Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
49,409 skills from 2,375 repositories · updated 7 hours ago
48,362 skills
- oma-skill-creationfirst-fluke/oh-my-agentCreate or revise OMA skills and their references. Use for skill routing, execution contracts, conditional loading, and authoring validation.OtherNo warnings★ 1.4K↓ —
- find-quoteshashgraph-online/awesome-codex-pluginsFinds exact spoken quotes and clip-ready moments on podcasts and YouTube: verbatim words, speaker, date, a timestamped link, clip start and end. Uses arcmira.OtherNo warnings★ 1.5K↓ —
- varg-tryon-videoNewhashgraph-online/awesome-codex-pluginsTurns a flat-lay or product photo of clothing into a try-on video on varg: clean the garment photo, dress a model photo in it with Bria Virtual Try-On (or a Nano Banana / GPT Image edit for harder garments), keep the same model across shots, then animate fit-check motions that sell clothes (slow turn, tug and let fall, walk to camera, mirror selfie, fabric close-up) on Kling 4 or Seedance 2.5 with the garment kept intact, and add size captions so the fit is honest. Use when a fashion or apparel seller (Shopify, TikTok Shop, Amazon, dropshipping) asks for a try-on video, "my clothes on a model", an AI model wearing their product, a fit-check or outfit video, a try-on haul, or virtual try-on from flat-lays. Not for accessories that need no body (use product-photo-to-video) or for consistent characters across a story (varg-character-design).MediaNo warnings★ 1.5K↓ —
- write-docsdzhng/skillsWrite and edit project docs (README/markdown) as a glossary of principles, not a mirror of the code. Use when creating or revising a README; when a doc enumerates exact scenes, scenarios, helpers, class ids, file lists, or command/flag matrices the code already holds; when trimming narrative or changelog out of a doc; or when deduplicating overlapping docs and wiring a root doc to its sub-docs.WritingNo warnings★ 1.4K↓ —
- audit-testsdzhng/skillsAudit whether tests earn their maintenance cost and which suite owns each contract. Use when pruning redundant tests, investigating implementation coupling or test-only production hooks, reviewing the value of proposed coverage, or auditing an entire subsystem. Use write-tests to implement the resulting test changes.TestingNo warnings★ 1.4K↓ —
- oma-securityfirst-fluke/oh-my-agentScan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.SecurityNo warnings★ 1.4K↓ —
- improve-search-visibility-store-listing-auditgooseworks-ai/goose-skillsAudits an app's App Store and Google Play listing against three competitors (title, subtitle, description opening, first screenshots and captions, rating, review themes) and writes a field-by-field rewrite with character counts, or a launch-day listing before release. Use alone when you already have the app's store links and signed-off product facts; otherwise run improve-search-visibility.WritingNo warnings★ 1.3K↓ —
- shophashgraph-online/awesome-codex-pluginsSell things in a Homie studio's games with the studio's OWN Stripe - a supporter pack, cosmetics, a season pass, a one-time unlock, a tip, a round of several items to a table, a paid booking with slot capacity, monthly giving or a membership - in real money, with Stripe Checkout, Stripe Tax or Stripe Managed Payments, refunds from the office, and optional studio policies with an open default; set up with Stripe's own agent tools (Stripe's MCP server and skills) with one browser approval and Payment Links by default, no human-handled key and no API key in the Worker. Use when someone asks to sell something, add a shop or store, take payments or donations, take paid bookings, set up monthly giving or memberships, make money from a game, set up or connect Stripe, make the products in Stripe, asks "how are sales?", about tax or Managed Payments, to add a supporter badge, refund a player, or about chargebacks.BrowserNo warnings★ 1.5K↓ —
- emailhashgraph-online/awesome-codex-pluginsUse when a val sends email, receives email, or is triggered by an incoming email. Covers email-type vals (the Email handler shape, attachment limits, the assigned val email address) and sending mail via std/email.ProductivityNo warnings★ 1.5K↓ —
- oauthhashgraph-online/awesome-codex-pluginsUse when a val needs to require login with a Val Town account — gating routes behind authentication, identifying the current user, building user-specific dashboards. Covers std/oauth's `oauthMiddleware` and `getOAuthUserData`, the auto-managed `/auth/*` routes, and session behavior. For third-party OAuth providers (Google, GitHub, etc.) see the `third-party-integrations` skill instead.PlanningNo warnings★ 1.5K↓ —
- oma-pdfNewfirst-fluke/oh-my-agentExtract PDF text, headings, tables, and images into Markdown using opendataloader-pdf. Use for PDF parsing, not PDF layout creation.DocumentsNo warnings★ 1.4K↓ —
- research-audience-score-segment-qagooseworks-ai/goose-skillsStep of the research-audience playbook: scores and tiers list rows, groups them into segments with an angle each, runs the pre-handover checks and writes the list files. Run research-audience instead; not for direct use.TestingNo warnings★ 1.3K↓ —
- perfhashgraph-online/awesome-codex-pluginsPerformance optimizer for loops, DB queries, rendering, and batch operations. Catches N+1 queries, missing indexes, and unnecessary re-renders.MediaNo warnings★ 1.5K↓ —
- laravel-tddhashgraph-online/awesome-codex-pluginsTest-driven development for Laravel with PHPUnit and Pest, factories, database testing, fakes, and coverage targets.TestingNo warnings★ 1.5K↓ —
- orchestratehashgraph-online/awesome-codex-pluginsCoordinate several workers: what idle agents do next, which finished work gets checked first, how to recover a dead one. Use when: managing multiple agents.OtherNo warnings★ 1.5K↓ —Also in 2 other repos
- rag-architectUpdatedalirezarezvani/claude-skillsDesign a RAG pipeline: chunk size, embedding model, vector database and retrieval quality metrics. Use whenever the user builds search over their docs, picks a vector store or finds answers miss the right context.PlanningNo warnings★ 29.2K↓ —
- second-brain-lintundefined-ui/second-brain-osAudit a second-brain vault for structural problems and repair them: broken wikilinks, orphan pages, empty stubs, frontmatter that violates the schema, near-duplicate pages, and stale index entries. Use this skill whenever the user asks to lint, clean, audit or check the health of their vault, says pages feel messy or links are broken, after a large bulk import, or when a scheduled maintenance run fires. Do NOT use for ingesting new sources, for answering questions from the vault, or for rewriting page content that is structurally fine but reads badly.OtherNo warnings★ 1.2K↓ —
- second-brain-quizundefined-ui/second-brain-osGenerate questions from the user's own concept pages so they can find out what they saved but never learned, and compare their answers against what the pages say. Use this skill when the user wants to test themselves, revise, make flashcards from their notes, or asks what they have forgotten. Do NOT use for generic quizzing on a topic the vault does not cover, or for answering a question from the vault.TestingNo warnings★ 1.2K↓ —
- redis-clusteringredis/agent-skillsRedis Cluster and replication guidance covering hash tags for multi-key operations, avoiding CROSSSLOT errors, and reading from replicas to scale read-heavy workloads. Use when designing keys for a sharded Redis Cluster, debugging CROSSSLOT errors on MGET / SDIFF / pipelines, configuring a multi-key transaction in a cluster, or routing reads to replicas for caches, analytics, or dashboards.OfficialDataNo warnings★ 172↓ —Also in 1 other repo
- second-brain-graphundefined-ui/second-brain-osAnalyse the vault's link graph and report on its shape: orphan rate, average degree, components, hubs, bridges and clusters, with what each number means for retrieval. Use this skill when the user asks about the health or structure of their graph, wants metrics, asks which pages are most connected or most isolated, or asks whether the vault is fragmented. Do NOT use for fixing what it finds, which is second-brain-lint, or for answering a content question.OtherNo warnings★ 1.2K↓ —
- second-brain-mergeundefined-ui/second-brain-osMerge two pages that describe the same thing, preserving every distinct claim, redirecting inbound links, and recording the merge. Use this skill when the user approves a duplicate merge, says "these are the same page", "merge X into Y", or asks to clean up near-duplicates that a lint run proposed. Do NOT use to merge pages on your own judgement, to delete a page outright, or to split one page into several.OtherNo warnings★ 1.2K↓ —
- second-brain-queryundefined-ui/second-brain-osAnswer a question from a second-brain vault by reading its own pages, citing the pages used, and saying plainly when the vault does not contain the answer. Use this skill whenever the user asks what they know about a topic, what they have read on something, what connects two ideas, what they have changed their mind about, or asks any question that should be answered from their own notes rather than general knowledge. Do NOT use for ingesting new material, for general questions the vault has nothing to do with, or when the user explicitly wants an answer from the open web.ProductivityNo warnings★ 1.2K↓ —
- redis-coreredis/agent-skillsCore Redis modeling guidance — choose the right data structure (String, Hash, List, Set, Sorted Set, JSON, Stream, Vector Set) and use consistent colon-separated key names. Use when designing a Redis data model, caching objects, deciding between Hash and JSON, building counters, leaderboards, membership sets, or session stores, or when reviewing/cleaning up Redis key naming.OfficialOtherNo warnings★ 172↓ —Also in 1 other repo
- tencent-meetingnano-muse/nanoMusenanoMuse: an open-source personal agent for every device you own. One agent with a name and a look of its own that does things, keeps working while the app is closed, remembers you, and asks before anything you cannot undo. On Android, iPhone and iPad, Windows / macOS / Linux and in the browser; your phone's screen and your computer as its hands.BrowserNo warnings★ 3.1K↓ —
security-audit
cloudflare/security-audit-skill
OfficialSecurityUpdated Sep 14, 2026
From the author
Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
Install
npx skills add cloudflare/security-audit-skill --skill security-audit -a claude-code
Installs to .claude/skills/security-audit/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Runs bundled scriptsNo network use seenLicence: MIT
Safety checks on SKILL.md
- Ships scripts we have not reviewedLow
Why 88
Security85
Provenance100
Maintenance85
Licence100
Adoption72
Files (20)
- AI-AND-LLM.md
- ATTACK-CLASSES.md
- CLIENT-SIDE.md
- CLOUD-AND-DEPLOYMENT.md
- DATA-ISOLATION-AND-LIFECYCLE.md
- DESKTOP-MOBILE-AND-LOCAL-IPC.md
- HUNTING.md
- MEMORY-SAFETY-AND-BINARY.md
- PROTOCOLS-RPC-AND-MESSAGING.md
- RECONNAISSANCE.md
- RESOURCE-EXHAUSTION-AND-AVAILABILITY.md
- SKILL.md
- +8 more