Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,105 skills from 2,358 repositories · updated 28 minutes ago
48,055 skills
- agentlas-uploadagentlas-ai/Agentlas-OSUse when the user types /agentlas-upload, /agentlas upload, $hephaestus-upload, or /hep-upload to scan, gate, and publish an agent/team package to Agentlas Cloud (private) or Agentlas Hub (public).OtherNo warnings★ 1.6K↓ —
- sci-abstractbrycewang-stanford/Awesome-Journal-SkillsUse when writing the two front-matter artifacts Science (AAAS) demands — the one-sentence summary for the table of contents and the ≤125-word single-paragraph abstract — both readable by any scientist and both leading with the quantified advance rather than the method. Late-stage polish skill for the flagship AAAS weekly.ScienceNo warnings★ 1.4K↓ —
- bamadaveebbelaar/bamaBuild any Mac app. Start here to pick the next skill for a native macOS app.OtherNo warnings★ 1.4K↓ —
- oma-pdfNewfirst-fluke/oh-my-agentExtract PDF text, headings, tables, and images into Markdown using opendataloader-pdf. Use for PDF parsing, not PDF layout creation.DocumentsNo warnings★ 1.4K↓ —
- vis-camera-readybrycewang-stanford/Awesome-Journal-SkillsUse when preparing an accepted IEEE VIS paper for its IEEE TVCG camera-ready, covering de-anonymization, the VGTC/TVCG template and journal metadata (DOI, ORCID, IEEE keywords/index terms), integrating the second-round required changes without scope creep, permanentizing open-materials links, the Open Practices disclosure form, and the Graphics Replicability Stamp handoff.ScienceNo warnings★ 1.4K↓ —
- oma-securityfirst-fluke/oh-my-agentScan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.SecurityNo warnings★ 1.4K↓ —
- eval-reportagentscope-ai/OpenJudgeUse when the user has run multiple evaluation skills and wants a comprehensive analysis — maturity assessment, cross-skill signals, trends, prioritized actions, and an executive summary. Also use when the user mentions eval health check, evaluation audit, ship readiness, evaluation maturity, or "how good is my evaluation system itself." This is a read-only analysis skill.ProductivityNo warnings★ 1K↓ —
- oma-tf-infraUpdatedfirst-fluke/oh-my-agentCreate or review Terraform infrastructure and plans. Use for cloud resources, IAM, networking, state management, and infrastructure changes.DevOpsNo warnings★ 1.4K↓ —
- jetson-flash-imageNVIDIA/skillsUse to flash a promoted BSP image to a Jetson DUT in RCM mode via flash.sh or l4t_initrd_flash.sh. Do NOT use for BSP customization, image promotion, or carrier derivation.MediaNo warnings★ 3.8K↓ —
- oma-voiceUpdatedfirst-fluke/oh-my-agentGenerate or transcribe speech with Voicebox or VoiceStudio, or process existing audio locally. Use for narration, transcripts, timed speech, and loudness conversion; video editing uses oma-video.MediaNo warnings★ 1.4K↓ —
- documenthashgraph-online/awesome-codex-pluginsRecord a decision, document existing code, or file a supplied research material. Modes: document decision (ADR, RFC, or rule), document code (spec, doc, guide, or scenario for existing behavior), document research (only when a finished report or one external material is already in hand). Use for 'we decided', 'record this decision', 'document why we chose X', 'make it our standard', 'draft an RFC', 'should we switch to Y' proposals, 'resolve the RFC', 'we accepted the proposal', 'document the auth module', 'capture how the payment system works', reference material, how-to instructions, or a user flow with examples over an existing spec. Name the type inside the subject to skip the type question. Planning a feature or an intended user journey → /archcore:plan. Checking docs against code or docs health → /archcore:review.ScienceNo warnings★ 1.5K↓ —
- security-auditcloudflare/security-audit-skillSecurity guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.OfficialSecurityNo warnings★ 57K↓ —
- sfxmintNewhashgraph-online/awesome-codex-pluginsAdd free CC0 sound effects to a web app or game without an API key, using the SFXMint API (sound roles, sets grouped by event, search) and permanent hotlinkable MP3/WAV URLs. With an SFXMint API key it can also generate a sound the library lacks. Use when the user asks to add sounds, audio feedback or UI sounds to an app, wants click / notification / success / error / alert sounds, game sound effects (coin, jump, hit, explosion, power-up, game over), ambience (rain, forest, drone), sound on a code-driven video or animation (Remotion, motion graphics), or asks where to get free sound effects for an app, game, video, prototype or demo. Not for music, voice or speech.DesignNo warnings★ 1.5K↓ —
- oma-pmfirst-fluke/oh-my-agentTurn product requirements into scoped tasks with dependencies and acceptance criteria. Use for implementation planning and prioritization.PlanningNo warnings★ 1.4K↓ —
- generate-release-noteshuytieu/COG-second-brainGenerate categorized release notes from any source (GitHub, Linear, Jira, or manual input) with optional publishingProductivityNo warnings★ 1.3K↓ —
- stoc-workflowbrycewang-stanford/Awesome-Journal-SkillsUse when planning a STOC (ACM Symposium on Theory of Computing) project calendar — backward planning to the early-November deadline, the STOC/FOCS alternating two-deadline year that theory groups schedule around, full-version and camera-ready milestones, and the June TheoryFest endpoint.ProductivityNo warnings★ 1.4K↓ —
- email-lifecycle-flow-writergooseworks-ai/goose-skillsStep of the email-lifecycle playbook: writes one lifecycle flow as a build sheet for the brand's email tool, every message finished in the brand voice. Run email-lifecycle instead; not for direct use.WritingNo warnings★ 1.3K↓ —
- using-agent-relayAgentWorkforce/relayUse when you are a registered relay agent (a spawned worker, or a lead that called register_agent) coordinating with peers in real time over current Agent Relay MCP tools - messaging, channels, threads, reactions, search, inbox, actions, and worker spawn/release. For role selection and orchestrator startup instructions, use https://agentrelay.com/skill and the orchestrating-agent-relay skill.OtherNo warnings★ 1.1K↓ —
- dac-workflowbrycewang-stanford/Awesome-Journal-SkillsUse to plan a full ACM/IEEE Design Automation Conference (DAC) Research-Manuscript campaign backward from the mid-to-late-November manuscript deadline through the two-stage abstract-then-manuscript submission on Softconf, the winter review, the March notification, the April camera-ready and copyright for the ACM Digital Library, and the July conference in Long Beach — with the Engineering-Track and Late-Breaking-Results side calendars.ProductivityNo warnings★ 1.4K↓ —
- minutes-live-sidekicksilverstein/minutesAct as the user's live meeting sidekick inside the current terminal agent session. Use when the user explicitly asks you, the terminal agent, to watch a meeting, follow the live transcript, answer during the call, offer strategist thoughts, silently watch for risks, or track decisions. Do not use this skill to start or control the separate Minutes Coach HUD; explicit Coach or HUD lifecycle requests belong to minutes-copilot, and an ambiguous request such as "coach me live" requires one short surface clarification.OtherNo warnings★ 1.6K↓ —Also in 1 other repo
- orchestrating-agent-relayAgentWorkforce/relayThe canonical way to run agent-relay - self-bootstrap the local broker and autonomously spawn, monitor, and coordinate a team of worker agents without human intervention. Covers infrastructure startup, agent spawning, lifecycle monitoring, message-based reading via the relay MCP, and team coordination.DevOpsNo warnings★ 1.1K↓ —
- sox-itgcSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weakness under AS 2201 and Reg S-X), drafting remediation plans, SOX 404(a)/404(b) applicability and filer status, IPO readiness timelines, and COSO 2013 alignment. Use this skill whenever a user mentions SOX, ITGC, IT general controls, 404(a)/404(b), ICFR, material weakness, user access reviews, segregation of duties in IT, change management controls for financial systems, SOX testing or walkthroughs, PCAOB audits, or quarterly compliance for financial reporting systems.TestingNo warnings★ 1K↓ —
- vn-pdplSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert Vietnam Personal Data Protection Law (PDPL) compliance advisor for Law No. 91/2025/QH15 and implementing Decree 356/2025/ND-CP (effective January 1, 2026). Use this skill for gap analysis against the Vietnam PDPL, data subject rights fulfilment workflows, cross-border data transfer impact assessments, privacy notices and internal policies, breach notification procedures, sector-specific obligations (finance, AI, cloud, blockchain), and DPO qualification reviews. Trigger whenever a user mentions Vietnam data privacy, VN-PDPL, Nghị định 356, Vietnamese personal data, or cross-border transfers involving Vietnamese citizens' data.FinanceNo warnings★ 1K↓ —
- fedrampSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types: SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP Certification Classes (A, B, C, D — new baseline labels: A = pilot/transitional, B = LI-SaaS/Low, C = Moderate, D = High, per NTC-0004), FedRAMP 20x (now the primary authorization pathway), OSCAL mandate (September 2026), 3PAO assessments, continuous monitoring (ConMon), gap assessments, system boundary definition, or architecture reviews for federal cloud. FedRAMP Ready retired July 28, 2026 (Legacy FedRAMP Ready). When in doubt, use this skill — it covers the full FedRAMP lifecycle from readiness through continuous monitoring.SecurityNo warnings★ 1K↓ —
pentest-report
mohitagw15856/pm-claude-skills
SecurityUpdated 6 hours ago
From the author
Write a clear penetration-test report from findings of an authorized engagement. Use when documenting a pentest, security assessment, or authorized red-team engagement — turning findings into a report clients act on. Produces an executive summary, scope & methodology, findings with severity/evidence/reproduction/remediation, and a risk-ranked remediation plan. For authorized testing only.
Install
npx skills add mohitagw15856/pm-claude-skills --skill pentest-report -a claude-code
Installs to .claude/skills/pentest-report/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 88
Security100
Provenance78
Maintenance100
Licence100
Adoption51
Files (1)
- SKILL.md