Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,492 skills from 2,391 repositories · updated 10 hours ago
49,492 skills
- security-reviewcodeaholicguy/ai-devkitAI DevKit · Review code, skills, and prompts for security vulnerabilities — OWASP Top 10, prompt injection, business logic flaws, and insecure defaults. Use when reviewing PRs, auditing modules, reviewing AI skills/prompts, or preparing for release.SecurityNo warnings★ 1.7K↓ —
- hunt-lfielementalsouls/Claude-BugHunterHunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.WritingNo warnings★ 5.4K↓ —
- document-codecodeaholicguy/ai-devkitAI DevKit · Document a code entry point with structured analysis, dependency mapping, and saved knowledge docs. Use when users ask to document, understand, or map code for a module, file, folder, function, or API.EngineeringNo warnings★ 1.7K↓ —
- compile-latexpedrohcgs/claude-code-my-workflowCompile a Beamer LaTeX slide deck with XeLaTeX (3 passes + bibtex). Use when user says "compile", "build the slides", "rebuild the PDF", "run latex", "render the tex", or asks why a `.tex` file isn't producing a PDF. Operates on `Slides/*.tex`.DocumentsNo warnings★ 1.7K↓ —
- dev-worktreecodeaholicguy/ai-devkitAI DevKit · Worktree setup and resume guidance for isolated feature work. Use when starting, resuming, switching, or verifying a feature branch/worktree for lifecycle, debugging, implementation, review, or multi-agent workflows.EngineeringNo warnings★ 1.7K↓ —
- visual-auditpedrohcgs/claude-code-my-workflowAdversarial visual-layout audit of a Quarto `.qmd` or Beamer `.tex` deck. Flags overflow, font inconsistency, box fatigue, spacing, and alignment issues. Use when user says "visual audit", "check the layout", "does this overflow?", "look for visual issues", "audit the slides", or after reworking a deck's appearance. Does NOT check writing or pedagogy — pair with `/proofread` or `/pedagogy-review`.DocumentsNo warnings★ 1.7K↓ —
- huashu-topic-genalchaincyf/huashu-skills快速生成3-4个选题方向，含标题、大纲和优劣分析。当用户提到"选题"、"写什么"、"文章方向"、"题目建议"时使用。OtherNo warnings★ 2.2K↓ —
- ar-loopNewLeoYeAI/agent-master-skillsUse for /ar-loop, or to run an autoresearch experiment on a schedule (10 min to monthly) with CronCreate.OtherNo warnings★ 2.2K↓ —
- blog-brandAgriciDaniel/claude-blogEstablish durable brand and voice context for cross-skill consumption. Generates BRAND.md (audience, positioning, do/don't editorial rules, taboo phrases, competitor differentiation) and VOICE.md (existing persona JSON re-expressed as readable prose), both written to the project root. When present, the blog orchestrator loads these files, fenced as untrusted data, for write, rewrite, brief, outline, calendar, and strategy workflows. Pairs with blog-persona, which manages the structured persona JSON. Use when the user says "blog brand", "create brand context", "BRAND.md", "VOICE.md", "establish editorial brand". Not for learning a voice from existing posts (blog-style) or managing persona JSON (blog-persona).WritingNo warnings★ 2.6K↓ —
- storybrand-messagingwondelai/skillsClarify brand messaging using narrative structure that positions the customer as hero. Use when the user mentions "brand message", "website copy", "elevator pitch", "one-liner", "brand script", "StoryBrand framework", "customer as hero", or "my messaging isnt resonating". Also trigger when rewriting homepage copy, crafting email nurture sequences, or creating consistent messaging across sales and marketing collateral. Covers landing page copy, marketing collateral, and consistent communication. For memorable messaging, see made-to-stick. For product positioning, see obviously-awesome.DesignNo warnings★ 2.6K↓ —Also in 2 other repos
- zxLeoYeAI/agent-master-skillsComprehensive guide for writing shell scripts with Google zx — a tool for writing better scripts using JavaScript/TypeScript. Use when writing, debugging, or refactoring zx scripts (.mjs, .js, .ts files using zx), executing shell commands from JavaScript, working with ProcessPromise/ProcessOutput APIs, piping streams, configuring zx options, or using zx CLI. Do NOT use for general Node.js questions unrelated to shell scripting.WritingNo warnings★ 2.2K↓ —
- oracle-reviewpedrohcgs/claude-code-my-workflowA ready-to-fork Claude Code template for academics using LaTeX/Beamer + R. Multi-agent review, quality gates, adversarial QA, and replication protocols.EngineeringNo warnings★ 1.7K↓ —
- dsh-pre-push-checksNewqufei1993/skills-hub在交付或推送前验证改动时使用，核实项目必需检查、当前构建产物和真实用户行为，区分通过、失败、未运行与环境阻塞。OtherNo warnings★ 1.9K↓ —
- data-analysispedrohcgs/claude-code-my-workflowEnd-to-end R data analysis pipeline — exploration → cleaning → regression → publication-ready tables and figures. Use when user says "analyze this dataset", "run a regression on X", "explore this CSV", "full analysis workflow", "get me summary stats and a regression", or points at a `.csv`/`.rds`/`.dta` and asks for empirical results. Produces numbered R scripts in `scripts/R/` and outputs to `output/`.DataNo warnings★ 1.7K↓ —
- dsh-translate-docsNewqufei1993/skills-hub仅在用户明确调用时翻译或同步指定文档，保留技术含义、结构、命令和两边的独立修改。OtherNo warnings★ 1.9K↓ —
- cirqsickn33/agentic-awesome-skillsCirq is Google Quantum AI's open-source framework for designing, simulating, and running quantum circuits on quantum computers and simulators.OtherNo warnings★ 49.1K↓ —
- 37signals-waywondelai/skillsBuild lean, opinionated products using the 37signals philosophy from "Getting Real", "Rework", and "Shape Up". Use when the user mentions "Getting Real", "Rework", "Shape Up", "37signals", "Basecamp method", "six-week cycles", "fixed time variable scope", "appetite vs estimates", "betting table", "breadboarding", "fat marker sketch", "build less", "underdo the competition", "opinionated software", "we have too many meetings", "how do we ship faster", or "stop overbuilding". Also trigger when cutting scope to ship sooner, running a small team, or avoiding long-term roadmaps. Covers shaping, betting, building, and the art of saying no. For MVP validation, see lean-startup. For design sprints, see design-sprint.DesignNo warnings★ 2.6K↓ —Also in 2 other repos
- voice-profilepedrohcgs/claude-code-my-workflowExtract a written voice profile from your own prior papers, then use it to keep new drafts sounding like you. Reads a corpus one document at a time via subagents, produces a reusable profile on disk (lexicon, sentence rhythm, how you open and close, hedging habits, deliberate quirks), and audits a draft against it. Use when the user says "make this sound like me", "match my voice", "profile my writing", "why does this draft not sound like my papers", or before drafting prose that will carry their name. The positive counterpart to /humanize, which only detects AI tells.WritingNo warnings★ 1.7K↓ —
- ai-devkit-setupcodeaholicguy/ai-devkitAI DevKit · Check local AI DevKit readiness and run setup only when status shows onboarding or harness integration gaps.OtherNo warnings★ 1.7K↓ —
- milvusLeoYeAI/agent-master-skillsOperate Milvus vector database with pymilvus — collections, vector search, hybrid search, indexes, RBAC, partitions, and more via Python code.DataNo warnings★ 2.2K↓ —
- loresickn33/agentic-awesome-skillsMarkdown project memory for AI agents. Use for decisions, architecture, conventions, monorepo scopes, `.lore/`, or `lore` commands; not native `/init`/`/compact` or generic init/compress/audit/query.PlanningNo warnings★ 49.1K↓ —
- blog-translateAgriciDaniel/claude-blogTranslate existing blog posts into one or more target languages with SEO-optimized localization. Produces native-quality translations that preserve markdown structure, frontmatter, schema JSON-LD, image and chart embeds, and evidence-backed explanations. Localizes keywords, meta tags, numbers, dates, currencies, and quote styles per locale. Flags machine-translation artifacts for review. Run BEFORE blog-localize: this handles language conversion; localize handles cultural adaptation after translation completes. Use when user says "translate blog", "blog translate", "uebersetzen", "traduire", "traducir", "translate post", "blog auf Deutsch", "blog en espanol".WritingNo warnings★ 2.6K↓ —
- pentest-checklistzebbern/claude-code-guideThis skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.SecurityNo warnings★ 4.7K↓ —
- kaltstart-triageKlotzkette/claude-fuer-deutsches-rechtFür Kaltstart Triage: routet Rolle, Frist, Unterlagen und Fachschritt; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: BGB AT Prüfer.OtherNo warnings★ 1.8K↓ —
unpinned-dependency
cisco-ai-defense/skill-scanner
OtherUpdated Oct 26, 2026
From the author
Demonstrate a package dependency that is not locked to an exact version
Install
npx skills add cisco-ai-defense/skill-scanner --skill unpinned-dependency -a claude-code
Installs to .claude/skills/unpinned-dependency/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 89
Security100
Provenance81
Maintenance100
Licence100
Adoption55
Files (3)
- SKILL.md
- _expected.json
- requirements.txt