Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
48,622 skills from 2,355 repositories · updated 16 hours ago
47,548 skills
- viteLeoYeAI/agent-master-skillsVite build tool configuration, plugin API, SSR, and Vite 8 Rolldown migration. Use when working with Vite projects, vite.config.ts, Vite plugins, or building libraries/SSR apps with Vite.EngineeringNo warnings★ 2.2K↓ —Also in 2 other repos
- assuredworkloads-frameworks-navigatorgoogle/skillsActs as a Data Boundary Compliance Analyst that maps user compliance queries against Data Boundary Frameworks and cloud controls, validates matched resources, and recommends appropriate Frameworks or cloud controls. Use when mapping direct natural language workload requirements to Assured Workloads / Data Boundary Frameworks and cloud controls, browsing built-in Data Boundary frameworks, or identifying major requirement gaps. Don't use for non-Data-Boundary Compliance Manager posture assessments or direct Terraform deployment execution without framework selection.OfficialDevOpsNo warnings★ 21.8K↓ —
- blog-decayAgriciDaniel/claude-blogCompare two Google Search Console page exports (current vs previous period) to flag pages whose clicks or impressions fell by a chosen threshold, with a triage hint (refresh, query shift, consolidate, prune). The 20% default is a screening heuristic, not proof of decay. Use for "/blog decay", "content decay", "QoQ decline", "refresh declining posts". Needs two GSC exports; not for diagnosing a single traffic drop live (blog-google) or rewriting posts (blog-rewrite).WritingNo warnings★ 2.6K↓ —
- vitestLeoYeAI/agent-master-skillsVitest fast unit testing framework powered by Vite with Jest-compatible API. Use when writing tests, mocking, configuring coverage, or working with test filtering and fixtures.TestingNo warnings★ 2.2K↓ —Also in 1 other repo
- <slug>gooseworks-ai/goose-skills<What it does and when to use it, in one or two sentences. This is what an agent matches on. At most 1,024 characters.>OtherNo warnings★ 1.3K↓ —
- add-iron-proxynanocoai/nanoclawInstall or refresh Iron Proxy and its official Iron Control web console for NanoClaw. Use when selecting the Iron gateway, adding its management UI, configuring credentials and grants, or restoring the proxy, approval bridge, and agent guidance.DesignNo warnings★ 31.1K↓ —
- minutes-setupsilverstein/minutesGuided first-time setup for Minutes — download whisper model, create directories, configure audio input. Use when the user says "set up minutes", "install minutes", "first time setup", "configure minutes", "get started with minutes", "how do I start using minutes", or when verify shows missing components.MediaNo warnings★ 1.6K↓ —Also in 1 other repo
- add-clidashnanocoai/nanoclawAdd clidash — a zero-dependency, read-only web dashboard that derives its tabs and tables at runtime from any CLI that lists resources as JSON. Ships pre-wired for NanoClaw's ncl CLI (agent groups, sessions, channels, users, roles), plus message-activity charts, a log tail, and a read-only file viewer for group skills/CLAUDE.md/profiles.EngineeringNo warnings★ 31.1K↓ —
- research-marketgooseworks-ai/goose-skillsMarket research and brand watch: which market the brand is in, how big the reachable part is, what's changing, how buyers buy and what they pay, what people are saying now, and what it means for positioning. Use when the marketer asks for market research, "how big is my market", "what's changing in my category", "what do others charge", "what are people saying about us", "is there demand for <idea>", or "watch my brand / tell me if something blows up" (alerts only, risk first). Also writes positioning choices and finished messages ("position my product", "write our positioning"). Researches first, asks only decisions at the end, and saves the output to the brand. Not for who the buyers are and their own words — use research-audience; not for a deep look at rivals — use research-competitors.ScienceNo warnings★ 1.3K↓ —
- oma-frontendfirst-fluke/oh-my-agentImplement or modify web UI in React, Next.js, or Angular. Use for components, pages, styles, forms, and frontend state or data flows.DesignNo warnings★ 1.4K↓ —Also in 1 other repo
- add-opencodenanocoai/nanoclawUse OpenCode as an agent provider. OpenRouter, OpenAI, Google, DeepSeek, etc. via OpenCode config — not the Anthropic Agent SDK. Per group via `ncl groups config update --provider opencode`; host passes OPENCODE_* and XDG mount when spawning containers.OtherNo warnings★ 31.1K↓ —
- openmeld-cliamplifthq/openmeldUse OpenMeld through its public CLI to work in Spaces, reply to a Wake, consult the Center Agent, connect this computer, manage Agent Profiles, or diagnose delivery.EngineeringNo warnings★ 1.4K↓ —Also in 1 other repo
- where-to-start-situation-savegooseworks-ai/goose-skillsStep of the where-to-start playbook: saves the founder's answers and the agreed first move with the brand, so later visits and other playbooks don't ask again. Run where-to-start instead; not for direct use.OtherNo warnings★ 1.3K↓ —
- write-reportgooseworks-ai/goose-skillsTurns findings you already have into a report a marketer can read in 30 seconds. It has a short summary with key findings and how sure each one is, the first move, decisions needed, at most six next moves, what was not checked, and dated sources. It checks length and wording before handing over, then saves the report to the brand. Use alone when you already have the findings and their sources; otherwise run the playbook for the job (e.g. research-market, research-competitors, plan-campaign).WritingNo warnings★ 1.3K↓ —
- add-oneclinanocoai/nanoclawInstall or refresh OneCLI as NanoClaw's gateway provider. Use when setup selects OneCLI, an existing OneCLI-backed install is migrated to the gateway seam, or its runtime, approval bridge, setup, and agent guidance must be restored from the in-tree package.OtherNo warnings★ 31.1K↓ —
- mono-coloryanliudesign/mono-color-skillGenerate original one-ink or controlled two-ink editorial images from any theme, sentence, article idea, object, or reference photo. Always use this skill when the user asks for 单色海报、双色印刷、单色调视觉、蓝色/绿色孔版印刷、risograph、网点照片、复古或当代编辑排版、zine poster, monochrome editorial poster, duotone print, or asks to use the mono-color style. It uses an adaptive white, gray, or pale-beige substrate, no more than two printing inks, active negative space, terse human language, and strong serif/grotesk/mono typography without making retro styling the default or copying a source composition, wording, logo, or artwork. Produce both the final generation prompt and the generated raster image unless the user explicitly asks for prompt only.DesignNo warnings★ 3.6K↓ —
- watchgooseworks-ai/goose-skillsObserve actual video and sound over the whole file or named ranges, with timestamped evidence and honest coverage. Use complementary playback, listening and targeted frames; return observations without edits or verdicts.MediaNo warnings★ 1.3K↓ —
- add-codexnanocoai/nanoclawUse Codex (OpenAI's codex app-server) as a full agent provider — planning, tool orchestration, MCP tools, server-side history, session resume — alongside or instead of Claude. ChatGPT subscription or OpenAI API key, vault-only via the selected gateway. Per-group via `ncl groups config update --provider codex`. Distinct from using OpenAI as an MCP tool (where Claude remains the planner).PlanningNo warnings★ 31.1K↓ —
- ctf-forensicsljagiello/ctf-skillsProvides digital forensics and signal analysis techniques for CTF challenges. Use when analyzing disk images, memory dumps, event logs, network captures, cryptocurrency transactions, steganography, PDF analysis, Windows registry, Volatility, PCAP, Docker images, coredumps, side-channel power traces, DTMF audio spectrograms, packet timing analysis, CD audio disc images, or recovering deleted files and credentials.SecurityNo warnings★ 3.6K↓ —
- asc-id-resolverrorkai/app-store-connect-cli-skillsResolve App Store Connect IDs (apps, builds, app and digital-goods versions, groups, testers) from human-friendly names using asc. Use when commands require IDs.OtherNo warnings★ 1.1K↓ —
- cloudbase-wechat-integrationTencentCloudBase/CloudBase-AI-ToolkitCloudBase WeChat integration guide for Mini Program WeChat Pay, Mini Program virtual payment (虚拟支付, wx.requestVirtualPayment), Official Account JSAPI Pay, Native QR-code Pay, Official Account OAuth, openid handling, payment callbacks, and CloudBase Integration Center generated functions. This skill should be used when users ask to add, debug, or extend WeChat payment, virtual payment, or official-account flows on CloudBase.EngineeringNo warnings★ 1.2K↓ —Also in 5 other repos
- build-and-verifydaveebbelaar/bamaBuild a SwiftUI macOS app from the command line, install it, and check light and dark window snapshots of every page before calling a change done. Use after any UI code change, when a build fails, or when the user asks to run, screenshot, or check the app.DesignNo warnings★ 1.2K↓ —
- email-lifecyclegooseworks-ai/goose-skillsLifecycle email, SMS and push: audits the list and deliverability, then writes the flows this kind of business needs first, loadable as-is in your own tool, plus segments, cadence and this week's broadcasts. Never sends anything. Use when: set up my welcome and abandoned-cart emails; trial onboarding or waitlist launch emails; win back lapsed customers; plan this week's emails and texts; push notifications for my app; why are my emails going to spam; plan our Black Friday email and SMS sends; a send went wrong. Not for cold outreach to prospects — use write-outreach; not the editorial newsletter issue — use make-content; not the whole cross-channel Black Friday plan — use plan-campaign.ProductivityNo warnings★ 1.3K↓ —
- render-hypermotiongooseworks-ai/goose-skillsAssemble the FREE steps of the product-hypermotion + kinetic-typography video format — dice ONE Seedance 2.0 hypermotion clip into 5-6 segments and intercut them with PIL kinetic-typography spec/CTA cards (italic skew, 1.08x outline echo, 3D extrusion, slam-with-shake, inversion flash) plus a real-logo PIL end card (base64-decoded from the brand SVG), center-crop 1:1 to 9:16, and explicit-map mux a music bed. Deterministic, FREE (PIL + FFmpeg), no paid calls, the real logo and spec typography stay pixel-crisp. The paid steps (the ONE Seedance i2v, the music) are separate capabilities; the recipe orchestrates them. Use for the product-hypermotion format.MediaNo warnings★ 1.3K↓ —
security-architecture-review
cbrock84/headcount
SecurityUpdated Oct 18, 2026
From the author
Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.
Install
npx skills add cbrock84/headcount --skill security-architecture-review -a claude-code
Installs to .claude/skills/security-architecture-review/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 89
Security100
Provenance80
Maintenance100
Licence100
Adoption53
Files (2)
- SKILL.md
- references/sources.md