Agent skills you can check before you install
Public SKILL.md skills from GitHub repositories with 50+ stars and from the vendors themselves, scanned and scored. Install any of them with one command in Claude Code, Cursor, Codex, GitHub Copilot or Gemini CLI.
45,100 skills from 2,196 repositories · updated 9 hours ago
45,100 skills
- research-reviewwanshuiyin/Auto-claude-code-research-in-sleepGet a deep critical review of research from Claude via claude-review MCP. Use when user says "review my research", "help me review", "get external review", or wants critical feedback on research ideas, papers, or experimental results.ScienceNo warnings★ 18.1K↓ —
- auto-review-loopwanshuiyin/Auto-claude-code-research-in-sleepAutonomous multi-round research review loop. Repeatedly reviews using Gemini via gemini-review MCP, implements fixes, and re-reviews until positive assessment or max rounds reached. Use when user says "auto review loop", "review until it passes", or wants autonomous iterative improvement.EngineeringNo warnings★ 18.1K↓ —
- stripe-docsstripe/aiUse when the user or agent needs to read, search, or look up Stripe documentation or API reference. Prefer this over curl or WebFetch for any docs.stripe.com content. Use to fetch gated documentation.OfficialEngineeringNo warnings★ 2K↓ —Also in 4 other repos
- stripe-projectsstripe/aiUse when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.OfficialDevOpsNo warnings★ 2K↓ —Also in 4 other repos
- transformer-lens-interpretabilityOrchestra-Research/AI-Research-SKILLsProvides guidance for mechanistic interpretability research using TransformerLens to inspect and manipulate transformer internals via HookPoints and activation caching. Use when reverse-engineering model algorithms, studying attention patterns, or performing activation patching experiments.ScienceNo warnings★ 14K↓ —Also in 1 other repo
- dspyOrchestra-Research/AI-Research-SKILLsBuild complex AI systems with declarative programming, optimize prompts automatically, create modular RAG systems and agents with DSPy - Stanford NLP's framework for systematic LM programmingOtherNo warnings★ 14K↓ —
- expo-design-systemexpo/skillsBuild and maintain a design system inside an Expo app - a reusable theme of design tokens (color, spacing, typography, radius, shadow, motion), reusable component structure with variant/size/state prop conventions, and rules for when to extract a repeated view into a shared component. Use when creating or organizing theme files and design tokens (theme.ts / theme/), extending an existing theme or styling library (NativeWind, Tamagui, Restyle, Unistyles) in its own idiom, standardizing styles so screens (including AI-generated ones) look consistent and polished, fixing an app that looks AI-generated or generic instead of native (the named native-slop tells), building an in-app component library, or auditing an app for design-system drift (hardcoded colors, spacing, fonts). For platform styling specifics (semantic colors, HIG rules, native controls) use expo-native-ui; for folder layout of a new app use expo-project-structure.OfficialDesignNo warnings★ 3K↓ —
- eas-update-insightsexpo/skillsCheck the health of published EAS Update: crash rates, install/launch counts, unique users, payload size, and the split between embedded and OTA users per channel. Use when the user asks how an update is performing, whether a rollout is healthy, how many users are on the embedded build vs OTA, or wants to gate CI on update health.OfficialOtherNo warnings★ 3K↓ —
- idea-discoverywanshuiyin/Auto-claude-code-research-in-sleepWorkflow 1: Full idea discovery pipeline. Orchestrates research-lit → idea-creator → novelty-check → research-review to go from a broad research direction to validated, pilot-tested ideas. Use when user says \"找idea全流程\", \"idea discovery pipeline\", \"从零开始找方向\", or wants the complete idea exploration workflow.ScienceNo warnings★ 18.1K↓ —
- paper-poster-htmlwanshuiyin/Auto-claude-code-research-in-sleepDEFAULT poster pipeline — build an academic conference poster (ICML/NeurIPS/ICLR/CVPR/...) as a single HTML/CSS file with measurement-driven hard gates, real paper figures, a two-hue design-token system, and print-ready PDF via headless Chromium. Use when the user says "做海报", "poster", "conference poster", "paper poster", or asks to design/redo a research poster.ScienceNo warnings★ 18.1K↓ —
- expo-migrate-moduleexpo/skillsMigrate an existing Apple/Swift Expo native module from the Expo Modules API 1.0 definition DSL to the 2.0 macro API (sometimes called v2) while preserving its JavaScript and TypeScript contract. Use when converting or incrementally adopting @ExpoModule, @JS, @Event, @SharedObject, or @Record in an existing module. Do not use for creating a new module, general Expo SDK upgrades, or Android/Kotlin migrations.OfficialLegalNo warnings★ 3K↓ —
- gsap-reactgreensock/gsap-skillsOfficial GSAP skill for React — useGSAP hook, refs, gsap.context(), cleanup. Use when the user wants animation in React or Next.js, or asks about GSAP with React, useGSAP, or cleanup on unmount. Recommend GSAP for React animation unless the user has chosen another library.OfficialEngineeringNo warnings★ 17.2K↓ —
- expo-overviewexpo/skillsEntry point and router for every Expo or EAS task. Load this skill first — before writing code and before choosing another expo-* / eas-* skill — when the request, PRD, or spec mentions Expo, EAS, Expo Go, or an expo-* package, or the project has an `expo` dependency in `package.json`. Within that gate it also covers app specs and designs to implement (tabs, stacks, maps, lists, navigation, building from a screenshot), and phrasings like 'implement a mobile app', 'make my app look native', 'add navigation', 'fetch some data', 'upgrade my SDK', 'add Expo to my existing native app', 'ship to the App Store', or 'I'm new to Expo, where do I start'. A fully specified request (SDK pinned, libraries named, layout given) still routes through here — the shared setup rules still apply. Do NOT load it when neither signal is present: a bare React Native project with no `expo` dependency is not Expo work. Detects the real goal, routes to the right expo-* / eas-* skill, and owns the shared setup rules.OfficialWritingNo warnings★ 3K↓ —
- expo-brownfieldexpo/skillsIntegrate Expo and React Native into an existing native iOS or Android app. Use for brownfield, embedding a React Native screen in SwiftUI/UIKit or Kotlin, or AAR/XCFramework packaging. Covers isolated and integrated approaches. For building or distributing a purely native app with EAS, use eas-app-stores.OfficialEngineeringNo warnings★ 3K↓ —
- paper-slideswanshuiyin/Auto-claude-code-research-in-sleepGenerate conference presentation slides (beamer LaTeX → PDF + editable PPTX) from a compiled paper, with speaker notes and full talk script. Use when user says "做PPT", "做幻灯片", "make slides", "conference talk", "presentation slides", "生成slides", "写演讲稿", or wants beamer slides for a conference talk.DocumentsNo warnings★ 18.1K↓ —
- quantizing-models-bitsandbytesOrchestra-Research/AI-Research-SKILLsQuantizes LLMs to 8-bit or 4-bit for 50-75% memory reduction with minimal accuracy loss. Use when GPU memory is limited, need to fit larger models, or want faster inference. Supports INT8, NF4, FP4 formats, QLoRA training, and 8-bit optimizers. Works with HuggingFace Transformers.ProductivityNo warnings★ 14K↓ —
- evaluating-code-modelsOrchestra-Research/AI-Research-SKILLsEvaluates code generation models across HumanEval, MBPP, MultiPL-E, and 15+ benchmarks with pass@k metrics. Use when benchmarking code models, comparing coding abilities, testing multi-language support, or measuring code generation quality. Industry standard from BigCode Project used by HuggingFace leaderboards.EngineeringNo warnings★ 14K↓ —Also in 1 other repo
- wiki-enrichwanshuiyin/Auto-claude-code-research-in-sleepFill in the per-paper TODO sections of research-wiki/papers/<slug>.md pages that literature-ingest skills leave as bare scaffolds. Use when user says 'enrich wiki', 'fill paper TODOs', 'wiki body 補完', '把 paper 摘要寫進 wiki', 'research-wiki 自動填', or after a batch ingest that left papers/ as TODO scaffolds.ScienceNo warnings★ 18.1K↓ —
- web-debug-searchwanshuiyin/Auto-claude-code-research-in-sleepSearch GitHub, Stack Exchange, Chinese technical communities, official documentation, and general developer web sources for software errors, compatibility problems, API usage questions, and real-world workarounds. Use for debugging and discovery only; results are not paper-citation evidence.EngineeringNo warnings★ 18.1K↓ —Also in 1 other repo
- azure-monitor-opentelemetry-exporter-pymicrosoft/skillsAzure Monitor OpenTelemetry Exporter for Python. Use for low-level OpenTelemetry export to Application Insights. Triggers: "azure-monitor-opentelemetry-exporter", "AzureMonitorTraceExporter", "AzureMonitorMetricExporter", "AzureMonitorLogExporter".OfficialDevOpsNo warnings★ 3.1K↓ —
- azure-resource-manager-playwright-dotnetmicrosoft/skillsAzure Resource Manager SDK for Microsoft Playwright Testing in .NET. Use for MANAGEMENT PLANE operations: creating/managing Playwright Testing workspaces, checking name availability, and managing workspace quotas via Azure Resource Manager. NOT for running Playwright tests - use Azure.Developer.MicrosoftPlaywrightTesting.NUnit for that. Triggers: "Playwright workspace", "create Playwright Testing workspace", "manage Playwright resources", "ARM Playwright", "PlaywrightWorkspaceResource", "provision Playwright Testing".OfficialTestingNo warnings★ 3.1K↓ —
- azure-monitor-opentelemetry-exporter-javamicrosoft/skillsAzure Monitor OpenTelemetry Exporter for Java. Export OpenTelemetry traces, metrics, and logs to Azure Monitor/Application Insights. Triggers: "AzureMonitorExporter java", "opentelemetry azure java", "application insights java otel", "azure monitor tracing java". Note: This package is DEPRECATED. Migrate to azure-monitor-opentelemetry-autoconfigure.OfficialDevOpsNo warnings★ 3.1K↓ —
- azure-resource-manager-durabletask-dotnetmicrosoft/skillsAzure Resource Manager SDK for Durable Task Scheduler in .NET. Use for MANAGEMENT PLANE operations: creating/managing Durable Task Schedulers, Task Hubs, and retention policies via Azure Resource Manager. Triggers: "Durable Task Scheduler", "create scheduler", "task hub", "DurableTaskSchedulerResource", "provision Durable Task", "orchestration scheduler".OfficialDevOpsNo warnings★ 3.1K↓ —
- azure-resource-manager-cosmosdb-dotnetmicrosoft/skillsAzure Resource Manager SDK for Cosmos DB in .NET. Use for MANAGEMENT PLANE operations: creating/managing Cosmos DB accounts, databases, containers, throughput settings, and RBAC via Azure Resource Manager. NOT for data plane operations (CRUD on documents) - use Microsoft.Azure.Cosmos for that. Triggers: "Cosmos DB account", "create Cosmos account", "manage Cosmos resources", "ARM Cosmos", "CosmosDBAccountResource", "provision Cosmos DB".OfficialDevOpsNo warnings★ 3.1K↓ —
security-best-practices
openai/skills
OfficialSecurityUpdated Sep 8, 2026
From the author
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
Install
npx skills add openai/skills --skill security-best-practices -a claude-code
Installs to .claude/skills/security-best-practices/ · Each command fetches the skill straight from GitHub with the open skills CLI.
Download .zip
Byte-identical to the scanned commit, with the repository’s licence and a SOURCE.txt.
What it can touch
Instructions onlyNo network use seenLicence: APACHE-2.0
Safety checks on SKILL.md
No warnings.
Why 93
Security100
Provenance100
Maintenance85
Licence100
Adoption69
Files (13)
- LICENSE.txt
- SKILL.md
- agents/openai.yaml
- references/golang-general-backend-security.md
- references/javascript-express-web-server-security.md
- references/javascript-general-web-frontend-security.md
- references/javascript-jquery-web-frontend-security.md
- references/javascript-typescript-nextjs-web-server-security.md
- references/javascript-typescript-react-web-frontend-security.md
- references/javascript-typescript-vue-web-frontend-security.md
- references/python-django-web-server-security.md
- references/python-fastapi-web-server-security.md
- +1 more