Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,409 skills from 2,375 repositories · updated 15 hours ago
49,407 skills
- social-post-craftcbrock84/headcountWrites, structures, and evaluates social posts end to end — hooks, body, formatting for how each platform renders, and a quality check before publishing. Use this to draft a post, rewrite one that underperformed, turn a longer piece into social content, sharpen an opening, or judge whether a draft is worth publishing.MediaNo warnings★ 2.6K↓ —
- newsletter-writercbrock84/headcountWrites and edits newsletters and marketing emails people actually open — subject lines, opening, structure, voice, and the conversion turn where there is one. Use this to draft or rewrite a newsletter or email, sharpen weak email copy, plan a newsletter's structure and cadence, write a sequence, or repurpose an issue into other formats. For automated lifecycle and SMS programs, use `lifecycle-messaging`.MarketingNo warnings★ 2.6K↓ —
- scenario-ugcscenario-labs/skillsUse when producing UGC-style creator video with Scenario: a talking-head ad or testimonial from a portrait and a script, a founder clip, a product demo or unboxing, a reaction or before-after cut, a faceless voiceover over b-roll, or vertical social video for TikTok, Reels, or Shorts that must feel filmed on a phone rather than produced. Keywords: UGC, creator ad, talking head, testimonial, avatar, lipsync, founder video, social proof, faceless voiceover, organic, vertical video.MediaNo warnings★ 1.9K↓ —
- internal-controls-and-auditcbrock84/headcountDesigns and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Use this to design controls for a process, prepare for an external audit, respond to an audit finding, set approval thresholds, or assess where a small team's segregation of duties is genuinely broken.TestingNo warnings★ 2.6K↓ —
- technical-debt-managementcbrock84/headcountMakes technical debt visible and decidable — distinguishing real debt from mess, quantifying its cost, and arguing for remediation in business terms. Use this to assess and prioritize debt, decide whether to fix or live with something, justify remediation work to non-engineers, or plan a migration off a system nobody wants to touch.PlanningNo warnings★ 2.6K↓ —
- contagiouswondelai/skillsEngineer word-of-mouth and virality using the STEPPS framework (Social Currency, Triggers, Emotion, Public, Practical Value, Stories). Use when the user mentions "go viral", "word of mouth", "shareable content", "social currency", "why people share", "referral program", "nobody is sharing it", or "make this spread". Also trigger when designing shareable features, crafting social campaigns, or building products that spread through peer recommendation. Covers environmental triggers and high-arousal emotional content. For sticky messaging, see made-to-stick. For persuasion tactics, see influence-psychology.OtherNo warnings★ 2.6K↓ —Also in 2 other repos
- dsh-pre-push-checksNewqufei1993/skills-hub在交付或推送前验证改动时使用，核实项目必需检查、当前构建产物和真实用户行为，区分通过、失败、未运行与环境阻塞。OtherNo warnings★ 1.9K↓ —
- lifecycle-messagingcbrock84/headcountDesigns automated email and SMS programs — welcome and onboarding sequences, nurture, re-engagement, transactional messaging, and the timing and segmentation behind them. Use this to build or fix an email sequence, plan lifecycle automation, improve open or click performance, set up SMS flows, or decide what messages a customer should receive and when.PlanningNo warnings★ 2.6K↓ —
- security-architecture-reviewcbrock84/headcountReviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.SecurityNo warnings★ 2.6K↓ —
- virtualization-operationscbrock84/headcountRuns the hypervisor layer beneath the servers — host capacity and consolidation ratios, VM sprawl, snapshot discipline, resilience and live migration, and licensing that counts cores rather than instances. Use this to size or expand a cluster, work out why VMs are slow when the hosts look idle, clean up sprawl, set snapshot and template policy, or decide what stays virtualized and what moves to cloud.OtherNo warnings★ 2.6K↓ —
- portaljs-define-schemadatopian/portaljsDefine a dataset's metadata profile — infer a Frictionless Table Schema from its data, add Data Package metadata (license, sources, keywords), and write it into datasets.json so the showcase renders a typed field table. Extend or customize via the L0-L3 profile ladder. Use when a registered dataset needs field types, constraints, or catalog metadata before publishing.MediaNo warnings★ 2.4K↓ —
- output-waehlenKlotzkette/claude-fuer-deutsches-rechtFür Output wählen: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: Jurastudium.OtherNo warnings★ 1.8K↓ —
- foundry-agentic-loopgithub/awesome-copilotBuild agentic solutions on Microsoft Foundry, GitHub and Azure: hosted agents, toolbox tools and skills, Foundry IQ grounding and a React/FastAPI app. Three modes: rapid prototyping in an existing Foundry project; spec-driven development (SDD), where the foundry-agentic-loop-workflow runs Specify, Implement, Verify and Deploy to create the Foundry project and deploy with azd, or one phase runs alone; and Improve, which refines this skill and the workflow from past runs. Use for Agentic Loop requests and canvas actions, or end-to-end agent solutions from architecture to Azure deployment. Not for isolated Azure administration or unrelated UI edits.DevOpsNo warnings★ 40.8K↓ —
- dsh-translate-docsNewqufei1993/skills-hub仅在用户明确调用时翻译或同步指定文档，保留技术含义、结构、命令和两边的独立修改。OtherNo warnings★ 1.9K↓ —
- marketing-campaign-plannercbrock84/headcountDesigns a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the checklist that gets it out the door. Use this to plan a launch or campaign, sequence a go-to-market push, pressure-test a campaign before committing budget, or turn a product change into a coordinated set of activity. For ongoing channel programs rather than a bounded push, use `marketing-planning`.MarketingNo warnings★ 2.6K↓ —
- dokumente-intakeKlotzkette/claude-fuer-deutsches-rechtFür Dokumentenintake: ordnet Akte, Belege und Lücken; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: Energierecht.OtherNo warnings★ 1.8K↓ —
- design-postgis-tablestimescale/pg-aiguideComprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applicationsDesignNo warnings★ 1.9K↓ —
- tastegatesickn33/agentic-awesome-skillsBuild or fix a frontend so it looks designed, not AI-generated, then prove it in a real browser: renders at phone and desktop width and fails on overlap, low contrast and AI-slop defaults.DesignNo warnings★ 49.1K↓ —
- slackLeoYeAI/agent-master-skillsUse when you need to control Slack from Clawdbot via the slack tool, including reacting to messages or pinning/unpinning items in Slack channels or DMs.OtherNo warnings★ 2.2K↓ —
- cypress-flake-fixergithub/awesome-copilotFind and fix flake-prone anti-patterns in an existing Cypress suite, and APIs removed in Cypress 12 to 16. Bundles a zero-dependency scanner for fixed cy.wait() delays, assigned command return values, async/await, force: true, chaining after actions, one-shot expect() inside .then(), conditional testing, and removed APIs such as Cypress.env(), cy.exec(), cy.server()/cy.route(). Use when asked to fix flaky Cypress tests, remove cy.wait, stabilize or harden a Cypress suite, audit Cypress specs, debug "detached from the DOM" errors, or prepare an upgrade to Cypress 15 or 16.TestingNo warnings★ 40.8K↓ —
- market-research-reportsK-Dense-AI/scientific-agent-skillsBuilds evidence-traceable market research reports and assumption-driven market sizing or forecast scenarios. Use for market definition, industry and customer evidence, competitive landscapes, TAM/SAM/SOM reconciliation, forecast sensitivity, and auditable report scaffolds.ScienceNo warnings★ 56K↓ —
- copilot-usage-metricsgithub/awesome-copilotRetrieve and display GitHub Copilot usage metrics for organizations and enterprises using the GitHub CLI and REST API.EngineeringNo warnings★ 40.8K↓ —
- slideopssickn33/agentic-awesome-skillsTurn a repository into a cited HTML slide deck and detect the day it drifts from the code. Citations record file, lines, and hash; a stdlib check reports CURRENT, MOVED, or CHANGED.DocumentsNo warnings★ 49.1K↓ —
- anndataK-Dense-AI/scientific-agent-skillsHandles annotated matrices in single-cell analysis, .h5ad and Zarr files, and integration with the scverse ecosystem. This is the data format skill—for analysis workflows use scanpy; for probabilistic models use scvi-tools; for population-scale queries use cellxgene-census.OtherNo warnings★ 56K↓ —Also in 2 other repos
hunt-lfi
elementalsouls/Claude-BugHunter
WritingUpdated yesterday
From the author
Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-lfi -a claude-code
Installs to .claude/skills/hunt-lfi/ · Each command fetches the skill straight from GitHub with the open skills CLI.
No download: this skill’s licence (MIT) does not let us redistribute its files. The install commands fetch them from GitHub instead.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
- Reads credential files such as ~/.ssh or ~/.awsLow
Why 89
Security95
Provenance85
Maintenance100
Licence100
Adoption59
Files (1)
- SKILL.md