Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,492 skills from 2,391 repositories · updated 13 hours ago
49,492 skills
- cloud-armor-crs-rule-upgradergoogle/skillsUpgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to native evaluatePreconfiguredWaf dictionary parameters, remaps signature IDs to v042200, drops retired signature IDs, and updates structured preconfiguredWafConfig fine-tuning exclusions. Evaluates operational risk (High Breaking Change, Medium Attention Required, Low Clean Upgrade) including Method Enforcement breaking changes (PUT/PATCH/DELETE blocking) and sensitivity coverage expansions. Supports both in-place rule upgrades and smooth preview mode deployments with priority spacing and a 200-rule quota guardrail. Use when a user or agent needs to audit, upgrade, or transition Cloud Armor WAF rules to CRS 4.22. Don't use for non-WAF Cloud Armor rules (IP rate-limiting, geo-blocking, reCAPTCHA) or AWS/Azure WAF migrations.OfficialSecurityNo warnings★ 21.9K↓ —
- statistical-powerK-Dense-AI/scientific-agent-skillsCalculates sample sizes and statistical power for study planning. Applies when someone asks "how many subjects/samples/replicates do I need", wants an a priori power analysis, a minimum detectable effect (MDE), a power curve, or needs to justify a sample size for a grant, IRB protocol, or pre-registration. Covers closed-form power for t-tests, ANOVA, proportions, correlations, chi-square, and regression, plus simulation-based (Monte Carlo) power for complex designs — logistic/Poisson regression, mixed models, cluster-randomized trials, survival, and interactions. Also handles requests that only mention an effect size, alpha, or "80% power" without saying "power analysis" explicitly. For laying out the study (randomization, blocking, factorial/DOE, crossover, sequential designs) use experimental-design; for analyzing data already collected and reporting it use statistical-analysis.TestingNo warnings★ 56.1K↓ —
- diarysickn33/agentic-awesome-skillsUnified Diary System: A context-preserving automated logger for multi-project development.ProductivityNo warnings★ 49.1K↓ —
- ghbubbuild/bubGitHub CLI skill for interacting with GitHub via the gh command line tool. Use when Bub needs to (1) Create, view, or manage GitHub repositories, (2) Work with issues and pull requests, (3) Create and manage releases, (4) Run and monitor GitHub Actions workflows, (5) Create and manage gists, (6) Install and manage agent skills, or (7) Perform any GitHub operations via command line.DevOpsNo warnings★ 1.7K↓ —
- dev-retrocodeaholicguy/ai-devkitAI DevKit · Run an evidence-based retrospective on finished work (feature, session, incident) and turn friction into durable fixes, automation first. Use when users ask for a retro, lessons learned, post-mortem, or "what went wrong", or when another skill offers one after a feature or fix.OtherNo warnings★ 1.7K↓ —
- secops-detection-engineeringgoogle/skillsAuthor, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).OfficialSecurityNo warnings★ 21.9K↓ —
- cellprofilerK-Dense-AI/scientific-agent-skillsRuns reproducible CellProfiler microscopy pipelines for nuclear segmentation, cell counts, and per-object fluorescence measurements. Supports image/channel manifests, headless batch execution, segmentation overlays, and measurement QC for 2D fluorescence assays.MediaNo warnings★ 56.1K↓ —
- xurlLeoYeAI/agent-master-skillsA Twitter research and content intelligence skill focused on attracting WordPress and Shopify clients. Use to analyze Twitter profiles, threads, and conversations for: (1) Identifying what small agency founders and eCommerce brands are discussing; (2) Understanding pain points around WordPress performance, Shopify CRO, and development bottlenecks; (3) Extracting high-performing content angles; (4) Turning insights into authority-building posts; (5) Converting Twitter intelligence into business leverage for clear content angles, strong positioning, and qualified inbound leads.ScienceNo warnings★ 2.2K↓ —
- shopLeoYeAI/agent-master-skillsClaw goes shopping. Give your claw a creditcard. Financial management for Agents and OpenClaw bots.FinanceNo warnings★ 2.2K↓ —
- hundred-million-offerswondelai/skillsCreate irresistible offers using the Value Equation, bonus stacking, risk-reversing guarantees, and ethical scarcity. Use when the user mentions "grand slam offer", "make my offer more compelling", "what bonuses should I add", "guarantee strategy", "offer naming", or "people say its too expensive". Also trigger when packaging a product for higher perceived value, justifying premium pricing instead of discounting, designing a money-back guarantee, or structuring tiers to maximize conversions. Covers the MAGIC naming formula and starving-crowd targeting. For product positioning, see obviously-awesome. For outbound sales, see predictable-revenue.OtherNo warnings★ 2.6K↓ —Also in 2 other repos
- seedance-epic-fantasy-scifiLearnPrompt/awesome-seedanceMonsters, dragons, world reveals. Each entity gets its own definition block, the shots are cut by timecode, and scale is bought with reference objects and low angles rather than words like massive. Use when the user wants a Seedance 2.5 / 2.0 video prompt for this kind of clip (Epic fantasy and sci-fi spectacle; 中文触发词: 奇幻科幻大场面, 奇幻, 科幻, 巨龙, 怪兽, 史诗), or asks how published cases of this type were prompted. Read references/cases.md before drafting.MediaNo warnings★ 2.4K↓ —
- typeuibergside/typeuiUse TypeUI with Grok to access project design skills, brand kits, UI prompts, and layout variations through the TypeUI MCP server when creating or refining user interfaces.DesignNo warnings★ 2.2K↓ —
- conversion-optimizationwondelai/skillsGuided journey from a leaking conversion flow - landing page, signup, checkout, or in-app onboarding - to a measured, tested funnel. Orchestrates six skills phase by phase - lean-analytics, cro-methodology, storybrand-messaging, hundred-million-offers, influence-psychology, design-everyday-things - each phase carries its full method inline so it runs standalone, asking the user questions at every decision point and recording results in the project docs/ folder (FUNNEL.md, METRICS.md, EXPERIMENTS.md, CONVERSION-OPTIMIZATION-PLAN.md) so the journey resumes across sessions. Use when the user wants to raise conversion on a specific flow, fix checkout or signup abandonment, diagnose onboarding drop-off, or says 'people start but never finish'. With no site yet, use create-website; for a whole-site look, message, and speed audit, improve-website; if the flow converts but needs traffic, grow-website; for in-product engagement and retention, improve-app. For one framework in isolation, invoke that skill directly.MarketingNo warnings★ 2.6K↓ —Also in 2 other repos
- pufferlibK-Dense-AI/scientific-agent-skillsVersion-aware guidance for PufferLib reinforcement-learning environments, vectorization, policies, PuffeRL training, evaluation, and safe checkpoint review. Covers the native 5.0 build and environment API, published 3.0.0 Gymnasium/PettingZoo adaptation, and a pinned historical 4.0 profile.EngineeringNo warnings★ 56.1K↓ —Also in 1 other repo
- fable-judgeSahir619/fable-methodAdversarial verification of finished work. Treats any "done" as a set of claims, then re-runs the claimed verifications, diffs what actually changed, detects weakened tests and false completion claims, and delivers an evidence-based verdict (VERIFIED / VERIFIED WITH CAVEATS / REFUTED). Use after any agent or model claims work is complete - "/fable-judge", "judge this work", "verify what it did", "did that actually work?". Also runs the fable-method trap suite against a skill or model via "/fable-judge suite TARGET".TestingNo warnings★ 2.3K↓ —
- technical-documentationwondelai/skillsAudit, write, and improve developer documentation using Google's Developer Documentation Style Guide and Technical Writing courses. Use this skill for any documentation work, even when the user names no style guide: "audit our docs", "review this README", "write a README", "getting started guide", "how-to or tutorial", "API reference", "docstrings", "CLI help text", "changelog or release notes", "migration guide", or "our docs are confusing". Also use it when writing docs from code, rewriting a doc for clarity, fixing headings, procedures, or code samples, or enforcing consistent voice and terminology across a docs set — prefer it over editing documentation unaided. Covers reader and doc-type fit, second person and active voice, procedures, headings, lists and tables, code samples and placeholders, link text, notices, the word list, timeless docs, and accessibility. For code comments and naming, see clean-code. For marketing or landing-page copy, see storybrand-messaging.MarketingNo warnings★ 2.6K↓ —Also in 2 other repos
- design-code-architecturewondelai/skillsGuided journey from an app idea to a deliberate architecture: boundaries, domain model, data decisions, and resilience, making only the expensive-to-reverse decisions and deferring the rest. Orchestrates eight skills phase by phase - clean-architecture, domain-driven-design, system-design, ddia-systems, software-design-philosophy, release-it, pragmatic-programmer, 37signals-way - asking the user questions at every decision point and recording results in the project docs/ folder (ARCHITECTURE.md, DESIGN-CODE-ARCHITECTURE-PLAN.md) so the journey resumes across sessions. Use when the user wants to design a new app's architecture, choose boundaries and a domain model, decide monolith versus microservices, or says 'how should I structure this app'. If a codebase already exists, use remove-technical-debt (aged), improve-code-quality (fresh prototype), or architecture-optimization (slow but working); if unvalidated, run create-business or create-app first. For one framework in isolation, invoke that skill directly.DesignNo warnings★ 2.6K↓ —Also in 2 other repos
- kibibotLeoYeAI/agent-master-skillsCreate tokens on-chain, check fee earnings, check Kibi Credit balance, trigger agent credit reload, and interact with KibiBot's Agent API and Kibi LLM Gateway. Use when asked to create a token via KibiBot, check fee earnings across chains and platforms, check KibiBot Kibi Credit balance, check daily token creation quota, reload credits from trading wallet, or make LLM calls through KibiBot's gateway.FinanceNo warnings★ 2.2K↓ —
- scenario-video-adsscenario-labs/skillsUse when producing a video ad with Scenario from a product shot or brand assets: a mobile 9:16 or landscape 16:9 commercial, a TikTok, Reels, Shorts, YouTube, or CTV spot, or campaign creative needing a creative brief, storyboard, cinematic camera work, brand-faithful product footage, music and voiceover, captions, ad variants, budget planning, or platform delivery specs. Keywords: video ad, commercial, product video, advert, hook, CTA, end card, campaign, ad creative.MediaNo warnings★ 2.2K↓ —
- marketing-campaign-plannercbrock84/headcountDesigns a coordinated multi-channel campaign or product launch around one story — objective, message, channel sequencing, timeline, assets, and the checklist that gets it out the door. Use this to plan a launch or campaign, sequence a go-to-market push, pressure-test a campaign before committing budget, or turn a product change into a coordinated set of activity. For ongoing channel programs rather than a bounded push, use `marketing-planning`.MarketingNo warnings★ 2.6K↓ —
- cloud-infrastructurecbrock84/headcountDesigns and runs cloud infrastructure — environments, infrastructure as code, networking and isolation, scaling, and cost. Use this to design a cloud environment, control infrastructure spend, set up environment separation, plan for scale or region failure, or review infrastructure someone configured by hand.DevOpsNo warnings★ 2.6K↓ —
- what-if-oracleK-Dense-AI/scientific-agent-skillsSupports structured what-if scenario analysis for research planning, experimental contingencies, and scientific project decisions. Explores favorable, reference, adverse, wild-card, contrarian, and second-order scenarios with explicit assumptions, evidence, and decision triggers. Use to stress-test a research plan under uncertainty; scenario narratives do not estimate causal effects or calibrated forecast probabilities.TestingNo warnings★ 56.1K↓ —
- livequellen-hgbKlotzkette/claude-fuer-deutsches-rechtFür Livequellen HGB: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- pycalphadK-Dense-AI/scientific-agent-skillsComputes finite-temperature CALPHAD equilibria, phase fractions, and phase compositions from thermodynamic TDB databases using pycalphad. Use for alloy phase stability, equilibrium temperature sweeps, tie lines, lever-rule checks, or reproducible phase-fraction calculations with explicit components and mole-fraction conditions.OtherNo warnings★ 56.1K↓ —Also in 1 other repo
security-architecture-review
cbrock84/headcount
SecurityUpdated Oct 18, 2026
From the author
Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.
Install
npx skills add cbrock84/headcount --skill security-architecture-review -a claude-code
Installs to .claude/skills/security-architecture-review/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 89
Security100
Provenance80
Maintenance100
Licence100
Adoption53
Files (2)
- SKILL.md
- references/sources.md