Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,492 skills from 2,391 repositories · updated 5 hours ago
49,492 skills
- sepia-refactorNanako0129/sepiaUse when a user explicitly requests Sepia refactor for minimal in-place prose revision.EngineeringNo warnings★ 3.6K↓ —
- scikit-bioforyourhealth111-pixel/Vibe-SkillsBiological data toolkit. Sequence analysis, alignments, phylogenetic trees, diversity metrics (alpha/beta, UniFrac), ordination (PCoA), PERMANOVA, FASTA/Newick I/O, for microbiome analysis.ScienceNo warnings★ 3.8K↓ —
- sepia-recreateNanako0129/sepiaUse when a user explicitly requests Sepia recreate for a full rewrite.OtherNo warnings★ 3.6K↓ —
- vulnerability-triage-brocardstrailofbits/skillsThis skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding", "dismiss a vulnerability", "should we fix this CVE", "prioritize a vulnerability report", or needs to determine whether an incoming vulnerability report warrants investigation. Applies 7 brocards (rules of thumb) to systematically accept, dismiss, or request more information on vulnerability reports, or needs to filter raw findings from agentic vulnerability discovery pipelines before human review.SecurityNo warnings★ 8K↓ —
- privacy-generatorjeremylongshore/tons-of-skills-marketplaceDraft a service-specific privacy notice from confirmed processing facts, source observations and scoped applicability review, with a separate evidence and unresolved-questions record. Use when preparing or revising a privacy policy. Trigger with "privacy-generator" or "create a privacy policy".PlanningNo warnings★ 2.9K↓ —
- kiro-spec-tasksgotalab/cc-sddGenerate implementation tasks for a specificationPlanningNo warnings★ 3.8K↓ —Also in 4 other repos
- socialclawdavepoon/buildwithclaudeSocial media scheduling and publishing for AI agents. Use when the user wants to schedule posts, connect social accounts, upload media, or publish campaigns to X, LinkedIn, Instagram, Facebook Pages, TikTok, Discord, Telegram, YouTube, Reddit, WordPress, or Pinterest through SocialClaw.MarketingNo warnings★ 3.7K↓ —
- cudaq-importingNVIDIA/skillsUse when porting circuits from another framework (e.g. Qiskit) into CUDA-Q kernels while preserving the source algorithm and validation fidelity.OtherNo warnings★ 3.9K↓ —
- sepia-hemingwayNanako0129/sepiaUse when a user asks to write or revise fiction in the Hemingway manner, or asks for strong de-AI on a story; applies Sepia's built-in Hemingway voice profile.WritingNo warnings★ 3.6K↓ —
- kiro-debuggotalab/cc-sddInvestigate implementation failures using root-cause-first debugging. Use when an implementer is blocked, verification fails, or repeated remediation does not converge.EngineeringNo warnings★ 3.8K↓ —
- kiro-spec-statusgotalab/cc-sddShow specification status and progressPlanningNo warnings★ 3.8K↓ —Also in 7 other repos
- outreach-manageraaron-he-zhu/aaron-marketing-skillsUse when the user asks to "write influencer outreach", "follow up with a creator", "pitch a journalist, hunter, or launch partner", or "negotiate partnership terms"; produces personalized pitches, multi-touch follow-up sequences, negotiation scripts with objection handling, and a status pipeline tracker — the shared outreach mechanics engine for creator, media/analyst, launch-partner, and social-selling / advocate-recruitment targets. Not for finalizing signed agreements — use contract-helper; not for media-list tiering, embargo terms, or press-release structure — use press-media-relations. 达人邀约建联/合作谈判话术LegalNo warnings★ 3.1K↓ —
- design-code-architecturewondelai/skillsGuided journey from an app idea to a deliberate architecture: boundaries, domain model, data decisions, and resilience, making only the expensive-to-reverse decisions and deferring the rest. Orchestrates eight skills phase by phase - clean-architecture, domain-driven-design, system-design, ddia-systems, software-design-philosophy, release-it, pragmatic-programmer, 37signals-way - asking the user questions at every decision point and recording results in the project docs/ folder (ARCHITECTURE.md, DESIGN-CODE-ARCHITECTURE-PLAN.md) so the journey resumes across sessions. Use when the user wants to design a new app's architecture, choose boundaries and a domain model, decide monolith versus microservices, or says 'how should I structure this app'. If a codebase already exists, use remove-technical-debt (aged), improve-code-quality (fresh prototype), or architecture-optimization (slow but working); if unvalidated, run create-business or create-app first. For one framework in isolation, invoke that skill directly.DesignNo warnings★ 2.6K↓ —Also in 2 other repos
- technical-documentationwondelai/skillsAudit, write, and improve developer documentation using Google's Developer Documentation Style Guide and Technical Writing courses. Use this skill for any documentation work, even when the user names no style guide: "audit our docs", "review this README", "write a README", "getting started guide", "how-to or tutorial", "API reference", "docstrings", "CLI help text", "changelog or release notes", "migration guide", or "our docs are confusing". Also use it when writing docs from code, rewriting a doc for clarity, fixing headings, procedures, or code samples, or enforcing consistent voice and terminology across a docs set — prefer it over editing documentation unaided. Covers reader and doc-type fit, second person and active voice, procedures, headings, lists and tables, code samples and placeholders, link text, notices, the word list, timeless docs, and accessibility. For code comments and naming, see clean-code. For marketing or landing-page copy, see storybrand-messaging.MarketingNo warnings★ 2.6K↓ —Also in 2 other repos
- steps-plan-pmoKlotzkette/claude-fuer-deutsches-rechtFür Steps Plan und Deal-PMO: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.PlanningNo warnings★ 1.8K↓ —
- gtarsK-Dense-AI/scientific-agent-skillsSupports Gtars for local genomic interval models and set algebra, overlaps and counts, consensus and coverage, tokenization, fragment processing, and refget/BEDbase planning across Python, Rust, and the CLI.ScienceNo warnings★ 56.1K↓ —Also in 2 other repos
- cellprofilerK-Dense-AI/scientific-agent-skillsRuns reproducible CellProfiler microscopy pipelines for nuclear segmentation, cell counts, and per-object fluorescence measurements. Supports image/channel manifests, headless batch execution, segmentation overlays, and measurement QC for 2D fluorescence assays.MediaNo warnings★ 56.1K↓ —
- memorycodeaholicguy/ai-devkitAI DevKit · Use the memory CLI as a durable knowledge layer. Search before non-trivial work, store verified reusable knowledge, update stale entries, and avoid saving transcripts, secrets, or one-off task progress.ProductivityNo warnings★ 1.7K↓ —
- labarchive-integrationK-Dense-AI/scientific-agent-skillsIntegrates with the official LabArchives ELN REST-like API and Inventory API v1. Supports regional endpoint selection, signed-request construction, user authorization and UID flows, local LA container validation, and verified LabArchives integration workflows.EngineeringNo warnings★ 56.1K↓ —
- unioneLeoYeAI/agent-master-skillsSend transactional and marketing emails via UniOne Email API. Manage email templates, validate email addresses, check delivery statistics, manage suppression lists, configure webhooks, and handle domain settings. UniOne delivers billions of emails annually with 99.88% deliverability.MarketingNo warnings★ 2.2K↓ —
- cloud-monitoring-promql-querygoogle/skillsGenerates valid PromQL queries from Cloud Monitoring metric descriptors and resource parameters. Use when asked to create, generate, write, or format PromQL queries, PromQL strings, or PromQL aggregations for Cloud Monitoring metrics and resources. Don't use for raw metric discovery or metric selection.OfficialWritingNo warnings★ 21.9K↓ —
- one-page-marketingwondelai/skillsBuild a complete marketing plan covering the full customer journey from stranger to raving fan. Use when the user mentions "marketing plan", "marketing strategy", "target market", "USP", "lead nurture", "customer lifetime value", "PVP Index", or "I dont know where to start with marketing". Also trigger when building a marketing plan from scratch, choosing acquisition channels, or designing end-to-end customer-lifecycle campaigns. Covers the PVP Index, channel selection, and advocacy systems. For brand messaging, see storybrand-messaging. For conversion optimization, see cro-methodology.MarketingNo warnings★ 2.6K↓ —Also in 2 other repos
- clean-architecturewondelai/skillsStructure software around the Dependency Rule: source code dependencies point inward from frameworks to use cases to entities. Use when the user mentions "architecture layers", "dependency rule", "ports and adapters (hexagonal)", "onion architecture", "screaming architecture", "where should business logic go", "decouple from the database", "swap the framework without a rewrite", or "keep business rules independent". Also trigger when deciding which layer code belongs in, isolating core logic from infrastructure, defining module boundaries, or debating whether the framework should call your code or the reverse. Covers component principles, boundaries, and SOLID. For code-level quality, see clean-code. For domain modeling, see domain-driven-design.PlanningNo warnings★ 2.6K↓ —Also in 2 other repos
- noxalhaftungKlotzkette/claude-fuer-deutsches-rechtFür Noxalhaftung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
code-maturity-assessor
trailofbits/skills
EngineeringUpdated 2 days ago
From the author
Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing, then produces a scorecard with evidence-based ratings and a priority-ordered roadmap. Use when assessing or scoring the maturity of a smart contract or blockchain codebase, producing a maturity scorecard or evaluation, or judging how mature, well-tested, or well-documented such a project is against a rubric.
Install
npx skills add trailofbits/skills --skill code-maturity-assessor -a claude-code
Installs to .claude/skills/code-maturity-assessor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (CC-BY-SA-4.0) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyNo network use seenLicence: CC-BY-SA-4.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance87
Maintenance100
Licence80
Adoption61
Files (6)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg
- resources/ASSESSMENT_CRITERIA.md
- resources/EXAMPLE_REPORT.md
- resources/REPORT_FORMAT.md