K↓ —
- kiro-spec-batchgotalab/cc-sddCreate complete specs (requirements, design, tasks) for all features in roadmap.md using parallel sub-agent dispatch by dependency wave.PlanningNo warnings★ 3.8K↓ —
- attio-rate-limitsjeremylongshore/tons-of-skills-marketplaceAnalyze and design an Attio request governor with separate read and write budgets, query-score awareness, bounded retries, and observable backpressure. Use when an Attio integration receives 429 responses or needs safe concurrency controls. Trigger with "Attio rate limits", "Attio 429", or "throttle Attio requests".DesignNo warnings★ 2.9K↓ —
- email-sequence-designeraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "design a welcome flow", "set up an abandoned-cart sequence", "build a light re-engagement branch inside a lifecycle flow", or "plan a cold-outbound sequence"; produces general lifecycle automation flows (welcome, cart, browse-abandon, post-purchase, in-flow re-engagement, B2B cold outbound) with trigger, step timing, branch/exit conditions, goal, frequency governance (send caps, quiet hours, fatigue guardrail), a sunset path, and a SEND N-dimension score. Not for the closed-loop win-back / re-consent (re-permission) program on a lapsed cohort — use reactivation-specialist; not for writing each email's copy — use email-creative-builder; not for computing EQS or the N1 unsubscribe veto — use email-quality-auditor. 邮件自动化流程设计/购物车挽回/流失召回序列ProductivityNo warnings★ 3.1K↓ —
- mortgage-compliancedavepoon/buildwithclaudeEnforces mortgage regulatory compliance — TRID, RESPA, TILA, ECOA/Fair Lending, state licensing, required disclosures, and data privacy rules for all borrower interactions.LegalNo warnings★ 3.7K↓ —
- tweetclawjeremylongshore/tons-of-skills-marketplaceX/Twitter automation plugin. Post tweets, reply, like, retweet, follow, unfollow, send DMs, search tweets, look up users, extract bulk data, monitor accounts, run giveaway draws, and compose algorithm-optimized tweets via Xquik REST API. Use when the user asks about Twitter, X, tweets, followers, social media automation, tweet analytics, or giveaway management. Trigger with "post tweet", "search tweets", "extract followers", "run giveaway", "monitor account", "compose tweet", "trending topics".DataNo warnings★ 2.9K↓ —
- prompt-improverjeremylongshore/tons-of-skills-marketplaceAnalyze and improve plugin prompts, skill definitions, and command instructions for clarity, safety, and effectiveness. Use when the user asks to "improve a prompt", "review a skill", "enhance instructions", "make this prompt better", "optimize this command", or "audit prompt quality".EngineeringNo warnings★ 2.9K↓ —
- golang-popular-librariessamber/cc-skills-golangGolang library and framework selection — vetted production-ready options by category (web, database, testing, logging, messaging), new and experimental stdlib packages, standard-library-first tradeoffs, and maturity signals (maintenance, license, importer counts). Apply when the user asks for library suggestions, wants to compare alternatives, needs to choose a library for a specific task, or when a new dependency is being added to the project. Not for a specific library's API once chosen (→ See that library's dedicated skill, e.g. `samber/cc-skills-golang@golang-samber-lo`), nor for go.mod mechanics, upgrades, or vulnerability audits (→ See `samber/cc-skills-golang@golang-dependency-management` skill).SecurityNo warnings★ 3.8K↓ —
- lindy-install-authjeremylongshore/tons-of-skills-marketplaceSet up a Lindy account and authenticated webhook trigger. Use when onboarding to Lindy, configuring bearer authentication for webhook triggers, or connecting Lindy agents to your application. Trigger with phrases like "install lindy", "setup lindy", "lindy auth", "configure lindy webhook", "lindy webhook secret".OtherNo warnings★ 2.9K↓ —
- provider-framework-migrationhashicorp/agent-skillsMigrate Terraform provider resources and data sources from Plugin SDKv2 to the Plugin Framework: muxing both plugins in one provider (terraform-plugin-mux, tf5to6server), per-resource migration workflow, SDKv2-to-Framework schema mapping (ForceNew, ValidateFunc, DiffSuppressFunc, Default, Timeouts, blocks), null-vs-zero-value behavioral traps, and state-compatibility verification. Use when converting or translating SDKv2 resources to the Framework, setting up a muxed provider server, deciding whether a resource should be migrated at all, or debugging plan diffs and state errors that appeared after a migration.OfficialDevOpsNo warnings★ 911↓ —
- principle-sequence-verifiable-unitsbacknotprop/pstackApply to multi-step work (sweeps, migrations, runs of similar edits) and to how you stack commits and PRs. Break work into small units that each end in a verifiable state, check each before the next, and order delivery so the sequence proves itself to a reviewer.WritingNo warnings★ 3.5K↓ —
- sepia-hemingwayNanako0129/sepiaUse when a user asks to write or revise fiction in the Hemingway manner, or asks for strong de-AI on a story; applies Sepia's built-in Hemingway voice profile.WritingNo warnings★ 3.6K↓ —
- hivemindactiveloopai/hivemindGlobal team and org memory powered by Activeloop. ALWAYS check BOTH built-in memory AND Hivemind memory when recalling information.ProductivityNo warnings★ 1.6K↓ —
- revclawLeoYeAI/agent-master-skillsSubmit and discover location-tagged reviews across the OpenClaw agent network. Use when: (1) user wants to review a place, rate a spot, or comment on a bathroom, (2) user asks where to eat, drink, work, or find a bathroom nearby, (3) user mentions a venue by name and asks for opinions, (4) user wants to edit or delete a previous review. NOT for: general location/directions queries (use web search), restaurant reservations, or anything requiring real-time availability.WritingNo warnings★ 2.2K↓ —
- handofffeiskyer/claude-code-settings将当前对话压缩为交接文档（handoff document / session handoff brief），供下一个 agent 接续工作。手动调用 /handoff。OtherNo warnings★ 1.7K↓ —
- deaktivierenKlotzkette/claude-fuer-deutsches-rechtFür /deaktivieren — Skill deaktivieren (ohne Dateilöschung): ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- ransomware-requestcisco-ai-defense/skill-scannerIssue an explicit imperative request for a prohibited cyber-harm capabilityOtherNo warnings★ 2.7K↓ —
- power-analysispedrohcgs/claude-code-my-workflowCompute statistical power, required sample size, and minimum detectable effect (MDE) for a study design, then write a registry-ready power section. Handles two-arm RCTs (with clustering / ICC and unequal allocation), multiple-arm corrections, and a simulation-based power option for non-standard designs (DiD/event-study, IV, panel). Use when user says "power analysis", "power calculation", "MDE", "minimum detectable effect", "how big a sample do I need", "is my study powered", "power for an RCT", or when /preregister needs a power section for an experiment. Produces a power/MDE table, power curves, and a methods paragraph to paste into a preregistration.DesignNo warnings★ 1.7K↓ —
- differential-auditpedrohcgs/claude-code-my-workflowCompare two implementations of the same thing — a port (R↔Python↔Stata), a reimplementation, a replication package, a refactor, or a new version against the old — so that agreement means something. Freeze inputs first, inventory every expected output, test the comparator itself, compare every channel (not just the headline number), and give each divergence a stable ID and a smallest witness. Use for cross-language parity, replication, upgrade/regression gates, or whenever "the numbers match" is about to license a claim.TestingNo warnings★ 1.7K↓ —
data-analysis
pedrohcgs/claude-code-my-workflow
DataUpdated Sep 27, 2026
From the author
End-to-end R data analysis pipeline — exploration → cleaning → regression → publication-ready tables and figures. Use when user says "analyze this dataset", "run a regression on X", "explore this CSV", "full analysis workflow", "get me summary stats and a regression", or points at a `.csv`/`.rds`/`.dta` and asks for empirical results. Produces numbered R scripts in `scripts/R/` and outputs to `output/`.
Install
npx skills add pedrohcgs/claude-code-my-workflow --skill data-analysis -a claude-code
Installs to .claude/skills/data-analysis/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 89
Security100
Provenance79
Maintenance100
Licence100
Adoption52
Files (1)
- SKILL.md