Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,604 skills from 2,205 repositories · updated 9 hours ago
45,602 skills
- repo-standardizergithub/awesome-copilotPolish any GitHub repository's surface — labels (emoji rating tiers, P0–P3 priority, impact severity), issue forms, PR template, CI workflows, CODEOWNERS, rulesets, docs. Repo meta & config only — no code logic touched. Use when creating a new repo or polishing an existing one.EngineeringNo warnings★ 40.4K↓ —
- form-crosickn33/agentic-awesome-skillsOptimize any form that is NOT signup or account registration — including lead capture, contact, demo request, application, survey, quote, and checkout forms.MarketingNo warnings★ 48.5K↓ —
- managed-airflow-migrationsgoogle/skillsProvides guidance for migrating Apache Airflow DAGs in Managed Service for Apache Airflow (MSAA; formerly Cloud Composer). Covers migration to Airflow 2.11.1 (MSAA Gen 2 and 3) and Airflow 3 (MSAA Gen 3), including environment inspection, GCS download/upload and scanning patterns for breaking changes. Use when migrating the DAG code to newer Airflow version. Don't use when checking DAG run failures unrelated to code migration.OfficialEngineeringNo warnings★ 21.6K↓ —
- fp-reactsickn33/agentic-awesome-skillsPractical patterns for using fp-ts with React - hooks, state, forms, data fetching. Includes version-specific React examples; verify framework/client boundaries.EngineeringNo warnings★ 48.5K↓ —
- grill-mesickn33/agentic-awesome-skillsA relentless interview to sharpen a plan or design.DesignNo warnings★ 48.5K↓ —
- hunt-atosickn33/agentic-awesome-skillsHunt account takeover taxonomyOtherNo warnings★ 48.5K↓ —
- google-mobile-ads-rewardedgoogle/skillsProvides instructions for implementing, integrating, or configuring Google Mobile Ads (GMA) SDK rewarded ads in Android, iOS, or Unity mobile applications. Use when the task involves setting up rewarded ads. Don't use for "rewarded interstitial" ads.OfficialMarketingNo warnings★ 21.6K↓ —
- bigquery-troubleshootinggoogle/skillsProvides diagnostic workflows and step-by-step root-cause analysis procedures for actively broken, failing, or slow BigQuery jobs, execution graph and query plan stage bottlenecks, system performance issues, or unexpectedly expensive workloads. Use when interpreting symptoms, isolating bottlenecks, diagnosing cost spikes (on-demand query spend, capacity slot autoscaling, storage growth), execution graph stages or substep variables, identifying root causes, and determining remediation steps. Don't use for writing or optimizing SQL, proactive capacity planning, or storage layout design (use bigquery-optimization), or when the user already knows which telemetry they want and just needs the query (use bigquery-observability).OfficialDataNo warnings★ 21.6K↓ —
- scientific-critical-thinkingK-Dense-AI/scientific-agent-skillsEvaluates scientific claims and evidence quality. Applies to experimental design validity, biases and confounders, statistical interpretation, evidence grading frameworks (GRADE, Cochrane Risk of Bias), and teaching critical analysis. Supports evidence appraisal and identifying flaws; formal peer review writing belongs to peer-review.ScienceNo warnings★ 54.5K↓ —
- java-prosickn33/agentic-awesome-skillsMaster Java 21+ with modern features like virtual threads, pattern matching, and Spring Boot 3.x. Expert in the latest Java ecosystem including GraalVM, Project Loom, and cloud-native patterns.OtherNo warnings★ 48.5K↓ —
- developing-genkit-pythongoogle/skillsDevelop AI-powered applications using Genkit in Python. Use when the user asks about Genkit, AI agents, flows, or tools in Python, or when encountering Genkit errors, import issues, or API problems.OfficialEngineeringNo warnings★ 21.6K↓ —
- speedsickn33/agentic-awesome-skillsLaunch RSVP speed reader for textOtherNo warnings★ 48.5K↓ —
- folklore-variant-evidenceK-Dense-AI/scientific-agent-skillsRetrieves ClinGen gene-disease validity assertions for a public gene or disease, and reviews source-linked public evidence and literature for one supported GRCh38 germline nuclear SNV or simple indel through Folklore Clinical Variant Interpretation MCP. Used when a scientific agent must branch deterministically on resolved, ambiguous, not-found, invalid, unsupported, or unavailable variant outcomes; chain a resolved public variant into related literature or publication details; or preserve evidence provenance without accepting patient, phenotype, family, segregation, or private case data.ScienceNo warnings★ 54.5K↓ —
- aws-resource-querygithub/awesome-copilotQuery AWS resources using natural language. Covers EC2, S3, RDS, Lambda, ECS, EKS, Secrets Manager, IAM, VPC, networking, messaging, and more. Strictly read-only — no writes, deletes, or mutations.DevOpsNo warnings★ 40.4K↓ —
- workload-manager-basicsgoogle/skillsUse this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.OfficialDataNo warnings★ 21.6K↓ —
- google-ads-api-account-diagnosticsgoogle/skillsDiagnoses Google Ads account performance issues such as conversion loss (value or volume), low lead flow/volume, and lost impression share (opportunities) due to ad rank, bids, or budgets. Use when troubleshooting sudden performance drops, analyzing campaign impression share metrics, investigating low lead flow, or searching for bidding and budget constraints. Don't use for setting up new campaigns, uploading conversion events directly, or general Google Mobile Ads SDK integration issues (use gma-android-integrate instead).OfficialMarketingNo warnings★ 21.6K↓ —
- gke-platform-securitygoogle/skillsPlans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, Secrets Encryption (--database-encryption-key), Security Posture (--security-posture), enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for Workload Identity (use gke-workload-identity) or workload-level security (SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security).OfficialSecurityNo warnings★ 21.6K↓ —
- rust-prosickn33/agentic-awesome-skillsMaster Rust 1.75+ with modern async patterns, advanced type system features, and production-ready systems programming.OtherNo warnings★ 48.5K↓ —
- gke-service-networkinggoogle/skillsConfigures GKE edge networking, traffic routing, load balancing, and private service endpoints. Use when configuring Gateway API manifests, standard Ingress, Cloud Armor WAF security policies, Container-Native Load Balancing (NEGs), Private Service Connect (PSC), or Google-managed SSL certificates on GKE, and to troubleshoot Ingress and load-balancer 502/5xx errors, backend health-check failures, connection draining, and TLS/SSL policy enforcement. Don't use for core cluster IP planning, Dataplane V2 network policies, or node NAT egress (use gke-networking instead).OfficialSecurityNo warnings★ 21.6K↓ —
- markdown-mermaid-writingK-Dense-AI/scientific-agent-skillsWrites scientific Markdown documentation and Mermaid diagrams for workflows, relationships, timelines, and schemas. Provides syntax references, document templates, accessibility guidance, and version-aware rendering checks. Use when a user requests Markdown, Mermaid, or a text-based structural diagram; quantitative scientific figures require suitable plotting tools.WritingNo warnings★ 54.5K↓ —
- ruby-prosickn33/agentic-awesome-skillsWrite idiomatic Ruby code with metaprogramming, Rails patterns, and performance optimization. Specializes in Ruby on Rails, gem development, and testing frameworks.TestingNo warnings★ 48.5K↓ —
- google-cloud-scc-querygoogle/skillsQueries and retrieves active security findings, external exposures, toxic combinations, vulnerabilities, threats, and sensitive data risks from Security Command Center on Google Cloud. Use when retrieving details for a security finding by its name, validating finding scope (e.g., verifying findingClass is TOXIC_COMBINATION, VULNERABILITY, EXTERNAL_EXPOSURE, or THREAT), or fetching finding details for triage. Don't use to draft remediations, apply patches, or execute configurations.OfficialSecurityNo warnings★ 21.6K↓ —
- gemini-interactions-apigoogle/skillsGuides the usage of Gemini Interactions API on Gemini Enterprise Agent Platform. Use when the user wants to use the stateful, server-managed Interactions API for multi-turn conversations, background execution, streaming, structured output, and function calling on the Agent Platform.OfficialEngineeringNo warnings★ 21.6K↓ —
- ux-auditsickn33/agentic-awesome-skillsAudit screens for UX issues using Nielsen's heuristics and modern mobile UX best practicesDesignNo warnings★ 48.5K↓ —
mcp-security-audit
github/awesome-copilot
SecurityUpdated 2 days ago
From the author
Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions, not bare names, @latest, or ranges - Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, and npm exec references in MCP configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]
Install
npx skills add github/awesome-copilot --skill mcp-security-audit -a claude-code
Installs to .claude/skills/mcp-security-audit/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyUses the networkLicence: MIT
Safety checks on SKILL.md
No warnings.
Why 95
Security100
Provenance95
Maintenance100
Licence100
Adoption71
Files (1)
- SKILL.md