Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,418 skills from 2,407 repositories · updated 15 minutes ago
49,416 skills
- security-auditcloudflare/security-audit-skillSecurity guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.OfficialSecurityNo warnings★ 60.6K↓ —
- claudedzhng/skillsUse Claude Code as an independent `claude -p` subagent when the user explicitly asks for Claude, wants a second-agent opinion from Claude, or asks to delegate a well-scoped task to Claude. Supports selecting `--model` and thinking/effort level with defaults of the current `opus` alias and `high`.EngineeringNo warnings★ 1.4K↓ —
- localization-strategykostja94/marketing-skillsPlan, audit, implement, migrate, or validate localization for multilingual products and websites, including locale scope, market readiness, URL architecture, content coverage, hreflang coordination, rollout, and production verification. Use translation for the actual translation, glossary, and language review work.PlanningNo warnings★ 1.1K↓ —
- cfo-advisoralirezarezvani/claude-skillsStartup finance: runway and burn, unit economics (LTV, CAC, payback), fundraising and dilution. Load whenever the user asks how long the cash lasts, if burn is too high, or shares cash, ARR or CAC numbers.FinanceNo warnings★ 29.3K↓ —
- minutes-graphsilverstein/minutesPolicy-safe relationship rankings, commitments, aliases, person profiles, and topic research. Always use Minutes' bounded native CLI surfaces; never build or read a durable graph cache.ScienceNo warnings★ 1.6K↓ —Also in 1 other repo
- senior-architectalirezarezvani/claude-skillsSystem architecture decisions with a written rationale: monolith vs microservices, database choice, scaling limits, ADRs, Mermaid diagrams. Load whenever the user asks should we split, which database, will it scale, or wants an ADR.PlanningNo warnings★ 29.3K↓ —
- seo-auditkostja94/marketing-skillsWhen the user wants to run an SEO audit, technical SEO audit, or site health check. Also use when the user mentions "SEO audit," "technical audit," "site audit," "crawl audit," "indexing audit," "SEO health," or "fix SEO issues." For prioritization and organic strategy, use seo-strategy. For GSC data analysis, use google-search-console.MarketingNo warnings★ 1.1K↓ —
- refactoring-guruciembor/agent-rules-booksApply Refactoring.Guru-inspired rules when diagnosing code smells, choosing refactoring techniques, and stopping cleanup before uncontrolled redesign.EngineeringNo warnings★ 3.2K↓ —
- write-outreach-reply-readergooseworks-ai/goose-skillsStep of the write-outreach playbook: sorts outreach replies by type, matches each to its prospect row, sets that person's status and keeps useful exact words. Run write-outreach instead; not for direct use.WritingNo warnings★ 1.3K↓ —
- ap-feature-coordinatorSpielewoy/autoprompt-skillReport the compatibility redirect to `ap-run-coordinator`; this retired role cannot perform new work.OtherNo warnings★ 1.2K↓ —
- appllama-app-design-skillAppllama/appllama-skillsBuild native-feeling, benchmark-quality mobile app screens (Expo / React Native). Use when designing or implementing any mobile UI — screens, flows, onboarding, paywalls, tab bars, sheets, settings, empty states — or when polishing motion, navigation, typography, dark mode, or perceived performance. Enforces Apple HIG fidelity, semantic colors, native controls, anti-slop discipline, navigation semantics (push vs replace, modal vs sheet vs overlay, the one-way doors where back must not exist), purposeful Reanimated motion, a full-motion simulator-verified iteration loop, and a study-real-apps-first workflow (pairs with the Appllama MCP). Trigger on "build a screen", "make this screen better", "design the onboarding", "wire up this flow", "polish the UI", "make it feel native", or any mobile design/implementation task.DesignNo warnings★ 4.9K↓ —
- jetson-promote-imageNVIDIA/skillsUse to promote overlay files and built artifacts into the staged BSP image. Do NOT use to flash or build. Triggers: promote bsp image.MediaNo warnings★ 3.9K↓ —
- jlcpcbhashgraph-online/awesome-codex-pluginsJLCPCB PCB fabrication and assembly — BOM/CPL generation, basic vs extended parts, assembly constraints, design rules, ordering workflow. Use with KiCad for JLCPCB manufacturing. Use this skill when the user mentions JLCPCB, wants to order PCBs or assembled boards, needs prototype bare PCBs and stencils, wants to know JLCPCB design rules and capabilities, or is asking about PCB manufacturing costs or turnaround times. For gerber/CPL export, stencil ordering, and BOM management, see the `bom` skill.DesignNo warnings★ 1.5K↓ —
- mcp-case-overridesalibaba/skill-upPer-case mocked MCP override smoke skill used by skill-up e2e tests.TestingNo warnings★ 1.4K↓ —
- the-pragmatic-programmerciembor/agent-rules-booksApply Hunt and Thomas-inspired pragmatic programming rules when improving engineering judgment, feedback loops, DRY knowledge, orthogonality, automation, or adaptability.OtherNo warnings★ 3.2K↓ —
- ap-framework-validatorSpielewoy/autoprompt-skillReport the compatibility redirect to `ap-independent-checker`; this retired role cannot perform new work.OtherNo warnings★ 1.2K↓ —
- tprmSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor. Also trigger for 'a customer sent us a questionnaire' and 'how do I assess this vendor' style requests.SecurityNo warnings★ 1K↓ —
- make-content-content-briefgooseworks-ai/goose-skillsWrites a one-page content brief before any draft: audience, intent, the one arguable point, what top results already say and what this piece adds, an outline, a proof inventory with gaps marked, voice, CTA and banned words, checked against six gates. Use alone when you already have the topic, format, audience and destination and want only the brief; otherwise run make-content.WritingNo warnings★ 1.3K↓ —
- researchdaveebbelaar/bamaOnline research for a macOS app before building it, run as parallel researcher subagents, saved to docs/research/. Use when the user asks what to build, which features matter, how the best apps in a category work, how a macOS API or integration works, or wants a feature comparison.ScienceNo warnings★ 1.6K↓ —
- qa-testingrampstackco/claude-skillsRun QA testing on a page, feature, or full site at one of three depth tiers (smoke, standard, full). Use this skill whenever the user asks to QA a page or site, run a smoke test after a deploy, verify a page before launch, or run a regression sweep. Triggers on QA, QA sweep, smoke test, regression test, post-deploy check, pre-launch check, verify the deploy, test this page, does the page render, broken link, 404, image not loading. Also triggers proactively after a deploy or a new page launch where verification matters. Covers accessibility, performance, and SEO at the surface-signal level only: deep audits belong to `accessibility-audit`, `performance-optimization`, and `seo-technical`, and code-level debugging to `code-review-web`.TestingNo warnings★ 1K↓ —
- feedback-page-generatorkostja94/marketing-skillsDeprecated compatibility entry for Feedback Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Feedback Page.OtherNo warnings★ 1.1K↓ —
- jetson-customize-fanNVIDIA/skillsUse when you need to add, remove, edit, list, or change the boot default of an nvfancontrol fan profile on a Jetson/Tegra (Orin, Thor) target. Triggers: edit fan profile, tune fan curve.WritingNo warnings★ 3.9K↓ —
- web-design-guidelinesvercel-labs/agent-skillsReview UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".OfficialDesignNo warnings★ 33.6K↓ —Also in 2 other repos
- render-cartoon-music-videogooseworks-ai/goose-skillsAssemble a cartoon / animated / hand-crafted music-video ad from a config — a sung song carries the whole narrative while N per-bar i2v clips (one recurring animated character, one look pack) are each cut to their BAR window from librosa beat-tracking and hard-concatenated on the bar, VEED-whisper white bold-sans captions in the BOTTOM third (Alignment 2, above the logo bug, no pill) burned from the song's word timings re-spelled against the locked lyrics, a persistent brand logo bug held over the body (suppressed on the end card), and closed on a solid-brand-color PIL end card with the song still playing under it — never AI-rendered text. This is the FREE deterministic assembly stage (cut-to-bar + hard concat + logo bug + captions + end card + song mux); the song, character, keyframes, and clips come from create-music-elevenlabs / create-image-fal / create-video-fal. Use for the cartoon-music-video format.MediaNo warnings★ 1.3K↓ —
nis2
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
SecurityUpdated Oct 10, 2026
From the author
EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art. 21 risk management measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 governance obligations, supply chain security (Art. 21(2)(d); coordinated risk assessments Art. 22), gap assessments, policy drafting, ISO 27001 alignment, and penalty exposure analysis. Also covers Commission Implementing Regulation (EU) 2024/2690, the technical/methodological sub-requirements for Art. 21(2) and the significant-incident thresholds binding on DNS/cloud/data-centre/MSP/MSSP/trust-service and other digital entities. Use for NIS2 readiness, transposition questions, ENISA technical implementation guidance, significant-incident thresholds, supervisory differences between essential and important entities, and cross-border coordination.
Install
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill nis2 -a claude-code
Installs to .claude/skills/nis2/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 88
Security100
Provenance76
Maintenance100
Licence100
Adoption49
Files (4)
- SKILL.md
- references/article-21-measures.md
- references/implementing-reg-2024-2690.md
- references/iso27001-nis2-mapping.md