Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,492 skills from 2,391 repositories · updated 4 hours ago
49,492 skills
- entry-point-analyzertrailofbits/skillsAnalyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.SecurityNo warnings★ 8K↓ —
- exa-install-authjeremylongshore/tons-of-skills-marketplaceConfigure an Exa client without leaking credentials or mixing API-key, MCP OAuth, enterprise managed authorization, and payment-protocol trust models. Use when operating or reviewing this Exa boundary. Trigger with "Exa install auth", "review Exa install auth", or "fix Exa install auth".EngineeringNo warnings★ 2.9K↓ —
- trailmark-variant-neighborhoodtrailofbits/skillsExpands one confirmed or suspected vulnerability into a Trailmark graph neighborhood of variant candidates by finding sibling functions, shared callers and callees, common sensitive sinks, common entrypoint paths, interface implementations, override relationships, type/reference neighbors, and structurally similar nodes. Use after one issue is found to seed variant-analysis, semgrep-rule-creator, static-analysis, or manual review with graph-derived candidate locations.SecurityNo warnings★ 8K↓ —
- prepare-regressiontrailofbits/skillsUse when pinning before/after sources and collecting PR or commit context for a regression investigation.FinanceNo warnings★ 8K↓ —
- libfuzzertrailofbits/skillsSets up and runs libFuzzer, the coverage-guided fuzzer built into LLVM, on C/C++ code that compiles with Clang. Covers harness structure, -fsanitize=fuzzer builds, corpus and dictionary management, sanitizer integration, and campaign triage. Use when writing or debugging an LLVMFuzzerTestOneInput harness, starting fuzzing on a C/C++ library, choosing between libFuzzer and AFL++, or working out why a libFuzzer run finds nothing.MarketingNo warnings★ 8K↓ —
- offensive-evil-twinSnailSploit/Claude-RedEvil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.OtherNo warnings★ 10.3K↓ —
- trailmark-review-gatetrailofbits/skillsRuns a Trailmark structural review gate over a branch, pull request, fix commit, release diff, or git ref range to detect new entrypoints, new tainted paths, removed validation or authorization calls, privilege-boundary drift, blast-radius growth, complexity growth, and newly reachable sensitive sinks. Use when reviewing a PR, branch, remediation commit, or release diff where graph-level security regressions should be checked before merge.EngineeringNo warnings★ 8K↓ —
- doca-bf3-deploymentNVIDIA/skillsUse this skill for BlueField-3 (BF3) day-1 platform bring-up via the classic RShim/BFB path: pushing a BlueField bundle (BFB) to the DPU over RShim with bfb-install from the host, the host-to-DPU TMFIFO management channel (tmfifo_net0, the 192.168.100.x convention), RShim daemon state and console-over-rshim, DPU mode selection (DPU/embedded-function vs separated-host/NIC mode) via mlxconfig, post-BFB recovery, a six-state BlueField-state classifier, and verifying the install (cat /etc/mlnx-release plus version checks). Trigger even when the user does not say "BF3" — typical phrasings include {push a BFB to my BlueField-3}, {bfb-install exited 0 but the DPU never came back}, {ping 192.168.100.2 works but ssh fails}, or {is DOCA on the host or the Arm side?}. BFB reflash, mlxconfig set, mode changes, and firmware burns are destructive: require explicit target-bound confirmation and load doca-hardware-safety. App launch, container deploy, env install, and the BF4 BMC-Redfish path route elsewhere.DevOpsNo warnings★ 3.9K↓ —
- jetson-derive-carrierNVIDIA/skillsBootstrap a custom carrier board by forking carrier files and scaffolding a DT overlay from the reference devkit. Use after jetson-init-source; not for module-level or kernel-DTB changes.OtherNo warnings★ 3.9K↓ —
- atheristrailofbits/skillsSets up and runs Atheris, the coverage-guided Python fuzzer built on libFuzzer. Covers TestOneInput harnesses, FuzzedDataProvider, instrumenting both pure Python and native C extensions, and running under AddressSanitizer. Use when fuzzing a Python package, hunting memory corruption in a Python C extension, or choosing between Atheris and Hypothesis for a Python target.EngineeringNo warnings★ 8K↓ —
- clickup-automationdavepoon/buildwithclaudeAutomate ClickUp project management including tasks, spaces, folders, lists, comments, and team operations via Rube MCP (Composio). Always search tools first for current schemas.ProductivityNo warnings★ 3.7K↓ —
- recalldavepoon/buildwithclaudeSearch Origin's local memory by query. Targeted lookup, not orientation. Invoked as `/recall <query>`. Use when the user asks "do you remember", "what do you know about", "look up".ProductivityNo warnings★ 3.7K↓ —
- verified-emailUpdatedandroid/skillsProvides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-less email verification flow into an Android app. This skill solves the problem of high-friction sign-up processes by leveraging cryptographically verified credentials from trusted providers like Google.OfficialProductivityNo warnings★ 10.3K↓ —
- mergers-and-acquisitionscbrock84/headcountRuns corporate development — deal thesis, target screening, valuation framing, diligence, and integration planning. Use this when considering an acquisition or being approached about one, when evaluating build-versus-buy at company scale, when running or reviewing diligence, or when planning how an acquired business will actually be integrated.FinanceNo warnings★ 2.6K↓ —
- video-podcast-maker-nanoAgents365-ai/video-podcast-makerSmallest personal narrated-explainer-video pipeline (spoken narration over visuals, not an audio podcast), fully tool-agnostic and autonomous by default — topic → research ∥ asset collection → script → TTS → video → 4K render ∥ publish info + cover. The skill defines the pipeline logic and self-verified checkpoints; any TTS backend and any video tool (Remotion, HyperFrames, CapCut, ...) work, and how much human oversight to apply is set by the working project's AGENTS.md/CLAUDE.md, not here. Use when the user wants a quick personal narrated video with minimal steps, whether or not they name the tool stack. Do NOT trigger for audio-only podcasts, written episodic content, or heavy multi-format production.MediaNo warnings★ 1.7K↓ —
- nature-figureYuan1z0825/nature-skillsCreate, revise, audit, and export manuscript scientific figures in Python or R. Use for 论文配图、科研绘图、多面板图 and submission-ready plots, or explicitly requested AI-generated graphical abstracts and mechanism schematics. Not for interactive dashboards, data cleaning, or statistics-only analysis.ScienceNo warnings★ 52.2K↓ —
- architecture-optimizationwondelai/skillsGuided journey from a working codebase grown slow and tangled to one measurably fast, cleanly bounded, and readable. Orchestrates eight skills phase by phase - working-with-legacy-code, clean-architecture, software-design-philosophy, refactoring-patterns, system-design, ddia-systems, release-it, pragmatic-programmer - every phase carries its method inline so it runs standalone, asking the user questions at every decision point and recording results in the project docs/ folder (PERFORMANCE.md, ARCHITECTURE.md, ARCHITECTURE-OPTIMIZATION-PLAN.md) so the journey resumes across sessions. Use when the user wants to make an app faster, untangle drifted boundaries, fix slow endpoints and queries, or says 'it works but it is slow and getting worse'. For an untested prototype, improve-code-quality; for an aged codebase you fear to touch, remove-technical-debt; for greenfield structure, design-code-architecture; for marketing-site page speed, improve-website. For one framework in isolation, invoke that skill directly.PlanningNo warnings★ 2.6K↓ —Also in 2 other repos
- anndataK-Dense-AI/scientific-agent-skillsHandles annotated matrices in single-cell analysis, .h5ad and Zarr files, and integration with the scverse ecosystem. This is the data format skill—for analysis workflows use scanpy; for probabilistic models use scvi-tools; for population-scale queries use cellxgene-census.OtherNo warnings★ 56.1K↓ —Also in 2 other repos
- docs-sync-auditgithub/awesome-copilotRun a read-only documentation drift audit for a feature, PR, branch, release, API, configuration change, workflow, CLI, package, or repository area. Use when the user asks whether docs are stale, missing, inconsistent with code, or need updates after code changes. Checks README files, setup guides, API docs, env docs, changelogs, examples, comments, generated docs, and user-facing instructions. This is not a general code review; it compares what the docs claim against what the code does.EngineeringNo warnings★ 40.8K↓ —
- blog-translateAgriciDaniel/claude-blogTranslate existing blog posts into one or more target languages with SEO-optimized localization. Produces native-quality translations that preserve markdown structure, frontmatter, schema JSON-LD, image and chart embeds, and evidence-backed explanations. Localizes keywords, meta tags, numbers, dates, currencies, and quote styles per locale. Flags machine-translation artifacts for review. Run BEFORE blog-localize: this handles language conversion; localize handles cultural adaptation after translation completes. Use when user says "translate blog", "blog translate", "uebersetzen", "traduire", "traducir", "translate post", "blog auf Deutsch", "blog en espanol".WritingNo warnings★ 2.6K↓ —
- darlehen-mutuumKlotzkette/claude-fuer-deutsches-rechtFür Darlehen Mutuum: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- subunternehmerKlotzkette/claude-fuer-deutsches-rechtFür Subunternehmer: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: subunternehmer.OtherNo warnings★ 1.8K↓ —
- konzernklauselKlotzkette/claude-fuer-deutsches-rechtFür Konzernklausel: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: konzernklausel.OtherNo warnings★ 1.8K↓ —
- ki-service-agbKlotzkette/claude-fuer-deutsches-rechtPrüft AGB für KI-Dienste auf Leistungsversprechen, Zweckbestimmung, Rollenwechsel und Transparenz. Liefert konkrete Risikobegründung und ausformulierte Ersatzklauseln.OtherNo warnings★ 1.8K↓ —
send-experiment-designer
aaron-he-zhu/aaron-marketing-skills
TestingUpdated 10 hours ago
From the author
Use when the user asks to "design an email A/B test", "set up a multivariate subject/CTA test", "run a send-time test", "build a hold-out group", or "is this email result statistically and practically material?"; produces a falsifiable hypothesis, one-variable-per-cell matrix, sample-size/MDE/duration/power plan, and an effect/uncertainty read from own ESP data. Applies only a precommitted owner-approved action rule; the helper never chooses a business action. Not for EQS/vetoes or writing the email. 邮件AB测试设计/多变量测试/发送时间测试/留出组/显著性判定
Install
npx skills add aaron-he-zhu/aaron-marketing-skills --skill send-experiment-designer -a claude-code
Installs to .claude/skills/send-experiment-designer/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 90
Security100
Provenance82
Maintenance100
Licence100
Adoption55
Files (1)
- SKILL.md