Skill-uri pentru agenți pe care le poți verifica înainte să le instalezi
Skill-uri SKILL.md publice din depozite GitHub cu peste 50 de stele și de la producători, scanate și evaluate. Instalează oricare dintre ele cu o singură comandă în Claude Code, Cursor, Codex, GitHub Copilot sau Gemini CLI.
47.966 de skill-uri din 2.309 depozite · actualizat acum 5 ore
47.966 de skill-uri
- trailmark-summarytrailofbits/skillsRuns a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.ProductivitateFără avertismente★ 7,9 K↓ —
- push-to-registryhashicorp/agent-skillsPush Packer build metadata to HCP Packer registry for tracking and managing image lifecycle. Use when integrating Packer builds with HCP Packer for version control and governance.OficialMediaFără avertismente★ 910↓ —
- skill-content-calendar-logZJU-REAL/Easel统一内容日历底座。记录每次发布（发布页/对话页均自动落库）、用户排期、平台活动/节日/特殊日期到 一个时间线，并供 Agent 规划前读回。当用户说"内容日历""日历里有什么""接下来发什么""这周发了啥" "把这个活动记到日历""最近的发布节奏""哪个平台该更新了"时触发。是发布时间线的权威底座， 与 skill-publish-log（指标底座）互补：本底座管"何时发什么/该做什么"，publish-log 管"每条数据表现"。ProductivitateFără avertismente★ 4,2 K↓ —
- offensive-cicd-pipelineSnailSploit/Claude-RedComprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persiDevOpsFără avertismente★ 9,9 K↓ —
- ramp-sdk-patternsjeremylongshore/tons-of-skills-marketplaceBuild a small typed Ramp Developer API adapter with secure token management, pagination, structured errors, rate control, idempotency, and schema drift checks. Use when replacing scattered raw requests in application code. Trigger with "Ramp API client" or "Ramp SDK patterns".InginerieFără avertismente★ 2,9 K↓ —
- offensive-cicd-secretsSnailSploit/Claude-RedComprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for using rDevOpsFără avertismente★ 9,9 K↓ —
- offensive-wpsSnailSploit/Claude-RedWPS (Wi-Fi Protected Setup) PIN attack methodology — Pixie Dust offline attack against vulnerable chipsets (Ralink, Realtek, Broadcom, MediaTek), online PIN brute-force with reaver/bully, lockout handling, time-of-day evasion, WPS push-button vulnerability windows, and PIN-to-PSK derivation. Use when a target SOHO router exposes WPS — common on consumer ISP gear, often left enabled by default even when WPS attacks have been known for over a decade.SecuritateFără avertismente★ 9,9 K↓ —
- anima-hello-worldjeremylongshore/tons-of-skills-marketplaceGenerate reviewable React or HTML code from a Figma design using the Anima SDK. Use when testing design-to-code conversion, learning Anima's code output format, or building your first automated design-to-code pipeline. Trigger with: "anima hello world", "anima example", "figma to react", "figma to code", "anima generate code".TestareFără avertismente★ 2,9 K↓ —
- gsd:quickdavepoon/buildwithclaudeExecute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agentsProductivitateFără avertismente★ 3,7 K↓ —
- offensive-sstiSnailSploit/Claude-RedDense description covering Server-Side Template Injection across Jinja2, Twig, Freemarker, Velocity, Pebble, Smarty, Mako, Handlebars, ERB, Thymeleaf, EJS, Pug. Engine fingerprinting, filter bypass, blind exploitation, WAF evasion, SSTI-to-RCE chains. Tools: tplmap. CWE-1336. MITRE T1190. Use when testing template rendering endpoints or exploiting template injection for code execution.TestareFără avertismente★ 9,9 K↓ —
- nvmolkit-usageNVIDIA/skillsUse when writing or debugging nvMolKit Python code for GPU-accelerated RDKit fingerprints, similarity, conformers, clustering, and molecular searches.RedactareFără avertismente★ 3,8 K↓ —
- principle-explain-the-numbermichael-denyer/pstack-claudeApply before you measure, and before you trust, report, or act on a number you measured: a speedup, a regression, a throughput, a latency, or an eval result. Find what limits it, and rule out that it measured something other than the work you think.AlteleFără avertismente★ 3,7 K↓ —
- chrome-mcp-troubleshootingtrailofbits/skillsDiagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.BrowserFără avertismente★ 7,9 K↓ —
- exa-load-scalejeremylongshore/tons-of-skills-marketplaceValidate Exa capacity with synthetic workload models, endpoint-specific budgets, bounded queues, and stop conditions. Use when operating or reviewing this Exa boundary. Trigger with "Exa load scale", "review Exa load scale", or "fix Exa load scale".PlanificareFără avertismente★ 2,9 K↓ —
- sxonowork-studio/notfair-pluginSearch Experience Optimization (SXO), the bridge between SEO and UX/CRO. Audits the journey from the SERP click to the on-page goal: click-through factors (title, meta, rich results), then post-click signals that keep users and drive conversions: above-the-fold relevance and intent match, page speed / Core Web Vitals, readability, clear CTAs, mobile usability, and what causes pogo-sticking back to Google. Use when the user has decent rankings but poor CTR or poor on-page conversion, wants better dwell time / engagement, less bounce, or a page experience aligned with search intent. Trigger on: "SXO", "search experience optimization", "good rankings but low CTR", "high bounce rate from search", "pogo-sticking", "improve dwell time", "SEO and conversion", "ranking but not converting", "engagement signals", "make this page convert search traffic". For pure landing-page conversion in ads use /google-ads-landing; for content quality use /seo-page.DesignFără avertismente★ 4,1 K↓ —
- short-drama-image-promptszenstory-ai/drama-skills为短剧人物、造型、地点、道具和状态编写或修改可直接复制的图片提示词 Markdown。用户提到角色设定图、三视图、参考图、场景板、道具图、风格帧、Look Development、状态变体或局部编辑提示词时使用；不生成图片，也不调用供应商。MediaFără avertismente★ 3,6 K↓ —Apare și în 1 alt depozit
- security-reviewerforyourhealth111-pixel/Vibe-SkillsDedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.SecuritateFără avertismente★ 3,8 K↓ —
- anima-rate-limitsjeremylongshore/tons-of-skills-marketplaceImplement rate limiting for Anima API code generation requests. Use when batching component generation, handling rate limit errors, or optimizing API throughput for large design systems. Trigger with: "anima rate limit", "anima throttling", "anima batch generation".DesignFără avertismente★ 2,9 K↓ —
- exa-observabilityjeremylongshore/tons-of-skills-marketplaceInstrument Exa calls with content-free metrics, traces, cost, and asynchronous lifecycle signals that support diagnosis without logging retrieved text. Use when operating or reviewing this Exa boundary. Trigger with "Exa observability", "review Exa observability", or "fix Exa observability".DevOpsFără avertismente★ 2,9 K↓ —
- audience-segment-builderaaron-he-zhu/aaron-marketing-skillsUse when the user asks to "build audience segments from my customer list", "make value-based / lookalike seed lists", "set up exclusion / suppression segments", or "map audiences to funnel stages across platforms"; turns the user's OWN customer/CRM/GA4 export into seed audiences, value-based lookalike SEED lists, exclusion/suppression segments, and a cross-platform funnel-stage targeting map, informing the ROAS A (Audience) dimension. Not for building account structure or match types — use campaign-architect; not for organic SERP intent — use keyword-research. 付费广告受众分群/种子人群/排除人群/相似人群种子ȘtiințăFără avertismente★ 3 K↓ —
- validate-skillmdjeremylongshore/tons-of-skills-marketplaceValidate and grade SKILL.md files with the marketplace rubric, static production checks, and optional J-Rig behavioral evidence. Use when creating a skill, checking quality, preparing a marketplace submission, or reviewing evaluation results. Trigger with "validate this skill", "grade my skill", "deep eval", "check SKILL.md", or "/validate-skillmd".AlteleFără avertismente★ 2,9 K↓ —
- server-actionsdavepoon/buildwithclaudeThis skill should be used when the user asks about "Server Actions", "form handling in Next.js", "mutations", "useFormState", "useFormStatus", "revalidatePath", "revalidateTag", or needs guidance on data mutations and form submissions in Next.js App Router.AlteleFără avertismente★ 3,7 K↓ —
- adjudicate-regressiontrailofbits/skillsUse when deciding whether source and live reproduction evidence establish a new regression or an exclusion.AlteleFără avertismente★ 7,9 K↓ —
- validate-pluginjeremylongshore/tons-of-skills-marketplaceValidate a Claude Code plugin directory against the official Anthropic spec and Intent Solutions enterprise standard. Runs structural validation (plugin.json fields, file references, permissions) and content validation (SKILL.md grading, command/agent frontmatter). Use when building a new plugin, preparing for marketplace submission, or auditing existing plugins. Trigger with "validate this plugin", "check plugin structure", "grade my plugin", "/validate-plugin".PlanificareFără avertismente★ 2,9 K↓ —
trailmark-summary
trailofbits/skills
ProductivitateActualizat alaltăieri
De la autor
Runs a Trailmark summary analysis on a codebase. Returns auto-detected languages, entry point count, and dependency list. Use when vivisect or galvanize needs a quick structural overview. Triggers: trailmark summary, code summary, structural overview.
Instalare
npx skills add trailofbits/skills --skill trailmark-summary -a claude-code
Se instalează în .claude/skills/trailmark-summary/ · Fiecare comandă descarcă skill-ul direct de pe GitHub cu utilitarul open source skills.
Fără descărcare: licența acestui skill (CC-BY-SA-4.0) nu ne permite să-i redistribuim fișierele. Comenzile de instalare le iau direct de pe GitHub.
La ce are acces
Doar instrucțiuniFolosește rețeauaLicență: CC-BY-SA-4.0
Verificări de siguranță pe SKILL.md
Niciun avertisment.
De ce 90
Securitate100
Proveniență87
Întreținere100
Licență80
Adopție61
Fișiere (3)
- SKILL.md
- agents/openai.yaml
- assets/trail-of-bits-mark.svg