Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,096 skills from 2,358 repositories · updated 1 minute ago
48,047 skills
- cmmcSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", "prime contractor flow-down requirements", the July 2026 CMMC Phase 2 suspension, or the CMMC Reform Task Force.SecurityNo warnings★ 1K↓ —
- tc-trackeralirezarezvani/claude-skillsUse when tracking technical changes as records, or handing work between AI sessions with a change record. Creates, updates and validates change records with tc_create.py, tc_update.py and tc_validator.py.OtherNo warnings★ 29.2K↓ —
- asc-workflowrorkai/app-store-connect-cli-skillsDefine, validate, run, resume, and audit repo-local multi-step automations with current `asc workflow` and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.ProductivityNo warnings★ 1.1K↓ —
- brief-from-pilemohitagw15856/pm-claude-skillsTurn a folder of accumulated documents into one decision-ready brief — the skim-map pass over the pile, the extraction against the brief's actual questions, the conflict reconciliation when documents disagree, and the provenance trail back to sources. Use when asked read all this and tell me what matters, synthesize this folder for the new lead, turn these 20 docs into a brief, or what does all this material actually say. Produces the pile map, the question-driven extraction, the reconciled brief with per-claim sources, and the didn't-read honesty ledger.OtherNo warnings★ 1.5K↓ —
- triggershashgraph-online/awesome-codex-pluginsCreate and manage triggers that watch for something (a job that finishes, a service that goes down, a failing CI run, a new release, a price crossing a threshold) and hand a task to Codex when it happens. Use when the user wants to be told, or wants something done, "when X happens", and when handling a message that starts with [self-starter].ProductivityNo warnings★ 1.5K↓ —
- inbox-triagenano-muse/nanoMuseGo through recent mail and sort it into needs-a-reply, waiting-on-others, to-do and can-ignore, with draft replies ready for review. Use when the user asks to triage, sort, catch up on or clear their inbox; never to send anything on its own.EngineeringNo warnings★ 3K↓ —
- performance-profileralirezarezvani/claude-skillsUse for a slow endpoint, memory leak, CPU spike, large bundle or performance budget in Node.js, Python or Go, before optimizing. Measures before and after with performance_profiler.py, flamegraphs and k6 load tests.TestingNo warnings★ 29.2K↓ —
- senior-securityalirezarezvani/claude-skillsUse for STRIDE threat modeling, DREAD scoring or a quick secret scan, or to route a security request to the right specialist. Models threats with threat_modeler.py and scans with secret_scanner.py.SecurityNo warnings★ 29.2K↓ —
- slack-agent-flownanocoai/nanoclawLet an existing Slack agent create new agents that arrive as their own Slack bots — provisioned app, operator DM, and a shared three-way room, hot-started without a host restart.OtherNo warnings★ 31.1K↓ —
- vertical-site-conventionsrampstackco/claude-skillsCompose pages and sites that read as their vertical: ecommerce-catalog storefronts that look like storefronts, hospitality-food sites that look like restaurants, b2b-manufacturer sites that look industrial. Use this skill whenever the user wants to build a site that looks like the vertical it serves, fix a build that reads as generic or off-vertical, build to an experience bar produced by competitor-experience-audit, or compose pages with the merchandising, density, and layout conventions a credible site in the category is expected to carry. Triggers on vertical conventions, storefront layout, ecommerce layout, retail conventions, merchandising layout, category page composition, site composition, build to the experience bar, make it look like the vertical, off-vertical, looks generic, build conventions for a vertical, site grammar. Also triggers when a build that is technically clean reads wrong for its category, and the cause is composition, not visual taste.OtherNo warnings★ 1K↓ —
- cn-level-mappermohitagw15856/pm-claude-skillsCompare job levels (职级) across Chinese technology companies and against international ladders, to judge an offer, a job move or a promotion target: what a level usually means in scope and expectations, how levels roughly line up, and what to ask the recruiter. Use when asked P7 相当于什么级别, 跳槽职级怎么对标, 字节 2-2 对应阿里什么, 这个 offer 的职级合理吗, compare Chinese tech levels, or how does Alibaba P-level map to Google levels. Produces a level comparison built from the person's own ladders and offer details, a scope-and-expectation profile for each level, the negotiation questions to ask, and a clear note on what is approximate.ProductivityNo warnings★ 1.5K↓ —
- add-sharepointmicrosoft/power-platform-skillsUse when the user wants to read or write SharePoint lists, manage documents in a SharePoint document library, or create a new SharePoint list from a Power Apps mobile app.WritingNo warnings★ 1.1K↓ —
- oss-contribution-researchrampstackco/claude-skillsResearch and prepare an outside contribution to an open-source repo, then stop at a queue item for a human to approve: policy check, intake, duplicate check, reproduction, patch, the repo's own checks, an independent critic rerun, and a disclosed, hashed draft of the exact text to post. Use this skill whenever the user wants to contribute to someone else's repo, fix an upstream bug, pick up a good-first-issue, draft an AI-assisted pull request for an outside project, follow up on their own outside PR, or run a gated contribution pipeline. Triggers on open source contribution, contribute to this repo, upstream fix, outside PR, external PR, good first issue, fix this issue in their repo, contribution research, AI-assisted PR, disclose AI in PR, reply to review on my PR. Also triggers when the user names an issue in a repo they do not maintain and asks for a fix, even if they do not say contribute.ScienceNo warnings★ 1K↓ —
- mariadb-operator-commentmariadb-operator/mariadb-operatorPost a comment (or a formal PR review) to a GitHub issue or pull request in mariadb-operator/mariadb-operator. Use whenever the user wants to publish something to GitHub for this repo — "comment on issue #123", "post this as a PR comment", "leave a note on #456", "reply on the PR" — and especially when they want the output of the mariadb-operator-pr-review skill delivered to GitHub instead of just shown in chat, e.g. "review PR #1234 and post it as a comment" or "post the review results to the PR". Always confirms the exact comment text with the user before publishing — never posts autonomously.EngineeringNo warnings★ 1K↓ —
- discovery-research-synthesisrampstackco/claude-skillsTurning research artifacts into actionable PM insight. Customer interviews, user research notes, support ticket reviews, sales call transcripts, survey data, in-app feedback, all synthesized into the decisions they are meant to inform. The discipline of moving from raw discovery data to clear product direction without losing signal in the synthesis or fabricating insight that was not actually there. Triggers on research synthesis, customer interview synthesis, user research analysis, discovery readout, research insights, sales call analysis, support ticket analysis, qualitative data analysis. Also triggers when a team has done research but cannot turn it into decisions, when synthesis is producing pretty decks but no roadmap movement, or when an upcoming PM decision needs to be grounded in research already conducted.ScienceNo warnings★ 1K↓ —
- package-healthmohitagw15856/pm-claude-skillsCheck a package's health before you depend on it — npm and PyPI registry APIs via keyless curl: downloads, release recency, maintenance signals, and the dependency-decision read. Use when asked is this npm package maintained, check this PyPI library before we adopt it, compare these two packages, or is this dependency abandoned. Produces the health read with the signals interpreted (not just listed), the numbers with their commands, and the adopt/avoid/vendor recommendation framing.OtherNo warnings★ 1.5K↓ —
- bug-triage-packmohitagw15856/pm-claude-skillsTriage a raw bug report into something a team can act on — clean repro steps, a defensible severity/priority, environment, likely area/owner, and duplicate check. Use when asked to triage this bug, set severity and priority, is this a P1, or clean up this bug report for the backlog. Produces the normalized repro, a severity and priority with the reasoning (impact × frequency × workaround), the environment/metadata, a suspected component and owner queue, and a duplicate/related-issue check — flagging when info is missing rather than guessing.OtherNo warnings★ 1.5K↓ —
- red-green-proofalirezarezvani/claude-skillsTurns a suspected bug into a proven one. Verify the cause against reality before claiming it, write a test that FAILS on the current code, apply the fix, watch it pass — then revert the fix and confirm the test goes red again, because a test that passes both ways proves nothing. Invoked bare after a debugging conversation, it takes the target from context rather than asking. Use when fixing a bug, investigating an incident, hardening a flaky area, or when asked to "add tests that reveal the bug". Triggers on "/red-green-proof", "prove the bug", "red-green", "make the test fail first", "is that test load-bearing", "reveal the bug with a test".TestingNo warnings★ 29.2K↓ —
- go-bag-buildermohitagw15856/pm-claude-skillsBuild an emergency go-bag tailored to your actual household and your most likely local hazards — not a generic list — covering the people, pets, medications, documents, and hazard-specific items you'd need to grab and leave in minutes. Use when someone says 'build an emergency kit', 'what goes in a go-bag', 'prepare for evacuation', or 'emergency preparedness for my family'. Produces a personalised packing list, a grab-in-2-minutes core, storage and maintenance guidance, and per-person/per-pet additions. Points to official preparedness sources for your region.PlanningNo warnings★ 1.5K↓ —
- product-configurator-designrampstackco/claude-skillsDesigning build-your-own product configurators (Tesla-style, custom-pricing, plan-builders) with constraint logic, real-time pricing, validation, and save-and-share mechanics. Honest about infinite-options (decision paralysis), canned-bundles-only (no real customization), and guided-configuration (smart defaults plus meaningful constraints plus escape hatches) patterns. Triggers on configurator design, build-your-own, custom configuration, plan builder, product customizer, configuration tool. Also triggers when users abandon mid-configuration, when configurator conversion is poor, or when a configurator is being scoped for the first time.DesignNo warnings★ 1K↓ —
- url-dumphuytieu/COG-second-brainQuick capture URLs with automatic content extraction, insights, and categorization into knowledge bookletsOtherNo warnings★ 1.3K↓ —
- csrdSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert CSRD (Corporate Sustainability Reporting Directive, EU 2022/2464) compliance advisor. Use this skill whenever a user asks about CSRD, European Sustainability Reporting Standards (ESRS), double materiality assessment, sustainability reporting obligations, ESG disclosure, CSRD scope and thresholds, value chain reporting, XBRL digital tagging, third-party assurance, CSRD gap assessments, CSRD implementation timelines, ESRS E1–E5 environmental standards, ESRS S1–S4 social standards, ESRS G1 governance, the 2026 Omnibus scope change (Directive (EU) 2026/470, 1,000+ employees) and revised/simplified ESRS (July 2026), CSRD vs GRI/TCFD/SASB alignment, or any EU corporate sustainability reporting question. Trigger even if the user only mentions "ESG reporting Europe", "sustainability disclosure EU", or "non-financial reporting".FinanceNo warnings★ 1K↓ —
- book-drafthashgraph-online/awesome-codex-pluginsPhase 3: Drafting. Voice lock on a sample chapter, then sequential full-context chapter drafting with draft-critique-revise, bible ledger updates, and periodic continuity checks.ProductivityNo warnings★ 1.5K↓ —
- eu-ai-act-specialistalirezarezvani/claude-skillsUse for EU AI Act (Regulation 2024/1689) compliance work: classifying an AI system's risk tier, planning the Art. 43 conformity route and Annex IV file, or listing obligations by role. Runs ai_system_risk_classifier.py, conformity_assessment_planner.py and ai_act_obligation_tracker.py, citing Articles.PlanningNo warnings★ 29.2K↓ —
soc2
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
SecurityUpdated Oct 10, 2026
From the author
Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.
Install
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill soc2 -a claude-code
Installs to .claude/skills/soc2/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 88
Security100
Provenance76
Maintenance100
Licence100
Adoption49
Files (5)
- SKILL.md
- references/controls.md
- references/evidence.md
- references/policies.md
- references/vendor.md