SkillsAdd

Install skills for AI.
Extend your AI agent.

A local directory of open agent skills — ranked, searchable, and one command away.

How to install Browse ranked skills

Catalog324,895

Summaries320,711

With docs109,090

Ranked9,730

Topics

Agent workflows 125,511 Design & UI 81,335 Testing 28,140 Docs & files 15,373 Databases 8,443 React 7,147 Marketing 6,034 Azure 3,589

Ranked skills

All Official With docs

#

Skill

Source

8W Activity

Installs

git-commit-push Commit changes and push to origin without creating a PR

zc277584121/mygitplugin

cmdi-command-injection >- Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pi…

yaklang/hack-skills

format-string-exploitation >- Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enab…

yaklang/hack-skills

user-onboarding Onboarding script for first-time Starchild users: positioning, quick wins, discovery. Use when the user is new or vag…

starchild-ai-agent/official-skills

xxe-xml-external-entity >- XXE playbook. Use when XML, SVG, OOXML, SOAP, or parser-driven imports may resolve external entities, files, or in…

yaklang/hack-skills

logo-creator Create logos using AI image generation. Discuss style/ratio, generate variations, iterate with user feedback, crop, r…

resciencelab/opc-skills

graphql-and-hidden-parameters >- GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hi…

yaklang/hack-skills

file-access-vuln >- Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, lo…

yaklang/hack-skills

benchmark-methodology >- Use after competitive-platform-analysis has produced a tiered competitor set. Scores each competitor across nine w…

ssti-server-side-template-injection >- SSTI playbook. Use when template expressions, server-side rendering, preview features, or templating engines may e…

yaklang/hack-skills

knip Run knip to find and remove unused files, dependencies, and exports. Use for cleaning up dead code and unused depende…

brianlovin/agent-config

limrun-gradle Build an Android app on a remote Gradle sandbox with `lim gradle build` instead of local Gradle or Android Studio, fr…

limrun-inc/skills

kernel-exploitation >- Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type con…

yaklang/hack-skills

agent-self-evaluation Use after completing any non-trivial task. The agent self-rates its output on 5 axes — accuracy, completeness, clarit…

deserialization-insecure >- Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via Objec…

yaklang/hack-skills

convex-schema-validator Defining and validating database schemas with proper typing, index configuration, optional fields, unions, and migrat…

waynesutton/convexskills

http-parameter-pollution >- HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app fr…

yaklang/hack-skills

platform-widget-generate Use this skill to author a complete HXL WidgetBundle (UEM body + schema.json + -meta.xml). TRIGGER when: user asks fo…

forcedotcom/sf-skills

m10-performance CRITICAL: Use for performance optimization. Triggers: performance, optimization, benchmark, profiling, flamegraph, cr…

actionbook/rust-skills

browser-exploitation-v8 >- Browser and V8 exploitation playbook. Use when exploiting JavaScript engine vulnerabilities including JIT type con…

yaklang/hack-skills

authsome Use this to access external services/CLIs/APIs: Gmail/gh/Github/Stripe etc. or when running any bash command, script,…

agentrhq/authsome

ads-math Calculate and model paid-media CPA, CPL, CPC, CPM, ROAS, MER, break-even targets, contribution margin, LTV:CAC, impre…

agricidaniel/claude-ads

flight-ticket-search Google Flights 공개 검색 표면을 무료로 조회해 항공권 후보, 예약 검색 링크, 날짜/월/연도별 최저가·평균가 비교를 보수적…

nomadamas/k-skill

git-commit-pr Commit changes and create a pull request to the official upstream repo

zc277584121/mygitplugin

council Gather independent views on a high-stakes judgment. Not for one-judge plan challenge; that is premortem. Triggers: "c…

boshu2/agentops

race-condition >- Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-…

yaklang/hack-skills

request-smuggling >- HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree wit…

yaklang/hack-skills

symbolic-execution-tools >- Symbolic execution and constraint solving playbook. Use when solving CTF reversing challenges, recovering keys, by…

yaklang/hack-skills

open-redirect >- Open redirect playbook. Use when URL parameters, form actions, or JavaScript sinks control navigation targets and …

yaklang/hack-skills

csp-bypass-advanced >- Advanced Content Security Policy bypass techniques. Use when XSS or data exfiltration is blocked by CSP and you ne…

yaklang/hack-skills

html-plan Direct-invocation specialist for clear, self-contained HTML plans that preserve source material while improving hiera…

plannotator/effective-html

competitive-platform-analysis >- Use when scoping a competitive landscape — identifying, categorising, and score-filtering a competitor set before …

ce-debug Diagnosis loop for bugs and failing behavior. Use when asked to debug or fix failing or slow behavior.

everyinc/compound-engineering-plugin

insecure-source-code-management >- Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidd…

yaklang/hack-skills

iot Create IoT architecture diagrams using PlantUML syntax with device and sensor stencil icons. Best for smart home, ind…

markdown-viewer/skills

crlf-injection >- CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values,…

yaklang/hack-skills

web-cache-deception >- Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitiv…

yaklang/hack-skills

agentforce-bot-upgrade Use this skill to Upgrade Einstein Bots into Agentforce agents end-to-end in a single pass, orchestrating per-bot Age…

forcedotcom/sf-skills

intercity-bus-booking Search and assist Korean 시외버스/Tmoney bookings using official HTTP/API-first flows; use for 시외버스 예매, 시간표,…

nomadamas/k-skill

dependency-confusion >- Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-con…

yaklang/hack-skills

screenshot-optimization When the user wants to design, optimize, or evaluate App Store screenshots and preview videos.

eronred/aso-skills

git-summarize-weekly Summarize weekly GitHub contributions for writing weekly reports

zc277584121/mygitplugin

git-fork-clone Fork a GitHub repo and clone it locally with proper remote setup

zc277584121/mygitplugin

mobile-ssl-pinning-bypass >- Mobile SSL pinning bypass playbook. Use when intercepting HTTPS traffic from mobile applications that implement ce…

yaklang/hack-skills

avoid-ai-writing Audit and rewrite content to remove AI writing patterns ("AI-isms").

conorbronsdon/avoid-ai-writing

git-get-notification Check GitHub notifications and recent Issues/PRs for monitored repos

zc277584121/mygitplugin

expression-language-injection >- Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-co…

yaklang/hack-skills

http-host-header-attacks >- HTTP Host header injection and routing abuse playbook. Use when the application trusts the Host header for generat…

yaklang/hack-skills

git-sync-main Sync local main branch with the latest code from official upstream or origin remote

zc277584121/mygitplugin

owasp-security Implement secure coding practices following OWASP Top 10.

hoodini/ai-agents-skills