Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,409 skills from 2,375 repositories · updated 40 minutes ago
48,362 skills
- vuln-triagemohitagw15856/pm-claude-skillsTriage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.SecurityNo warnings★ 1.5K↓ —
- event-tracehoangsonww/Claude-Code-Agent-MonitorTrace the full event chain for one Claude Code session into an ordered timeline of every event type with tool_name and summary, highlighting gaps, out-of-order events, and failures. Reads /api/events?session_id= and /api/sessions/:id from the Agent Monitor dashboard. Use when debugging what a session actually did, step by step.EngineeringNo warnings★ 1.1K↓ —
- update-knowledge-basehuytieu/COG-second-brainMaintain and update product knowledge base from releases, features, and project changes with optional wiki syncOtherNo warnings★ 1.3K↓ —Also in 1 other repo
- stoc-workflowbrycewang-stanford/Awesome-Journal-SkillsUse when planning a STOC (ACM Symposium on Theory of Computing) project calendar — backward planning to the early-November deadline, the STOC/FOCS alternating two-deadline year that theory groups schedule around, full-version and camera-ready milestones, and the June TheoryFest endpoint.ProductivityNo warnings★ 1.4K↓ —
- cloud-storage-webUpdatedTencentCloudBase/CloudBase-AI-ToolkitComplete guide for CloudBase cloud storage using Web SDK (@cloudbase/js-sdk) - upload, download, temporary URLs, file management, and best practices.OtherNo warnings★ 1.2K↓ —Also in 4 other repos
- cis-controlsSushegaad/Claude-Skills-Governance-Risk-and-ComplianceExpert CIS Controls v8 (CIS Top 18) advisor — implementation group scoping (IG1/IG2/IG3), control gap assessments, safeguard-level guidance, asset inventory, software inventory, data protection, secure configuration, account management, access control, continuous vulnerability management, audit log management, email and web browser protections, malware defenses, network infrastructure management, network monitoring and defense, application software security, incident response, penetration testing, and CIS Controls mapping to NIST CSF, ISO 27001, SOC 2, and CMMC. Use for any question about CIS Controls, CIS Benchmarks, Implementation Groups, or prioritized cyber hygiene for any organization size.SecurityNo warnings★ 1K↓ —
- comment-mininggooseworks-ai/goose-skillsMine comments and replies on social posts, videos, and ads for recurring customer language, questions, objections, desired outcomes, complaints, product requests, purchase signals, and creative opportunities. Use for voice-of-customer research grounded in linked source evidence.ScienceNo warnings★ 1.3K↓ —
- fleet-runshoangsonww/Claude-Code-Agent-MonitorSummarize Workflow-tool fleet runs from the Agent Monitor — these fleets emit no hooks and are ingested from on-disk run journals. List recent runs with status and agents-per-run, then drill into a single run's per-agent detail. Reconciles against the live run-state endpoints. Use when reviewing Workflow() fleets rather than hook-instrumented interactive sessions.ProductivityNo warnings★ 1.1K↓ —
- review-automation-orchestratorTencentCloudBase/CloudBase-AI-ToolkitUse when running or scheduling periodic repository review cycles that must dispatch the correct reviewer, aggregate findings, and escalate outcomes into reports, issues, or corrective PRs across API contracts, documentation freshness, code quality, and CloudBase skill quality.EngineeringNo warnings★ 1.2K↓ —
- live-watchhoangsonww/Claude-Code-Agent-MonitorPolls the Agent Monitor /api/stats endpoint several times over a short window and reports the live deltas in active_sessions, active_agents, events_today, and ws_connections so you can see activity moving in real time. Use when watching the dashboard for live changes rather than a one-time snapshot.EngineeringNo warnings★ 1.1K↓ —
- goose-adsgooseworks-ai/goose-skillsEdit, resize, animate and study image ads with GooseWorks in this chat. New static or image ads go to the make-static-ads skill when it is installed or catalog_fetch opens it. Read the brand and follow the active playbook, preserving factual prerequisites and approvals.MarketingNo warnings★ 1.3K↓ —
- scouthuytieu/COG-second-brainEvaluate URLs and tools — check vault coverage, assess relevance, recommend save or skipOtherNo warnings★ 1.3K↓ —
- oma-tf-infrafirst-fluke/oh-my-agentCreate or review Terraform infrastructure and plans. Use for cloud resources, IAM, networking, state management, and infrastructure changes.DevOpsNo warnings★ 1.4K↓ —
- data-exporthoangsonww/Claude-Code-Agent-MonitorExport Claude Code session and analytics data in JSON, CSV, or Markdown formats. Supports exporting sessions, events, costs, and analytics for external analysis or reporting. Use for data backup or integration.DataNo warnings★ 1.1K↓ —
- running-github-actions-efficientlykajisho5/ffmpeg-skillCut GitHub Actions minutes and wall-clock time without losing coverage — the OS billing multiplier (macOS 10x / Windows 2x / Linux 1x), trigger hygiene that stops push+pull_request double-firing, concurrency that cancels superseded runs, dependency caching keyed on lockfiles, matrix discipline, and auditing scheduled crons that bill 24/7. Use when CI is burning included minutes, when runs feel slow, when setting up a new repo's workflows, or when reviewing an existing workflow for waste.DevOpsNo warnings★ 4.4K↓ —
- run-organic-socialgooseworks-ai/goose-skillsRuns a brand's organic social: how each platform works now, a strategy per platform and two weeks of posts in the brand's or a person's real voice. Use when a marketer says "run organic social for my brand", "fill my social calendar", "plan two weeks of posts", "grow my X / LinkedIn / Instagram / TikTok", "ghostwrite my founder's posts", "which platforms should we be on?", "plan the social for our launch", "a TikTok or Reel script to shoot on my phone", "tear down @x's account", or "my accounts went quiet". The marketer posts by hand; nothing is posted or scheduled. Not for a standalone post or repurposing one piece — use make-content.MarketingNo warnings★ 1.3K↓ —
- oma-scmfirst-fluke/oh-my-agentManage Git branches, merges, conflicts, commits, and release baselines. Use for repository history and change-management operations.EngineeringNo warnings★ 1.4K↓ —
- tos-decodermohitagw15856/pm-claude-skillsDecode a terms of service or privacy policy into what you're actually agreeing to, ranked by real-world impact. Use when someone asks 'what am I agreeing to', 'decode this privacy policy', 'is this ToS bad', or 'should I click accept'. Produces a ranked findings table with a 'should I care?' verdict per finding, covering data resale, arbitration and class-action waivers, unilateral changes, content licenses, and what deletion really means.OtherNo warnings★ 1.5K↓ —
- graphifyhashgraph-online/awesome-codex-plugins将 Graphify 作为可选知识图谱能力接入，用于 brownfield 结构扫描、依赖路径分析与架构问答。 不替代 `/team-*` 主链；输出统一回落到 handoff 与 artifacts 证据。OtherNo warnings★ 1.5K↓ —
- push-to-forked-prhoangsonww/Claude-Code-Agent-MonitorPush the current working tree directly to a GitHub PR whose head lives on a **fork**, without creating a new branch and without pushing to `origin` (which is usually the upstream). Invoke when the user says things like "push straight to PROtherNo warnings★ 1.1K↓ —Also in 2 other repos
- mcp-audithoangsonww/Claude-Code-Agent-MonitorAudit the configured MCP servers (user + project scope) via the Agent Monitor Config Explorer API: transport (stdio vs http), command/args and env variable names, headers, and the source file each definition came from. Reads /api/cc-config/mcp. Use when reviewing MCP integrations for hygiene, duplication, or unexpected transports.EngineeringNo warnings★ 1.1K↓ —
- meta-ads-analyzergooseworks-ai/goose-skillsDiagnose Meta Ads campaign performance and account gaps using Meta's actual system mechanics — including customer-journey coverage, Breakdown Effect, Learning Phase, Auction Overlap, Pacing, and Creative Fatigue. Use for performance diagnosis, account audits, full-funnel or TOF/MOF/BOF gap analysis, deciding what to test or create next, and producing novice-friendly recommendations without forcing every campaign or ad into a funnel stage.MarketingNo warnings★ 1.3K↓ —
- test-native-extensionmicrosoft/power-platform-skillsValidate a third-party control repo across four automated layers plus one printed manual recipe. Layer 1 asserts native-source structure (Android getName() and iOS +moduleName to manifest nativeModule; @ReactMethod / RCT_EXPORT_METHOD to methods; no @ReactModule) plus load/init readiness (ReactPackage public no-arg constructor, iOS [cls new] no-arg init, requiresMainQueueSetup NO, non-throwing eager construction), so launch-time crashes surface before any build. Layer 2 validates the committed `./manifest.json` against the ppmplugin-format rules. Layer 3 asserts request/response/error-code agreement across native and PCF. Layer 4 compiles the PCF (auto-skipped if absent). Layer 5 prints a device end-to-end recipe. Native compile belongs to /build-android-binary and /build-ios-binary — this is the cheap structural pre-flight before those slow builds. Reports pass/fail per layer with a fix hint and updates .extension-state.md.TestingNo warnings★ 1.1K↓ —
- animate-imagegooseworks-ai/goose-skillsAnimate an existing product image or static ad into a short branded video using the GooseWorks Animate Images workflow, with source-image continuity and optional end-frame control.MediaNo warnings★ 1.3K↓ —
cmmc
Sushegaad/Claude-Skills-Governance-Risk-and-Compliance
SecurityUpdated Oct 10, 2026
From the author
Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", "prime contractor flow-down requirements", the July 2026 CMMC Phase 2 suspension, or the CMMC Reform Task Force.
Install
npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cmmc -a claude-code
Installs to .claude/skills/cmmc/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 88
Security100
Provenance76
Maintenance100
Licence100
Adoption49
Files (4)
- SKILL.md
- references/cmmc-assessment.md
- references/cmmc-levels.md
- references/cmmc-practices.md