Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,098 skills from 2,358 repositories · updated 20 minutes ago
48,051 skills
- triagehashgraph-online/awesome-codex-pluginsDiagnose stalled, blocked, overloaded, or unhealthy Agiflow projects and recommend specific corrective actions. Use for project health checks, blocked work, conflicting priorities, obsolete tasks, overloaded assignees, or an unmanageable backlog.PlanningNo warnings★ 1.5K↓ —
- inbox-triagenano-muse/nanoMuseGo through recent mail and sort it into needs-a-reply, waiting-on-others, to-do and can-ignore, with draft replies ready for review. Use when the user asks to triage, sort, catch up on or clear their inbox; never to send anything on its own.EngineeringNo warnings★ 3K↓ —
- senior-securityalirezarezvani/claude-skillsUse for STRIDE threat modeling, DREAD scoring or a quick secret scan, or to route a security request to the right specialist. Models threats with threat_modeler.py and scans with secret_scanner.py.SecurityNo warnings★ 29.2K↓ —
- where-to-start-situation-savegooseworks-ai/goose-skillsStep of the where-to-start playbook: saves the founder's answers and the agreed first move with the brand, so later visits and other playbooks don't ask again. Run where-to-start instead; not for direct use.OtherNo warnings★ 1.3K↓ —
- add-oneclinanocoai/nanoclawInstall or refresh OneCLI as NanoClaw's gateway provider. Use when setup selects OneCLI, an existing OneCLI-backed install is migrated to the gateway seam, or its runtime, approval bridge, setup, and agent guidance must be restored from the in-tree package.OtherNo warnings★ 31.1K↓ —
- planhashgraph-online/awesome-codex-pluginsUse after design approval for milestone plans with executable acceptance.PlanningNo warnings★ 1.5K↓ —
- add-sharepointmicrosoft/power-platform-skillsUse when the user wants to read or write SharePoint lists, manage documents in a SharePoint document library, or create a new SharePoint list from a Power Apps mobile app.WritingNo warnings★ 1.1K↓ —
- add-codexnanocoai/nanoclawUse Codex (OpenAI's codex app-server) as a full agent provider — planning, tool orchestration, MCP tools, server-side history, session resume — alongside or instead of Claude. ChatGPT subscription or OpenAI API key, vault-only via the selected gateway. Per-group via `ncl groups config update --provider codex`. Distinct from using OpenAI as an MCP tool (where Claude remains the planner).PlanningNo warnings★ 31.1K↓ —
- research-marketgooseworks-ai/goose-skillsMarket research and brand watch: which market the brand is in, how big the reachable part is, what's changing, how buyers buy and what they pay, what people are saying now, and what it means for positioning. Use when the marketer asks for market research, "how big is my market", "what's changing in my category", "what do others charge", "what are people saying about us", "is there demand for <idea>", or "watch my brand / tell me if something blows up" (alerts only, risk first). Also writes positioning choices and finished messages ("position my product", "write our positioning"). Researches first, asks only decisions at the end, and saves the output to the brand. Not for who the buyers are and their own words — use research-audience; not for a deep look at rivals — use research-competitors.ScienceNo warnings★ 1.3K↓ —
- doca-comchNVIDIA/skillsUse this skill when the user is doing hands-on DOCA Comch work on a host + BlueField pair — bringing up host ↔ DPU PCIe control-plane messaging, picking server (DPU) vs client (host) roles, choosing slow-path send-task / recv-callback vs fast-path producer / consumer, querying max-msg-size or max-clients capabilities, registering connection callbacks, or debugging DOCA_ERROR_* returns from the Comch API. Trigger even when the user does not explicitly mention "DOCA Comch" or "Comm Channel" (renamed in DOCA 2.5) — typical implicit phrasings include "send a control message from host to BlueField over PCIe", "DPU can't see the host representor", "DOCA_ERROR_NOT_PERMITTED on server_create", "DOCA_ERROR_AGAIN on task_send submit", "connect callback never fires", or "stream bulk data from a host driver to a DPU agent". Refuse and route elsewhere for installing DOCA itself, BFB / firmware bring-up, non-Comch DOCA libraries, or deploying Comch apps at scale — those belong to other skills.DevOpsNo warnings★ 3.8K↓ —
- varg-music-videoNewhashgraph-online/awesome-codex-pluginsDirects an AI music video or a song-driven promo end to end on varg, the way the most-watched AI music videos are made: measure the song (beat grid, word timings), pitch the concept, cast and lock character references, storyboard every cut on a downbeat, approve stills before paying for video, generate Seedance 2.5 shots, run a mandatory lip-sync pass, draw lyrics and graphics in code, run review rounds and master for each platform. Use when someone asks for a music video, a clip for my song, a video for a track, a lyric video with AI footage, a singing character, an AI artist or band video, slopcore, or a launch video cut to a song. Not for a one-off generated song or single clip (use varg-ai), shot planning and 3D camera blocking only (use varg-previz), a talking character without music (use varg-character-keynote or varg-podcast-video), or a typography-only lyric video with no generated footage (use a HyperFrames music-to-video skill).MediaNo warnings★ 1.5K↓ —
- red-green-proofalirezarezvani/claude-skillsTurns a suspected bug into a proven one. Verify the cause against reality before claiming it, write a test that FAILS on the current code, apply the fix, watch it pass — then revert the fix and confirm the test goes red again, because a test that passes both ways proves nothing. Invoked bare after a debugging conversation, it takes the target from context rather than asking. Use when fixing a bug, investigating an incident, hardening a flaky area, or when asked to "add tests that reveal the bug". Triggers on "/red-green-proof", "prove the bug", "red-green", "make the test fail first", "is that test load-bearing", "reveal the bug with a test".TestingNo warnings★ 29.2K↓ —
- rpihashgraph-online/awesome-codex-pluginsDrive one accepted change through implementation and checks to done, with one fresh review only where a mistake is costly. Use when: asked to run or orchestrate work through RPI.EngineeringNo warnings★ 1.5K↓ —Also in 2 other repos
- add-atomic-chat-toolnanocoai/nanoclawAdd Atomic Chat MCP server so the container agent can call local models served by the Atomic Chat desktop app via its OpenAI-compatible API.EngineeringNo warnings★ 31.1K↓ —
- arenaNewhashgraph-online/awesome-codex-pluginsSeveral subagents build the same artifact from one brief in isolation, a read-only judge scores them, and you pick a base and graft in the best parts of the rest. Use for "arena this", "competing attempts", "second opinion on this approach".OtherNo warnings★ 1.5K↓ —
- varg-tryon-videoNewhashgraph-online/awesome-codex-pluginsTurns a flat-lay or product photo of clothing into a try-on video on varg: clean the garment photo, dress a model photo in it with Bria Virtual Try-On (or a Nano Banana / GPT Image edit for harder garments), keep the same model across shots, then animate fit-check motions that sell clothes (slow turn, tug and let fall, walk to camera, mirror selfie, fabric close-up) on Kling 4 or Seedance 2.5 with the garment kept intact, and add size captions so the fit is honest. Use when a fashion or apparel seller (Shopify, TikTok Shop, Amazon, dropshipping) asks for a try-on video, "my clothes on a model", an AI model wearing their product, a fit-check or outfit video, a try-on haul, or virtual try-on from flat-lays. Not for accessories that need no body (use product-photo-to-video) or for consistent characters across a story (varg-character-design).MediaNo warnings★ 1.5K↓ —
- jetson-build-sourceNVIDIA/skillsUse when you need to rebuild the BSP overlay — DT, OOT modules, or kernel — from changes under bsp_sources/. Triggers: build bsp, rebuild dtb, rebuild kernel.OtherNo warnings★ 3.8K↓ —
- seo-geohashgraph-online/awesome-codex-pluginsOptimize content for AI Overviews (formerly SGE), ChatGPT web search, Perplexity, and other AI-powered search experiences. Generative Engine Optimization (GEO) analysis including brand mention signals, AI crawler accessibility, llms.txt compliance, passage-level citability scoring, and platform-specific optimization. Use when user says "AI Overviews", "SGE", "GEO", "AI search", "LLM optimization", "Perplexity", "AI citations", "ChatGPT search", or "AI visibility".MarketingNo warnings★ 1.5K↓ —
- add-vercelnanocoai/nanoclawAdd Vercel deployment capability to NanoClaw agents. Installs the Vercel CLI in agent containers and sets up OneCLI credential injection for api.vercel.com. Use when the user wants agents to deploy web applications to Vercel.DevOpsNo warnings★ 31.1K↓ —
- email-lifecyclegooseworks-ai/goose-skillsLifecycle email, SMS and push: audits the list and deliverability, then writes the flows this kind of business needs first, loadable as-is in your own tool, plus segments, cadence and this week's broadcasts. Never sends anything. Use when: set up my welcome and abandoned-cart emails; trial onboarding or waitlist launch emails; win back lapsed customers; plan this week's emails and texts; push notifications for my app; why are my emails going to spam; plan our Black Friday email and SMS sends; a send went wrong. Not for cold outreach to prospects — use write-outreach; not the editorial newsletter issue — use make-content; not the whole cross-channel Black Friday plan — use plan-campaign.ProductivityNo warnings★ 1.3K↓ —
- email-lifecycle-lifecycle-auditgooseworks-ai/goose-skillsStep of the email-lifecycle playbook: audits list, consent, live flows, recent sends and sending setup, marking every item verified, from-you or unknown. Run email-lifecycle instead; not for direct use.ProductivityNo warnings★ 1.3K↓ —
- baoyu-post-to-xUpdatedJimLiu/baoyu-skillsPosts content and articles to X (Twitter). Supports regular posts with images/videos and X Articles (long-form Markdown). In Codex, honor explicit requests for the Codex Chrome plugin/@chrome by using the Chrome Extension workflow; otherwise use Chrome Computer Use when available and fall back to real Chrome CDP scripts only when allowed. Use when user asks to "post to X", "tweet", "publish to Twitter", or "share on X".BrowserNo warnings★ 27.2K↓ —
- anti-entropy-governanceGanyuanRan/AegisUse when touching retiring old logic, collapsing duplicate owners, removing fallbacks, or schema/persistence/source-of-truth boundaries; identify opportunities automatically; destructive execution requires explicit confirmation.OtherNo warnings★ 1.4K↓ —
- design-buildhashgraph-online/awesome-codex-pluginsExecute a design plan produced by /design -- implements each node against its embedded measurement spec and gates every task on the project's build or tests under a bounded retry budget. Runs with Figma disconnected; the plan carries every number it needs. --auto runs the whole loop without a prompt.DesignNo warnings★ 1.5K↓ —
dependency-auditor
alirezarezvani/claude-skills
SecurityUpdated 4 hours ago
From the author
Use before a release, during a CVE investigation, before a major version bump or for a license review. Scans dependencies with dep_scanner.py, checks licenses with license_checker.py and plans safe upgrades with upgrade_planner.py.
Install
npx skills add alirezarezvani/claude-skills --skill dependency-auditor -a claude-code
Installs to .claude/skills/dependency-auditor/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Runs bundled scriptsNo network use seenLicence: MIT
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 88
Security85
Provenance94
Maintenance100
Licence100
Adoption69
Files (16)
- README.md
- SKILL.md
- assets/sample_go.mod
- assets/sample_package.json
- assets/sample_requirements.txt
- expected_outputs/sample_license_report.txt
- expected_outputs/sample_upgrade_plan.txt
- expected_outputs/sample_vulnerability_report.json
- references/dependency_management_best_practices.md
- references/license_compatibility_matrix.md
- references/vulnerability_assessment_guide.md
- scripts/dep_scanner.py
- +4 more