Skill-uri pentru agenți pe care le poți verifica înainte să le instalezi
Skill-uri SKILL.md publice din depozite GitHub cu peste 50 de stele și de la producători, scanate și evaluate. Instalează oricare dintre ele cu o singură comandă în Claude Code, Cursor, Codex, GitHub Copilot sau Gemini CLI.
45.604 skill-uri din 2.205 depozite · actualizat acum 8 ore
45.604 skill-uri
- sql-injection-testingzebbern/claude-code-guideThis skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.TestareFără avertismente★ 4,7 K↓ —
- three-best-practiceszebbern/claude-code-guideThree.js performance optimization and best practices guidelines. Use when writing, reviewing, or optimizing Three.js code. Triggers on tasks involving 3D scenes, WebGL/WebGPU rendering, geometries, materials, textures, lighting, shaders, or TSL.MediaFără avertismente★ 4,7 K↓ —
- dart-setup-ffi-assetsflutter/agent-pluginsGuides agents in compiling and packaging C/C++ source code into dynamic or static libraries (Code Assets) using Dart's Native Assets hook system (via hook/build.dart and hook/link.dart utilizing package:hooks and package:native_toolchain_c). Use when a user asks to: 'setup native assets', 'compile C/C++ source code', 'bundle dynamic libraries', 'build native C code', 'link native assets', 'implement build.dart or link.dart hooks', or 'integrate C/C++ interop in Dart/Flutter'. Helps agents avoid manual toolchain orchestration and configures secure hash-validated binary downloads or advanced linker tree-shaking with package:record_use mapping.OficialInginerieFără avertismente★ 3,1 K↓ —
- tempografana/skillsStand up Grafana Tempo as a cost-efficient distributed-tracing backend that only needs object storage, and write TraceQL queries against it. Covers OTLP + Jaeger + Zipkin ingestion, the distributor → live-store → block-builder → object-storage write path, metrics-generator for RED spanmetrics + service graphs, Helm `tempo-distributed` deployment, multi-tenant `X-Scope-OrgID`, TraceQL span / resource / event scopes, structural operators (`>>`, `<<`), `rate()` + `quantile_over_time` metrics, and the traces-to-logs / metrics / profiles datasource links. Use when deploying Tempo, writing a TraceQL query for slow / errored requests, debugging "no traces showing in Explore", sizing queriers / compactors, configuring S3 / GCS / Azure block storage, or wiring trace ↔ log ↔ profile correlation — even when the user says "tracing backend", "find slow requests", "show me the service graph", "store traces in S3", "Jaeger compatible store", or "what called this span" without naming Tempo.OficialDevOpsFără avertismente★ 290↓ —
- playwright-clizebbern/claude-code-guideAutomates browser interactions for web testing, form filling, screenshots, and data extraction using playwright-cli. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, extract information from web pages, mock network requests, manage browser sessions, or generate test code.TestareFără avertismente★ 4,7 K↓ —
- create-plancomposio-community/awesome-codex-skillsCreate a concise plan. Use when a user explicitly asks for a plan related to a coding task.PlanificareFără avertismente★ 17 K↓ —
- paperjsxcomposio-community/awesome-codex-skillsGenerate PPTX presentations, DOCX documents, XLSX spreadsheets, and PDF reports from structured JSON input using PaperJSX.DocumenteFără avertismente★ 17 K↓ —
- brand-guidelinescomposio-community/awesome-codex-skillsApplies OpenAI's brand colors and typography to any artifact that should match the Codex/OpenAI look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.DesignFără avertismente★ 17 K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for coinbase.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignFără avertismente★ 4,4 K↓ —
- lifelinesbrycewang-stanford/Auto-Empirical-Research-SkillsComplete survival analysis library in Python. Handles right-censored data, Kaplan-Meier curves, and Cox regression. Standard for clinical trial analysis and epidemiology.ȘtiințăFără avertismente★ 4,8 K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for netflix.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignFără avertismente★ 4,4 K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for railway.app — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignFără avertismente★ 4,4 K↓ —
- hunt-shadow-apielementalsouls/Claude-BugHunterHunt shadow / zombie / undocumented API surface (OWASP API9 Improper Inventory Management) — enumerate the full API version history (v1/v2/beta/legacy paths, header- and subdomain-based versioning), pull and diff every reachable OpenAPI/Swagger spec (including ones only findable via the Wayback Machine), and behaviorally diff old vs. current versions for auth/rate-limit/validation regressions rather than just response-shape differences. Distinct from hunt-api-misconfig, which owns exploitation once you have a spec or endpoint (mass assignment, JWT, OData, Swagger-chain attacks); distinct from hunt-subdomain, which owns host-level discovery. This skill owns the version-inventory and behavioral-diff workflow itself. Use when the target has versioned API paths, multiple specs, a changelog referencing deprecated endpoints, or a mobile app whose hardcoded backend calls look older than the current web app's.InginerieFără avertismente★ 5,3 K↓ —
- cloud-iam-deepelementalsouls/Claude-BugHunterCloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.DevOpsFără avertismente★ 5,3 K↓ —
- extract-designManavarya09/design-extractExtract the full design language from any website URL. Produces 8 output files including AI-optimized markdown, visual HTML preview, Tailwind config, React theme, shadcn/ui theme, Figma variables, W3C design tokens, and CSS variables. Also runs WCAG accessibility scoring. Use when user says 'extract design', 'get design system', 'design language', 'design tokens', 'what colors/fonts does this site use', 'turn this URL into design tokens', 'make a Tailwind theme from this site', or '/extract-design'. Do not use for building a new UI from scratch unless the user first wants to extract an existing website's design language.DesignFără avertismente★ 4,4 K↓ —
- linkedin-hook-extractorsergebulaev/linkedin-skillsReverse-engineer the hook formula from a viral LinkedIn post URL. Returns which of the 20 canonical 2026 formulas it uses (anaphora, R.I.P., year-pivot, time-anchor, curiosity-gap, contrarian, comment-gate, emotional cold-open, named-gratitude, and 11 more), why it worked, and a blank template. Use to learn from a competitor's post, not to write your own (use linkedin-post-writer).MarketingFără avertismente★ 5,2 K↓ —Apare și în 1 alt depozit
- web3-auditelementalsouls/Claude-BugHunterSmart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.SecuritateFără avertismente★ 5,3 K↓ —
- hunt-spa-apielementalsouls/Claude-BugHunterDiscover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.InginerieFără avertismente★ 5,3 K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for resend.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignFără avertismente★ 4,4 K↓ —
- code-testing-extensionsdotnet/skillsProvides file paths to language-specific extension files for the code-testing pipeline. Read this reference-only catalog for extension guidance files (e.g., dotnet.md for .NET, cpp.md for C++). Agents and skills read its bundled files directly; do not invoke this catalog through the model's skill tool.TestareFără avertismente★ 5,7 K↓ —
- memory-managementThinkInAIXYZ/deepchatGuide the agent to recall, remember, and route durable learning into Memory, Skills, Scheduled Tasks, or Tape.ProductivitateFără avertismente★ 6,4 K↓ —
- designlang-tokensManavarya09/design-extractUse when styling UI for retool.com — references the extracted design system tokens instead of inventing colors, spacing, or typography.DesignFără avertismente★ 4,4 K↓ —
- bug-bountyelementalsouls/Claude-BugHunterComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gateSecuritateFără avertismente★ 5,3 K↓ —
- antislopmiqdadbadjuber/anti-slopAnti Slop: Rules for AI Coding Agents. The core filter. Load always to stop generic AI slop.InginerieFără avertismente★ 7,1 K↓ —
sql-injection-testing
zebbern/claude-code-guide
TestareActualizat alaltăieri
De la autor
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
Instalare
npx skills add zebbern/claude-code-guide --skill sql-injection-testing -a claude-code
Se instalează în .claude/skills/sql-injection-testing/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Descarcă .zip
Identic octet cu octet cu commit-ul scanat, cu licența depozitului și un fișier SOURCE.txt.
La ce are acces
Doar instrucțiuniNu am văzut acces la rețeaLicență: MIT
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 91
Securitate100
Proveniență84
Întreținere100
Licență100
Adopție58
Fișiere (1)
- SKILL.md