Skill catalog
12,157agent skills synced from skills.sh, with their install counts. Read them here, or let your agent fetch the right one through the Graph-of-Skills MCP server.
Want your agent to use these? Set up Graph-of-Skills
or get a free key.
How these skills are sourced and what we check.
Cannot find one? Your agent can write a skill for your own library.
Have skills of your own? Install one on another machine.
A skill that comes from GitHub shows its npx skills add command on its page.
- dry-refactoring kucherenko/jscpd
Guided workflow to eliminate copy-paste duplication detected by jscpd. Refactor exact, renamed and near-miss clones using extract function, parameterize, module, constant, or base class strategies, starting from the hot…
3,659 installs - alarmkit dpearson2699/swift-ios-skills
Implement AlarmKit alarms and countdown timers for iOS and iPadOS with Lock Screen, Dynamic Island, StandBy, and paired Apple Watch system UI. Covers AlarmManager scheduling, AlarmAttributes and AlarmPresentation, syste…
3,658 installs - dependency-confusion yaklang/hack-skills
Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/C…
3,657 installs - sentry-nextjs-sdk getsentry/sentry-for-ai
Full Sentry SDK setup for Next.js. Use when asked to "add Sentry to Next.js", "install @sentry/nextjs", or configure error monitoring, tracing, session replay, logging, profiling, AI monitoring, or crons for Next.js app…
3,656 installs - software-architecture sickn33/agentic-awesome-skills
Guide for quality focused software architecture. This skill should be used when users want to write code, design architecture, analyze code, in any case that relates to software development.
3,656 installs - recall cursor/plugins
Reconstruct your recent working context from your own chat history, live state, and the shared record (user reports, prior fixes, incidents), then hand back a tight current-state brief. Use for 'recall my work on X', 'c…
3,655 installs - expression-language-injection yaklang/hack-skills
Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.
3,653 installs - metadata-optimization appeeky/aso-skills
When the user wants to optimize App Store metadata — title, subtitle, keyword field, or description. Also use when the user mentions "optimize my title", "ASO metadata", "keyword field", "character limits", "app descrip…
3,650 installs - pi-delegate amelnagdy/delegate-skills
Delegate a coding task to the Pi coding agent CLI (`pi`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Pi - phrasings like "h…
3,649 installs - deploying-ui-bundle forcedotcom/sf-skills
MUST activate when the project contains a uiBundles/*/src/ directory or sfdx-project.json and the task involves deploying, pushing to an org, or post-deploy setup. Use this skill when deploying a UI bundle app to a Sale…
3,647 installs - graphql-operations apollographql/skills
Guide for writing GraphQL operations (queries, mutations, fragments) following best practices. Use this skill when: (1) writing GraphQL queries or mutations, (2) organizing operations with fragments, (3) optimizing data…
3,645 installs - tipkit dpearson2699/swift-ios-skills
Implement and review Apple TipKit feature-discovery UI for iOS 17+ apps. Use when adding or auditing in-app tips, contextual help, coach marks, Tip, TipView, popoverTip, rules, events, actions, display frequency, testin…
3,645 installs - wiki-ingest ar9av/obsidian-wiki
Ingest new documents, raw text, folders, or URLs into the Obsidian wiki as distilled, linked knowledge. Use for general wiki ingestion when no more specific ingest skill applies, including processing _raw/ staged conten…
3,645 installs - csv-formula-injection yaklang/hack-skills
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
3,644 installs - vibe-security raroque/vibe-security-skill
Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth vali…
3,644 installs - active-directory-acl-abuse yaklang/hack-skills
Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.
3,643 installs - build-parallelism dotnet/skills
Analyze an MSBuild solution, solution filter, or Build.proj that schedules multiple project files. USE FOR: measured idle worker nodes, `-m` that does not scale, a serial ProjectReference critical path, graph builds, or…
3,643 installs - to-tickets vinvcn/mattpocock-skills-zh-cn
把 plan、spec 或当前对话拆成一组 tracer-bullet tickets，每个 ticket 声明 blocking edges，并发布到已配置的 tracker；本地用每 ticket 一个文件中的文本 edge，真实 tracker 用 native blocking links。
3,642 installs - clickjacking yaklang/hack-skills
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
3,641 installs - canslim-screener tradermonty/claude-trading-skills
Screen US stocks using William O'Neil's CANSLIM growth stock methodology. Use when user requests CANSLIM stock screening, growth stock analysis, momentum stock identification, or wants to find stocks with strong earning…
3,640 installs - app-clips dpearson2699/swift-ios-skills
Build iOS App Clips with invocation URLs, App Clip Codes, NFC, QR codes, Safari banners, Maps, Messages, target setup, App Store Connect experiences, size/capability constraints, NSUserActivity routing, SKOverlay promot…
3,639 installs - jndi-injection yaklang/hack-skills
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
3,639 installs - xcode-build-fixer avdlee/xcode-build-optimization-agent-skill
Apply approved Xcode build optimization changes following best practices, then re-benchmark to verify improvement. Use when a developer has an approved optimization plan from xcode-build-orchestrator, wants to apply spe…
3,639 installs - incremental-build dotnet/skills
Guide for optimizing MSBuild incremental builds. USE FOR: builds slower than expected on subsequent runs, 'nothing changed but it rebuilds anyway', diagnosing why targets re-execute unnecessarily, fixing broken no-op bu…
3,638 installs - permissionkit dpearson2699/swift-ios-skills
Create child communication safety experiences using PermissionKit to request parental permission for children. Use when building apps that involve child-to-contact communication, need to check communication limits, requ…
3,638 installs - swift-codable dpearson2699/swift-ios-skills
Implement Swift Codable models for JSON and property-list encoding and decoding with JSONDecoder, JSONEncoder, CodingKeys, and custom init(from:) or encode(to:). Use when parsing API responses, remapping keys, flattenin…
3,638 installs - writing-shape vinvcn/mattpocock-skills-zh-cn
Writing, exploit：把原始素材塑造成文章，一段一段地推进。
3,638 installs - active-directory-kerberos-attacks yaklang/hack-skills
Kerberos attack playbook for Active Directory. Use when targeting AD authentication via AS-REP roasting, Kerberoasting, golden/silver/diamond tickets, delegation abuse, or pass-the-ticket attacks.
3,637 installs - platform-detection dotnet/skills
Identify a .NET project's test platform, framework, command mode, and SDK-style vs classic project system. Use only for "which test platform/framework?", "VSTest or MTP?", or "what runner does this project use?", includ…
3,637 installs - ui-designer daniel-dan-conrad/ui-designer-skill
Craft one-of-a-kind, ship-ready frontend interfaces with elevated design quality. Apply this skill whenever the user wants to build web components, pages, artifacts, posters, or applications (for example, websites, land…
3,637 installs - http2-specific-attacks yaklang/hack-skills
HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H…
3,636 installs - linux-privilege-escalation yaklang/hack-skills
Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesti…
3,636 installs - data-analysis bytedance/deer-flow
Use this skill when the user uploads Excel (.xlsx/.xls) or CSV files and wants to perform data analysis, generate statistics, create summaries, pivot tables, SQL queries, or any form of structured data exploration. Supp…
3,635 installs - nestjs-drizzle-crud-generator giuseppe-trisciuoglio/developer-kit
Generates complete CRUD modules for NestJS applications with Drizzle ORM. Use when building server-side features in NestJS that require database operations, including creating new entities with full CRUD endpoints, serv…
3,635 installs - writing-mstest-tests dotnet/skills
ALWAYS USE when asked to fix, rewrite, update, improve, modernize, show corrected code for, or explain existing MSTest tests or MSTest-specific configuration. Use for "review" when corrected code or edits are wanted, ev…
3,635 installs - platform-encryption-configure forcedotcom/sf-skills
Configure Salesforce Shield Platform Encryption — generate deployable encryption settings and encrypted-field metadata, and answer key-model and lifecycle questions. TRIGGER when: user wants to turn on deterministic enc…
3,634 installs - debug-optimize-lcp chromedevtools/chrome-devtools-mcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to und…
3,633 installs - migrate-dotnet9-to-dotnet10 dotnet/skills
Migrate a .NET 9 project or solution to .NET 10 and resolve all breaking changes. USE FOR: upgrading TargetFramework from net9.0 to net10.0, fixing build errors after updating the .NET 10 SDK, resolving source and behav…
3,633 installs - otel-instrumentation honeycombio/agent-skill
OpenTelemetry SDK setup, custom instrumentation, and sending data to Honeycomb. Trigger phrases: "instrument my app", "add tracing", "set up OpenTelemetry", "configure OTel", "add custom spans", "add attributes to spans…
3,633 installs - saml-sso-assertion-attacks yaklang/hack-skills
SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.
3,633 installs - ce-work everyinc/compound-engineering-plugin
Execute a plan or concrete work prompt end-to-end. Use when implementing from a plan document, a spec path, or a clear build request; use ce-debug for open-ended bugs. Use when an outer orchestrator needs implementation…
3,632 installs - eval-performance dotnet/skills
Guide for diagnosing and improving MSBuild project evaluation performance. USE FOR: builds slow before any compilation starts, high evaluation time in binlog analysis, expensive glob patterns walking large directories (…
3,632 installs - generating-ui-bundle-site forcedotcom/sf-skills
MUST activate when the project contains a uiBundles/*/src/ directory and the task involves creating or configuring site infrastructure. Use this skill when creating or configuring a Salesforce Digital Experience Site fo…
3,632 installs - active-directory-certificate-services yaklang/hack-skills
AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.
3,630 installs - arbitrary-write-to-rce yaklang/hack-skills
Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable,…
3,629 installs - writing-fragments vinvcn/mattpocock-skills-zh-cn
Writing, explore：挖掘原始 fragments，暂不施加任何结构。
3,629 installs - testing-agentforce forcedotcom/sf-skills
Write, run, and analyze structured test suites for Agentforce agents. TRIGGER when: user writes or modifies test spec YAML (AiEvaluationDefinition); runs sf agent test create, run, run-eval, or results commands; asks ab…
3,628 installs - convert-to-cpm dotnet/skills
Convert .NET projects and solutions (.sln, .slnx) to NuGet Central Package Management (CPM) using Directory.Packages.props. USE FOR: converting to CPM, centralizing or aligning NuGet package versions across multiple pro…
3,627 installs - hash-attack-techniques yaklang/hack-skills
Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.
3,627 installs - apple-notes openclaw/openclaw
Create, view, edit, delete, search, move, or export Apple Notes via the memo CLI on macOS.
3,626 installs