Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,418 skills from 2,407 repositories · updated 3 minutes ago
49,416 skills
- cloud-securityalirezarezvani/claude-skillsUse when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs cloud_posture_check.py and maps findings to MITRE ATT&CK.SecurityNo warnings★ 29.3K↓ —
- scrapecreators-apigooseworks-ai/goose-skillsProvider reference for collecting public profiles, posts, comments, transcripts, trends, and ad-library data from major social platforms through ScrapeCreators. Use as a dependency of research workflows, not as the final user-facing deliverable.BrowserNo warnings★ 1.3K↓ —
- cicd-playbookmohitagw15856/pm-claude-skillsWrite a CI/CD pipeline playbook for a service or team. Use when asked to document a CI/CD pipeline, write a deployment process, define release gates, document build and test stages, or create a deployment guide. Produces a structured playbook covering pipeline stages, environment definitions, deployment gates, rollback procedures, and on-call responsibilities.TestingNo warnings★ 1.5K↓ —
- pcbwayhashgraph-online/awesome-codex-pluginsPCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey assembly (PCBWay sources parts by MPN), has parts not available on LCSC, needs assembled boards with non-LCSC components, wants to compare PCBWay vs JLCPCB, or needs assembly with parts sourced globally rather than from LCSC only. For gerber/CPL export, stencil ordering, and BOM management, see the `bom` skill.DesignNo warnings★ 1.5K↓ —
- cloudbase-code-reviewTencentCloudBase/CloudBase-AI-ToolkitCode review and validation for CloudBase projects. After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill to check for known pitfalls — auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse. Supports automated lint scripts (regex-based) + LLM semantic review.EngineeringNo warnings★ 1.2K↓ —Also in 5 other repos
- enable-tables-offlinemicrosoft/power-platform-skillsInternal mobile-app workflow read and executed only by /setup-offline-profile to enable Dataverse table prerequisites for a Mobile Offline Profile.ProductivityNo warnings★ 1.1K↓ —
- research-marketgooseworks-ai/goose-skillsMarket research and brand watch: which market the brand is in, how big the reachable part is, what's changing, how buyers buy and what they pay, what people are saying now, and what it means for positioning. Use when the marketer asks for market research, "how big is my market", "what's changing in my category", "what do others charge", "what are people saying about us", "is there demand for <idea>", or "watch my brand / tell me if something blows up" (alerts only, risk first). Also writes positioning choices and finished messages ("position my product", "write our positioning"). Researches first, asks only decisions at the end, and saves the output to the brand. Not for who the buyers are and their own words — use research-audience; not for a deep look at rivals — use research-competitors.ScienceNo warnings★ 1.3K↓ —
- setupfcakyon/claude-codex-settingsThis skill should be used when user encounters "Azure MCP error", "Azure authentication failed", "az login required", "Azure CLI not found", or needs help configuring Azure MCP integration.DevOpsNo warnings★ 1.2K↓ —
- setupmicrosoft/power-platform-skillsUse when Process Intelligence needs building, explicit cloud/account/environment configuration, sign-in, connection diagnostics, or recovery from an authentication error.OtherNo warnings★ 1.1K↓ —
- jetson-optimize-memoryNVIDIA/skillsReclaim DRAM by disabling unused subsystems across MB1 BCT, MB2 BCT, kernel reserved-memory, and SWIOTLB. Use for headless or no-camera Jetson deployments; not for CPU/GPU frequency tuning.ProductivityNo warnings★ 3.9K↓ —
- planning-with-filesOthmanAdi/planning-with-filesPersistent file-based planning for multi-step AI-agent work. Keeps task_plan.md, findings.md, and progress.md on disk; lifecycle hooks inject selected project planning context. Automatic recovery reads project planning files only. Explicit session-catchup.py --metadata reads same-project local agent session records and emits aggregate counts only; --replay may emit bounded nonce-framed excerpts. Optional gated mode can request continuation only when the host supports it and never runs commands declared in Markdown. The skill has no network upload path. Use for research or work needing 5+ tool calls.PlanningNo warnings★ 27.9K↓ —Also in 1 other repo
- basinfcakyon/claude-codex-settingsBuild and troubleshoot Cloudflare Basin analytics workflows with Basin Pipelines, Basin Catalog, and Basin SQL. Use for streaming data into R2 Iceberg tables, managing catalogs, or querying those tables; also use for requests using the former Data Platform, Pipelines, R2 Data Catalog, or R2 SQL names.DevOpsNo warnings★ 1.2K↓ —
- kinNewhashgraph-online/awesome-codex-pluginsHow to use Kin's MCP tools (search, describe, read, execute, feedback) and read their answers. Use when the person asks to read or change something in a service they connected in Kin, such as GitHub, Notion or Linear.ProductivityNo warnings★ 1.5K↓ —
- cloudrun-developmentTencentCloudBase/CloudBase-AI-ToolkitCloudBase Run backend development rules (Function mode/Container mode). Use this skill when deploying backend services that require long connections, multi-language support, custom environments, AI agent development, or migrating existing/GitHub apps that need VPC access to MySQL/PostgreSQL/Redis. Also use when diagnosing CloudRun container deploy failures (deploy_failed, readiness/probe failed, image won't start, docker.io pull loops) or a deploy stuck behind a running deploy task. For stateless HTTP services, prefer HTTP cloud functions.DevOpsNo warnings★ 1.2K↓ —Also in 5 other repos
- refactorhashgraph-online/awesome-codex-pluginsRestructure or clean up code with no behavior change, proved by before-and-after checks. Use when: asked to clean up, extract, dedupe or simplify, even one function.EngineeringNo warnings★ 1.5K↓ —Also in 2 other repos
- marketing-data-accessgooseworks-ai/goose-skillsHow to get live public data (ads libraries, social posts and comments, search results, creator profiles), business identity/work-contact reads, domain SEO metrics and paid media generation through GooseWorks, with no vendor key. Load before any playbook step that reads public data or calls an outside model: which proxy call fits the job, what it costs, how to get the human's yes, and what to do when the data is not reachable. Not for brand facts (read the brand brain) or the customer's own ad accounts (the GooseWorks ads tools, or an ads connector they have).MarketingNo warnings★ 1.3K↓ —
- stock-analysisalirezarezvani/claude-skillsAnalyze, research or value a listed stock or company (US, global, NSE or BSE) with verified data, ratios, scores and valuation. Use whenever asked if a stock is a buy, what it is worth, or how a company looks.FinanceNo warnings★ 29.3K↓ —
- auth-nodejs-cloudbaseTencentCloudBase/CloudBase-AI-ToolkitCloudBase Node SDK auth guide for server-side identity, user lookup, and custom login tickets. This skill should be used when Node.js code must read caller identity, inspect end users, or bridge an existing user system into CloudBase; not when configuring providers or building client login UI.DesignNo warnings★ 1.2K↓ —Also in 5 other repos
- vidseedshashgraph-online/awesome-codex-pluginsRegistry fallback entry point for the VidSeeds.ai MCP connector. Use the bundled domain skills for setup, efficiency, thumbnails, projects, analytics, local video, and publishing workflows.DataNo warnings★ 1.5K↓ —
- train-sentence-transformershuggingface/skillsTrain or fine-tune sentence-transformers models across `SentenceTransformer` (bi-encoder, dense or static embedding model for retrieval, similarity, clustering, classification, paraphrase mining, dedup, multimodal), `CrossEncoder` (reranker, pair scoring for two-stage retrieval / pair classification), `SparseEncoder` (SPLADE, sparse embedding model for learned-sparse retrieval), and `MultiVectorEncoder` (ColBERT / late-interaction, per-token embeddings scored with MaxSim). Covers loss selection, hard-negative mining, evaluators, distillation, LoRA, Matryoshka, and Hugging Face Hub publishing. Use for any sentence-transformers training task.OfficialProductivityNo warnings★ 11.3K↓ —
- huggingface-paper-publisherhuggingface/skillsPublish and manage research papers on Hugging Face Hub. Supports creating paper pages, linking papers to models/datasets, claiming authorship, and generating professional markdown-based research articles.OfficialScienceNo warnings★ 11.3K↓ —
- email-lifecyclegooseworks-ai/goose-skillsLifecycle email, SMS and push: audits the list and deliverability, then writes the flows this kind of business needs first, loadable as-is in your own tool, plus segments, cadence and this week's broadcasts. Never sends anything. Use when: set up my welcome and abandoned-cart emails; trial onboarding or waitlist launch emails; win back lapsed customers; plan this week's emails and texts; push notifications for my app; why are my emails going to spam; plan our Black Friday email and SMS sends; a send went wrong. Not for cold outreach to prospects — use write-outreach; not the editorial newsletter issue — use make-content; not the whole cross-channel Black Friday plan — use plan-campaign.ProductivityNo warnings★ 1.3K↓ —
- toolshashgraph-online/awesome-codex-pluginsAdd studio-owned MCP tools, prompts, app-record resources or signed inbound integrations to a Homie studio, sell goods or priced services to customers' AIs, declare event functions, and connect an AI through browser approval.BrowserNo warnings★ 1.5K↓ —
- ibkrhashgraph-online/awesome-codex-pluginsKeep an eye on an Interactive Brokers (IBKR) account or prices and speak up when something changes - new executions, prices crossing a level, option assignments and exercises, deposits and withdrawals, big moves in net asset value. Use when the user wants Codex to watch their IBKR account or IBKR market data, and when handling a fire of an IBKR trigger.OtherNo warnings★ 1.5K↓ —
cloud-security
alirezarezvani/claude-skills
SecurityUpdated 14 hours ago
From the author
Use when checking AWS, Azure or GCP for security misconfigurations: IAM privilege escalation, public buckets, open security groups, IaC gaps. Runs cloud_posture_check.py and maps findings to MITRE ATT&CK.
Install
npx skills add alirezarezvani/claude-skills --skill cloud-security -a claude-code
Installs to .claude/skills/cloud-security/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Runs bundled scriptsNo network use seenLicence: MIT
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 88
Security85
Provenance94
Maintenance100
Licence100
Adoption69
Files (3)
- SKILL.md
- references/cspm-checks.md
- scripts/cloud_posture_check.py