Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 14 hours ago
47,548 skills
- change-and-adoptioncbrock84/headcountGets people to actually use what was delivered — stakeholder analysis, communication, training, resistance, and measuring adoption. Use this to plan a rollout, recover an implementation nobody is using, handle resistance to a change, sequence communications, or work out why a technically successful project changed nothing.PlanningNo warnings★ 2.6K↓ —
- permission-checkpedrohcgs/claude-code-my-workflowDiagnose why Claude Code is (or isn't) prompting for permission. By default reads only repo-local layers (CLI project, CLI project-local, VSCode workspace). Host-global layers (CLI user `~/.claude/`, VSCode user settings) are read ONLY when the user explicitly confirms — those files may contain unrelated paths or secrets. Use when user says "why is it asking me to approve?", "permission check", "why am I getting prompts?", "bypass isn't working", "check my permissions". Read-only diagnostic.EngineeringNo warnings★ 1.7K↓ —
- ceo-advisorcbrock84/headcountPressure-tests a decision, plan, or idea before it is committed to — surfacing the assumption it rests on, the case against it, and what would have to be true for it to work. Use this when weighing options, when a plan needs challenging before commitment, when you have already decided and want a genuine gut check, when processing meeting notes into decisions, or when competing initiatives need ranking. Distinct from `chief-executive`, which owns direction; this one interrogates a specific decision.TestingNo warnings★ 2.6K↓ —
- project-deliverycbrock84/headcountPlans and delivers a single project — scope, estimation, scheduling, critical path, tracking, and recovering when it slips. Use this to plan a project, build or challenge a schedule, estimate credibly, track progress meaningfully, or recover a project that is late.PlanningNo warnings★ 2.6K↓ —
- activationcbrock84/headcountGets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account. Use this to design or fix signup and onboarding, diagnose why signups do not convert to active use, reduce time-to-value, or decide what a new user must accomplish first.DesignNo warnings★ 2.6K↓ —
- secops-detection-engineeringgoogle/skillsAuthor, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).OfficialSecurityNo warnings★ 21.8K↓ —
- assessment-designcbrock84/headcountBuilds questions and assessments that measure what they claim — matching item type to the thing being assessed, writing distractors that diagnose, and telling a question that measures learning from one that measures reading speed or test-taking. Use this to write or review assessment items, design a unit check or diagnostic, work out why scores do not match classroom performance, or decide how much evidence a claim about mastery actually needs.DesignNo warnings★ 2.6K↓ —
- cloud-armor-crs-rule-upgraderNewgoogle/skillsUpgrades Google Cloud Armor security policies from OWASP CRS 3.0 and 3.3 to OWASP CRS 4.22. Preserves signature opt-in and opt-out lists, translates evaluatePreconfiguredExpr to native evaluatePreconfiguredWaf dictionary parameters, remaps signature IDs to v042200, drops retired signature IDs, and updates structured preconfiguredWafConfig fine-tuning exclusions. Evaluates operational risk (High Breaking Change, Medium Attention Required, Low Clean Upgrade) including Method Enforcement breaking changes (PUT/PATCH/DELETE blocking) and sensitivity coverage expansions. Supports both in-place rule upgrades and smooth preview mode deployments with priority spacing and a 200-rule quota guardrail. Use when a user or agent needs to audit, upgrade, or transition Cloud Armor WAF rules to CRS 4.22. Don't use for non-WAF Cloud Armor rules (IP rate-limiting, geo-blocking, reCAPTCHA) or AWS/Azure WAF migrations.OfficialSecurityNo warnings★ 21.8K↓ —
- strategic-alliancescbrock84/headcountStructures partnerships that change what the business can do — technology integrations, channel and reseller arrangements, joint ventures, and OEM relationships. Use this to evaluate or structure a strategic partnership, decide between partnering and building, negotiate commercial terms of an alliance, or diagnose a partnership that is signed but not producing. For audience-borrowing partnerships, use `marketing:partnership-marketing`.MarketingNo warnings★ 2.6K↓ —
- paymentLeoYeAI/agent-master-skillsShopping Claw | Give your agent spending power. Financial management for Agents and OpenClaw bots.FinanceNo warnings★ 2.2K↓ —
- dsgvo-auskunftKlotzkette/claude-fuer-deutsches-rechtFür DSGVO-Auskunftsrecht (Art. 15 DSGVO): ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- bonusKlotzkette/claude-fuer-deutsches-rechtFür Bonus und leistungsbezogene Vergütung im Handelsvertretervertrag: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- zeitnarrativeKlotzkette/claude-fuer-deutsches-rechtFür Zeitnarrative und Timesheet: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt.OtherNo warnings★ 1.8K↓ —
- flight-booking-aitourmind-com/Tourmind-Booking-SkillsUse when a user wants to resolve airports, search live flight offers, verify a selected airfare, create a flight booking, query a flight order, or safely create or query a third-party payment through TourMind.OtherNo warnings★ 2.4K↓ —
- eyeballgithub/awesome-copilotDocument analysis with inline source screenshots. When you ask Copilot to analyze a document, Eyeball generates a Word doc where every factual claim includes a highlighted screenshot from the source material so you can verify it with your own eyes.OtherNo warnings★ 40.7K↓ —
- blog-factcheckAgriciDaniel/claude-blogVerify statistics and claims in blog posts by fetching cited source URLs and checking if the claimed data actually appears on the page. Extracts all load-bearing claims (statistics, product or policy claims, ranking and comparative claims, named sources), validates cited URLs before fetching, and scores match confidence (exact match 1.0, paraphrase 0.7-0.9, not found 0.0). Flags uncited claims as UNVERIFIED. Use when user says "fact check", "verify statistics", "check sources", "validate claims", "factcheck", "source verification".WritingNo warnings★ 2.6K↓ —
- kaltstart-triageKlotzkette/claude-fuer-deutsches-rechtFür Kaltstart Triage: routet Rolle, Frist, Unterlagen und Fachschritt; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: Datenbankrecht und Datenbankherstellerrecht.OtherNo warnings★ 1.8K↓ —
- blog-repurposeAgriciDaniel/claude-blogRepurpose blog posts for social media, email, video, podcast, and community channels. Generates Twitter/X threads, LinkedIn posts and articles, Threads, Bluesky, TikTok, Instagram, YouTube Shorts and long-form scripts, Reddit, newsletter, podcast, Discord, and Slack variants. Adapts tone for each platform. Use when user says "repurpose", "blog repurpose", "share blog", "social media", "twitter thread", "linkedin post", "youtube script", "reddit post".WritingNo warnings★ 2.6K↓ —
- blog-translateAgriciDaniel/claude-blogTranslate existing blog posts into one or more target languages with SEO-optimized localization. Produces native-quality translations that preserve markdown structure, frontmatter, schema JSON-LD, image and chart embeds, and citation capsules. Localizes keywords, meta tags, numbers, dates, currencies, and quote styles per locale. Flags machine-translation artifacts for review. Run BEFORE blog-localize: this handles language conversion; localize handles cultural adaptation after translation completes. Use when user says "translate blog", "blog translate", "uebersetzen", "traduire", "traducir", "translate post", "blog auf Deutsch", "blog en espanol".WritingNo warnings★ 2.6K↓ —
- blog-strategyAgriciDaniel/claude-blogBlog strategy development including topic cluster architecture with hub-and-spoke design, audience mapping, competitive landscape analysis, AI citation surface strategy across ChatGPT/Perplexity/AI Overviews, distribution channel planning (YouTube, Reddit, review platforms for AI-citation SEO), content scoring targets, measurement framework, and content differentiation through original research and first-hand experience. Use when user says "blog strategy", "content strategy", "blog positioning", "what should I blog about", "blog topics", "content pillars", "blog ideation".WritingNo warnings★ 2.6K↓ —
- blog-personaAgriciDaniel/claude-blogCreate and manage writing personas with NNGroup 4-dimension tone framework (Funny-Serious, Formal-Casual, Respectful-Irreverent, Enthusiastic-Matter-of-fact). Personas define readability targets, sentence length distribution, vocabulary tier, contraction frequency, and summary box label. Used by blog-write and blog-rewrite to enforce consistent voice. Use when user says "persona", "voice", "tone", "writing style", "brand voice", "create persona", "use persona".WritingNo warnings★ 2.6K↓ —
- blog-outlineAgriciDaniel/claude-blogSERP-informed outline generation with H2/H3 heading hierarchy, competitive content gap analysis, section-by-section word count targets, chart and image placement markers, optional FAQ question planning, and internal linking zones. Skeleton only: structure, H2/H3 hierarchy, word counts, optional FAQ slots. Use blog-brief instead if you need full competitive analysis, statistics research, and image suggestions. Lighter than a full content brief, generates article skeleton and structure only, ready for /blog write to consume. Use when user says "outline", "blog outline", "content outline", "structure blog", "plan sections", "article skeleton", "heading structure", "SERP analysis", "competitive outline", "plan article".WritingNo warnings★ 2.6K↓ —
- blog-calendarAgriciDaniel/claude-blogGenerate editorial calendars for blogs with topic clusters, publishing schedules, content decay detection, freshness update plans, seasonal opportunities, content mix formula, template integration, and distribution scheduling. Plans monthly or quarterly calendars optimized for SEO topic authority and freshness signals based on content priority. Use when user says "editorial calendar", "content calendar", "blog calendar", "publishing schedule", "blog plan", "content plan", "what should I write".WritingNo warnings★ 2.6K↓ —
- loresickn33/agentic-awesome-skillsMarkdown project memory for AI agents. Use for decisions, architecture, conventions, monorepo scopes, `.lore/`, or `lore` commands; not native `/init`/`/compact` or generic init/compress/audit/query.PlanningNo warnings★ 49K↓ —
smtp-penetration-testing
zebbern/claude-code-guide
TestingUpdated yesterday
From the author
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
Install
npx skills add zebbern/claude-code-guide --skill smtp-penetration-testing -a claude-code
Installs to .claude/skills/smtp-penetration-testing/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
- Uses sudoLow
Why 89
Security95
Provenance84
Maintenance100
Licence100
Adoption58
Files (1)
- SKILL.md