Awesome Agent Skills
Unlike many bulk-generated skill repositories, this collection focuses on real-world Agent Skills created and used by actual engineering teams, not mass AI‑generated stuff.
Compatible with Claude Code, Codex, Antigravity, Gemini CLI, Cursor, GitHub Copilot, OpenCode, Windsurf, and more. See the table below for paths and documentation.
The most contributed Agent Skills repository, built and maintained together with the community.
💛 Sponsors
| |
|---|
| TestMu AI (formerly LambdaTest) is an AI-native testing cloud platform built for modern engineering teams. Covering everything from autonomous test creation and fast execution to testing AI agents, chatbots and voice assistants. |
| Crawlbase is web data infrastructure trusted by 70,000+ developers. Its Crawling API, MCP server, and integrations give AI agents live access to any webpage — with JavaScript rendering, proxy rotation, and anti-bot protection. |
| SerpApi is a Web Search API for your AI apps. Available in Markdown and JSON for any integration. |
AI Design + Build Ecosystem Tools
You ship products with AI, but every launch still dies quietly because nobody posts about it. EveryFeed plugs your AI assistant into a social workspace that drafts, schedules, and publishes across 35+ channels — no agency, no marketing hire.
Table of Contents
Official Skills by
Official skills by VoltAgent for building AI agents with the VoltAgent TypeScript framework.
Official skills by the SerpApi team — the Web Search API for AI apps. They give agents structured, machine-readable search data through 130+ engines, from Google web and Scholar to Maps, Flights, Hotels, and Shopping.
- serpapi/serpapi-web-search - Structured search data via 130+ engines: pick the right engine, extract the right keys, recover from errors
- serpapi/agent-usability-test - Test whether agents can discover and use your tool — the subject under test is the interface, not the agent
More from SerpApi (not skills, but they pair with them):
Official skills by the Crawlbase team that give AI agents live web access through the Crawlbase MCP server: crawl any URL as raw HTML, clean Markdown, or a screenshot, and manage results in Crawlbase Cloud Storage.
More from Crawlbase (not skills, but they pair with them):
Production-grade Agent Skills for every major test automation framework, maintained by the TestMu AI (formerly LambdaTest) team. They help AI coding assistants generate expert-level test automation code across web, mobile, API, BDD, and unit testing stacks.
- testmu-ai/api-skill - Suite of API skills for designing, mocking, documenting, securing, and generating tests for REST/GraphQL/gRPC APIs
- testmu-ai/appium-skill - Generate Appium mobile automation for Android and iOS in Java, Python, or JS
- testmu-ai/behat-skill - Generate Behat BDD tests for PHP with Gherkin and Mink
- testmu-ai/behave-skill - Generate Behave BDD tests for Python with Gherkin and step implementations
- testmu-ai/capybara-skill - Generate Capybara E2E tests in Ruby with RSpec integration
- testmu-ai/cicd-pipeline-skill - Generate CI/CD pipelines for tests on GitHub Actions, Jenkins, GitLab CI, and Azure DevOps
- testmu-ai/codeception-skill - Generate Codeception acceptance, functional, and unit tests in PHP
- testmu-ai/cucumber-skill - Generate Cucumber BDD tests with Gherkin and step definitions in Java, JS, or Ruby
- testmu-ai/cypress-skill - Generate Cypress E2E and component tests in JavaScript or TypeScript
- testmu-ai/detox-skill - Generate Detox gray-box E2E tests for React Native apps in JavaScript
- zero/zero - Discover and call external paid tools for Claude Code agents instead of stopping to ask the user to sign up or fetch an API key
- zero/zero-gemini - Same Zero tool-discovery and payment layer packaged as a Gemini CLI extension
- typefully/typefully - Create, schedule, and publish social media content across X, LinkedIn, Threads, Bluesky, and Mastodon
Official skills by Venice.ai for the Venice API.
- veniceai/venice-api-overview - API basics, auth modes, pricing, and versioning
- veniceai/venice-auth - API keys and wallet-based Venice authentication
- veniceai/venice-chat - Chat completions, multimodal inputs, tools, and streaming
- veniceai/venice-responses - OpenAI-compatible Responses API for Venice
- veniceai/venice-embeddings - Embeddings models, dimensions, and encoding formats
- veniceai/venice-image-generate - Image generation endpoints and available styles
- veniceai/venice-image-edit - Image edits, upscaling, and background removal
- veniceai/venice-audio-speech - Text-to-speech models, voices, formats, and streaming
- veniceai/venice-audio-music - Music generation queueing, retrieval, and completion endpoints
- veniceai/venice-audio-transcription - Audio transcription models and speech-to-text options
- veniceai/venice-video - Video generation and transcription workflows
- cloudflare/agents-sdk - Build stateful AI agents with scheduling, RPC, and MCP servers
- cloudflare/cloudflare - Comprehensive Cloudflare platform skill covering Workers, Pages, storage, AI, networking, security, and IaC
- cloudflare/cloudflare-email-service - Send transactional email and route inbound mail with Cloudflare Email Sending and Email Routing
- cloudflare/durable-objects - Stateful coordination with RPC, SQLite, and WebSockets
- cloudflare/sandbox-sdk - Build sandboxed applications for secure, isolated code execution on Workers
- cloudflare/web-perf - Audit Core Web Vitals and render-blocking resources
- cloudflare/workers-best-practices - Review and author Workers code against production best practices and wrangler.jsonc conventions
- cloudflare/wrangler - Deploy and manage Workers, KV, R2, D1, Vectorize, Queues, Workflows
- cloudflare/security-audit-skill - Multi-phase security audits with independently verified, machine-readable findings
Agent Skills for the Stitch MCP server, compatible with Claude Code, Gemini CLI, Cursor, and more.
Official Google Workspace CLI skills for managing Google Workspace services via the gws CLI tool.
Official AI agent skills from the Expo team for building, deploying, and debugging Expo apps.
Official AI agent skills from the Hugging Face team for ML workflows.
- getsentry/sentry-sdk-setup - Set up Sentry in any language or framework — detects platform and routes to the right SDK
- getsentry/sentry-workflow - End-to-end Sentry workflow: fix production issues and review code with Sentry context
- getsentry/sentry-fix-issues - Find and fix Sentry issues with stack trace, breadcrumb, and trace context via MCP
- getsentry/sentry-code-review - Review code changes using Sentry issue and trace context
- getsentry/sentry-pr-code-review - Review PR comments from Seer Bug Prediction and Sentry feedback
- getsentry/sentry-create-alert - Create Sentry alerts with email, Slack, PagerDuty, Discord, and more
- getsentry/sentry-feature-setup - Configure advanced Sentry features: AI monitoring, OTel pipelines, and alerts
- getsentry/sentry-otel-exporter-setup - Configure the OpenTelemetry Collector with Sentry Exporter
- getsentry/sentry-setup-ai-monitoring - Instrument OpenAI, Anthropic, Vercel AI, LangChain, Google GenAI, and Pydantic AI
- getsentry/sentry-sdk-upgrade - Upgrade the Sentry JavaScript SDK across major versions
Domain-specific knowledge for Azure SDK and Microsoft AI Foundry development. 133 skills across 6 languages.
Core Skills
.NET Skills
Java Skills
Python Skills
Rust Skills
TypeScript Skills
- WordPress/wordpress-router - Classifies WordPress repos and routes to the right workflow
- WordPress/wp-project-triage - Detects project type, tooling, and versions automatically
- WordPress/wp-block-development - Gutenberg blocks: block.json, attributes, rendering, deprecations
- WordPress/wp-block-themes - Block themes: theme.json, templates, patterns, style variations
- WordPress/wp-plugin-development - Plugin architecture, hooks, settings API, security
- WordPress/wp-rest-api - REST API routes/endpoints, schema, auth, and response shaping
- WordPress/wp-interactivity-api - Frontend interactivity with data-wp-* directives and stores
- WordPress/wp-abilities-api - Capability-based permissions and REST API authentication
- WordPress/wp-wpcli-and-ops - WP-CLI commands, automation, multisite, search-replace
- WordPress/wp-performance - Profiling, caching, database optimization, Server-Timing
- WordPress/wp-phpstan - PHPStan static analysis for WordPress projects
Official curated skills from OpenAI's skills repository.
- openai/cloudflare-deploy - Deploy apps to Cloudflare using Workers, Pages, and platform services
- openai/develop-web-game - Build and test web games iteratively using Playwright with time-stepping
- openai/doc - Read, create, and edit .docx documents with formatting and layout fidelity
- openai/gh-address-comments - Address review and issue comments on open GitHub PRs via CLI
- openai/gh-fix-ci - Debug and fix failing GitHub Actions PR checks using log inspection
- openai/imagegen - Generate and edit images using OpenAI's Image API for projects
- openai/jupyter-notebook - Create clean, reproducible Jupyter notebooks for experiments and tutorials
- openai/linear - Manage issues, projects, and team workflows in Linear
- openai/netlify-deploy - Automate Netlify deployments with CLI auth, linking, and environment support
- openai/notion-knowledge-capture - Convert conversations into structured, searchable Notion wiki entries
- openai/notion-meeting-intelligence - Prep meetings by pulling Notion context and tailoring agendas
Official skills from Figma's MCP server guide.
Official marketing skills by Corey Haines, covering the full SaaS marketing stack from SEO and copywriting to growth, CRO, and paid acquisition.
Direct-response advertising skills by Kim Barrett, organized into foundations, copy-chief, operator-os, orchestrators, and QA — covering avatar work, offer design, Schwartz-style copywriting, creative testing, and full-funnel campaign orchestration.
Official Web3 and trading skills from the Binance team. Includes crypto market data, on-chain analytics, token security auditing, and spot trading via the Binance API.
- binance/crypto-market-rank - Query crypto market rankings including trending tokens, smart money inflows, meme rankings, and top trader PnL leaderboards
- binance/meme-rush - Track real-time meme token lists from launchpads (Pump.fun, Four.meme) and AI-powered hot market topics ranked by net inflow
- binance/query-address-info - Retrieve all token holdings and portfolio positions for any wallet address on BSC, Base, or Solana
- binance/query-token-audit - Audit token security to detect scams, honeypots, and malicious contracts across BSC, Base, Solana, and Ethereum
- binance/query-token-info - Search tokens and fetch metadata, real-time market data, and K-Line candlestick charts by keyword or contract address
- binance/trading-signal - Monitor on-chain Smart Money buy/sell signals with price, max gain, and exit rate data on Solana and BSC
- binance/spot - Place and manage spot trading orders on Binance via API key authentication, supporting mainnet and testnet
Official skills from the Apollo GraphQL team for building GraphQL clients, servers, federated supergraphs, and the Apollo Router.
Official authentication and identity skills from the Auth0 team. Covers SDKs for popular frameworks plus workflows for MFA, migration, and quickstart detection.
Official skills from the Brave team for accessing Brave Search APIs including web, images, videos, news, and local point-of-interest data.
Official browser automation skills from the Browserbase team. Covers headless browsing, cookie sync, serverless functions, and adversarial UI testing.
Official AI code review skills from the CodeRabbit team.
Official wallet, payments, and trading skills from the Coinbase team. Covers USDC transfers, onchain queries, x402 paid APIs, and Base trading.
Observability skills from Datadog Labs for APM, logs, monitors, and LLM observability workflows powered by the pup CLI.
Official skills from the Firebase team for setup, auth, Firestore, hosting, Genkit AI SDKs, and security rule auditing.
Official skills from the Flutter team covering layouts, state, navigation, native interop, platform setup, and testing for cross-platform Flutter apps.
46 battle-tested product management skills by Dean Peters. Frame problems, hunt opportunities, scaffold validation experiments, and kill bad bets fast — with frameworks from Teresa Torres, Geoffrey Moore, Amazon, MITRE, and more.
Component Skills
Interactive Skills
Workflow Skills
65 product management skills by Paweł Huryn, creator of The Product Compass newsletter. Covers the full PM lifecycle — from discovery and strategy to execution, analytics, and go-to-market — with frameworks from Teresa Torres, Geoffrey Moore, and more.
Data Analytics
Execution
Go-to-Market
Market Research
- phuryn/competitor-analysis - Analyze competitors with strengths, weaknesses, and differentiation
- phuryn/customer-journey-map - Map customer journeys with touchpoints, emotions, and opportunities
- phuryn/market-segments - Identify 3-5 customer segments with JTBD and product fit
- phuryn/market-sizing - Estimate TAM, SAM, SOM with top-down and bottom-up approaches
- phuryn/sentiment-analysis - Analyze user feedback with sentiment scores and JTBD insights
- phuryn/user-personas - Create 3 user personas with JTBD, pains, and gains
- phuryn/user-segmentation - Segment users by behavior, JTBD, and needs from feedback data
Marketing & Growth
Product Discovery
Product Strategy
Toolkit
11 development and document generation skills from the MiniMax AI team. Covers frontend, fullstack, mobile, shader development, document creation (PDF, DOCX, XLSX, PPTX), and the MiniMax AI CLI with MiniMax API integration.
- MiniMax-AI/cli - Generate text, image, video, speech, and music via MiniMax AI
- MiniMax-AI/frontend-dev - Full-stack frontend with cinematic animations, AI-generated media via MiniMax API, and generative art
- MiniMax-AI/fullstack-dev - Backend architecture with REST API design, auth flows, real-time features, and database integration
- MiniMax-AI/android-native-dev - Android native development with Kotlin/Jetpack Compose, Material Design 3, and accessibility
- MiniMax-AI/ios-application-dev - iOS development with UIKit, SnapKit, and SwiftUI covering navigation, Dark Mode, and HIG compliance
- MiniMax-AI/shader-dev - GLSL shader techniques for ray marching, fluid simulation, particle systems, and procedural generation
- MiniMax-AI/gif-sticker-maker - Convert photos into animated GIF stickers in Funko Pop / Pop Mart style via MiniMax API
- MiniMax-AI/minimax-pdf - Generate, fill, and reformat PDFs with a token-based design system and 15 cover styles
- MiniMax-AI/pptx-generator - Create and edit PowerPoint presentations from scratch with PptxGenJS
- MiniMax-AI/minimax-xlsx - Create, read, analyze, and validate Excel/spreadsheet files with zero format loss
Official DuckDB skills for data querying, file reading, and documentation search directly from Claude Code.
- duckdb/attach-db - Attach a DuckDB database file for interactive querying with automatic schema exploration
- duckdb/query - Run SQL queries against attached databases or ad-hoc against files using Friendly SQL dialect
- duckdb/read-file - Read any data file (CSV, JSON, Parquet, Avro, Excel, spatial) locally or from remote storage
- duckdb/duckdb-docs - Search DuckDB and DuckLake documentation using full-text search over HTTPS
- duckdb/read-memories - Search past Claude Code session logs to recover context from previous conversations
- duckdb/install-duckdb - Install or update DuckDB CLI and extensions with version management
Official GSAP animation skills covering the full GreenSock ecosystem — core API, timelines, ScrollTrigger, plugins, utilities, React integration, performance optimization, and framework support.
- greensock/gsap-core - Core API with gsap.to(), from(), fromTo(), easing, duration, stagger, and defaults
- greensock/gsap-timeline - Timelines with sequencing, position parameter, labels, nesting, and playback control
- greensock/gsap-scrolltrigger - ScrollTrigger for scroll-linked animations, pinning, scrub, and refresh handling
- greensock/gsap-plugins - Plugins including ScrollToPlugin, Flip, Draggable, SplitText, SVG, and physics
- greensock/gsap-utils - Utility functions like clamp, mapRange, interpolate, snap, selector, and wrap
- greensock/gsap-react - React integration with useGSAP hook, refs, gsap.context(), cleanup, and SSR
- greensock/gsap-performance - Performance tips for transforms, will-change, batching, and ScrollTrigger optimization
- greensock/gsap-frameworks - Vue, Svelte, and other frameworks with lifecycle, scoping, and cleanup patterns
28 skills by Garry Tan (Y Combinator CEO) that transform Claude Code into a virtual engineering team — structured workflows from ideation to production deployment. Ships 600K+ lines of production code in 60 days.
- garrytan/office-hours - YC Office Hours: six forcing questions that reframe your product before you write code
- garrytan/plan-ceo-review - CEO/Founder plan review with four modes: Expansion, Selective Expansion, Hold Scope, Reduction
- garrytan/plan-eng-review - Eng Manager review: lock in architecture, data flow, diagrams, edge cases, and tests
- garrytan/plan-design-review - Senior Designer review: rates each design dimension 0-10, explains what a 10 looks like, AI Slop detection
- garrytan/design-consultation - Build a complete design system from scratch with creative risks and realistic product mockups
- garrytan/design-review - Designer Who Codes: visual audit then fixes with atomic commits and before/after screenshots
- garrytan/review - Staff Engineer code review: finds bugs that pass CI but blow up in production
- garrytan/investigate - Systematic root-cause debugging: no fixes without investigation, traces data flow, tests hypotheses
- garrytan/qa - QA Lead: test your app, find bugs, fix them with atomic commits, auto-generate regression tests
- garrytan/qa-only - QA Reporter: same methodology as /qa but report only, no code changes
Official skills from Notion's repositories — workspace-aware skills for capturing knowledge, preparing meetings, researching, and turning specs into tasks.
From notion-cookbook:
From claude-code-notion-plugin:
Official Resend skills to send and receive emails, build email templates and power your agent with email expertise.
Lighthouse-style web quality skills from Addy Osmani(Google Chrome team) covering performance, Core Web Vitals, accessibility, SEO, and modern best practices — the same pillars Google Lighthouse audits.
- addyosmani/web-quality-audit - Comprehensive quality review across performance, accessibility, SEO, and best practices categories
- addyosmani/performance - Loading speed, runtime efficiency, and resource optimization
- addyosmani/core-web-vitals - LCP, INP, and CLS-specific optimizations
- addyosmani/accessibility - WCAG compliance, screen reader support, and keyboard navigation
- addyosmani/seo - Search engine optimization, crawlability, and structured data
- addyosmani/best-practices - Security, modern web APIs, and code quality patterns
Official MongoDB Agent Skills for agentic workflows — connection management, schema design, query optimization, natural language querying, and Atlas Stream Processing.
- redis/redis-core - Redis development best practices — data structures, query engine, vector search, caching, and performance optimization.
Official skills published by NVIDIA for its AI, accelerated computing, robotics, simulation, and developer platforms. NVIDIA updates and reorganizes this catalog frequently, so this list links to the maintained source instead of duplicating a snapshot.
Official Google Cloud skills covering Firebase, BigQuery, Cloud Run, GKE, AlloyDB, Cloud SQL, Gemini Enterprise Agent Platform, networking observability, and the Well-Architected Framework. 19 skills.
Extend the power of AI across your organization with a curated library of skills, agents, and MCP servers—all backed by your Red Hat subscription. Whether you’re an SRE optimizing workflows in Cursor or an architect building intelligent interfaces, leverage trusted building blocks to deploy and scale agentic automation with confidence.
-
redhat/cve-skillpack - Understand CVEs, check product lifecycle status, gather diagnostics, and file support cases at the right severity — essential Red Hat skills for everyday operations.
-
redhat/sre-skillpack - Discover, remediate, and verify CVEs across your RHEL fleet — orchestrating Red Hat Lightspeed and Ansible Automation Platform through a single workflow.
-
redhat/openshift-skillpack - Provision, inventory, and report on OpenShift clusters — spanning Assisted Installer, OCM, ROSA, ARO, and kubeconfig fleets — through a single conversational workflow.
-
redhat/openshift-virtualization - Manage the full VM lifecycle on OpenShift Virtualization — create, clone, snapshot, restore, rebalance, and report — through a single conversational workflow.
Official skills published by Cypress to help create, maintain, understand, and fix your Cypress tests. 3 skills.
Community Skills
- qdrant/skills - Agent skills for Qdrant vector search, covering scaling, performance optimization, search quality, monitoring, deployment, model migration, version upgrades, and SDK usage across Python, TypeScript, Rust, Go, .NET, and Java
- zilliztech/milvus-skill - Manage Milvus collections, indexes, vector searches, and RAG workflows
- BrianRWagner/ai-marketing-claude-code-skills - 17 marketing frameworks for cold outreach, homepage audit, social cards, and more
- AgriciDaniel/claude-seo - Universal SEO skill for comprehensive website analysis and optimization
- wshuyi/x-article-publisher-skill - Publish articles to X/Twitter
- CosmoBlk/email-marketing-bible - 55K-word email marketing guide as an AI skill
- smixs/creative-director-skill - AI creative director with recursive self-assessment: 20+ methodologies (SIT, TRIZ, Bisociation, SCAMPER, Synectics), 3-axis evaluation calibrated against Cannes/D&AD/HumanKind, 5-phase process from brief to presentation
- Xquik-dev/x-twitter-scraper - Tweet search, profile tweets, follower export, media, posting, replies, MCP
- Xquik-dev/tweetclaw - Post tweets, replies, DMs; search, monitor, run giveaways
- SHADOWPR0/beautiful_prose - Hard-edged writing style contract for timeless, forceful English prose without AI tics
- blader/humanizer - Remove signs of AI-generated writing from text, making it sound more natural and human
- MohamedAbdallah-14/unslop - Removes named AI writing tells (tricolons, em-dash pileups, hedging stacks, sycophancy openers, stock vocab like "delve"/"crucial"). Split lint/rewrite modes for auditing your own text without auto-rewriting. Five intensity levels, MIT
-
VoDaiLocz/kilo-kit-mcp - Comprehensive library of 177 curated skills paired with an MCP runtime enforcing protocol-level C4 workflow gates, hard-gated command execution with security guardrails, and 5 cognitive reasoning engines (Tree of Thoughts DAG, Adversarial Grilling, 5-Whys Root Cause Tracer, Context Compactor, Self-Evolution) for Claude Code, Cursor, Antigravity, and Codex
-
hedralab/eskill - Meta-skill to build top-tier Agent Skills: spec-compliant SKILL.md, eval loop, validator, market research, numbered-file pipeline
-
robzolkos/skill-rails-upgrade - Analyze Rails apps and provide upgrade assessments
-
antonbabenko/terraform-skill - Terraform and OpenTofu patterns: testing, modules, state, CI/CD.
-
zxkane/aws-skills - AWS development with infrastructure automation and cloud architecture patterns
-
Rootly-AI-Labs/rootly-incident-responder - AI-powered incident response with ML similarity matching, solution suggestions, and on-call coordination. Requires Rootly MCP Server
-
conorluddy/ios-simulator-skill - Control iOS Simulator
-
ramzesenok/iOS-Accessibility-Audit-Skill - Audit iOS App against Accessibility norms
-
truongduy2611/app-store-preflight-skills - Scan iOS/macOS projects to catch common mistakes that lead to App Store rejection before submission
- muratcankoylan/context-fundamentals - Understand what context is, why it matters, and the anatomy of context in agent systems
- muratcankoylan/context-degradation - Recognize patterns of context failure: lost-in-middle, poisoning, distraction, and clash
- muratcankoylan/context-compression - Design and evaluate compression strategies for long-running sessions
- muratcankoylan/context-optimization - Apply compaction, masking, and caching strategies
- muratcankoylan/multi-agent-patterns - Master orchestrator, peer-to-peer, and hierarchical multi-agent architectures
- muratcankoylan/memory-systems - Design short-term, long-term, and graph-based memory architectures
- muratcankoylan/tool-design - Build tools that agents can use effectively, including architectural reduction patterns
- muratcankoylan/evaluation - Build evaluation frameworks for agent systems
- k-kolomeitsev/data-structure-protocol - Graph-based long-term memory skill for AI (LLM) coding agents — faster context, fewer tokens, safer refactors
- ZeKaiNie/universal-examprep-skill - Multimodal grounded active-learning tutor for college textbooks (PDF/PPTX/DOCX). Features native PDF vector diagram cropping (
pypdfium2), real homework quiz banks, hard exit-code anti-hallucination, and persistent cross-session state. Tested on 1,000+ pages of real college courseware on small cheap models.
- shouldnotappearcalm/a-share-skill - China A-share (Shanghai/Shenzhen) skills: real-time quotes, K-line history, technical indicators, events, capital flows, sector heatmaps, and paper trading. Works with Claude Code, Cursor, Codex, and Qoder
- transloadit/skills - Transloadit skill collection (6)
- honeydew-ai/honeydew-ai-coding-agents-plugins - 11 skills for the Honeydew semantic layer over Snowflake, Databricks, and BigQuery: model exploration, entity/relation/attribute/metric/context/domain creation, validation, query, filtering, and workspace branching
- raintree-technology/hig-doctor - Apple Human Interface Guidelines as 14 agent skills covering platforms, foundations, components, patterns, inputs, and technologies for iOS, macOS, visionOS, watchOS, and tvOS
- K-Dense-AI/scientific-agent-skills - Scientific research and analysis skills
- NotMyself/claude-win11-speckit-update-skill - Windows 11 system management
- sanjay3290/imagen - Generate images using Google Gemini's API
- SHADOWPR0/security-bluebook-builder - Build security Blue Books for sensitive apps
🔒 Security Notice
Skills in this list are curated, not audited. They may be updated, modified, or replaced by their original maintainers at any time after being added here.
Before installing or using any Agent Skill, review potential security risks and validate the source yourself.
Recommended tools:
Agent skills can include prompt injections, tool poisoning, hidden malware payloads, or unsafe data handling patterns. Always review the code and use skills at your own discretion.
Skills Paths for Other AI Coding Assistants
Skill Quality Standards
As the ecosystem grows, consistent quality helps agents discover and use skills reliably. The following references and criteria keep the bar high.
Quality Criteria
| Area | Guideline |
|---|
| Description | Write in third person. State what the skill does and when to use it. Use specific keywords agents can match on (e.g., "PostgreSQL migration" not "database stuff"). |
| Progressive disclosure | Keep top-level metadata under ~100 tokens. Skill body should stay below 500 lines. Load resources (large docs, schemas) on demand, not inline. |
| No absolute paths | Never hard-code machine-specific paths like /Users/alice/. Use relative paths or well-known variables ($HOME, $PROJECT_ROOT). |
| Scoped tools | Request only the tools the skill actually needs. Avoid blanket "tools": ["*"]. Declare tool dependencies explicitly. |
🤝 Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
- Submit new skills via PR
- Improve existing definitions
Note: Please don't submit skills you created 3 hours ago. We're now focusing on community-adopted skills, especially those published by development teams and proven in real-world usage. Quality over quantity.
Contributor ♥️ Thanks
License
MIT License - see LICENSE
This is a curated list. Skills listed here are created and maintained by their respective authors and teams, not by us. We select community-adopted, proven skills and do not audit, endorse, or guarantee the security or correctness of listed projects. They are not security-audited and should be reviewed before production use.
If you find an issue with a listed skill or want your skill removed, please open an issue and we'll take care of it promptly.
