4,118 free skills · page 39 of 69
General & Other skills
Skills that are genuinely useful but don’t fit a dev-tool-specific bucket — legal and compliance, creative writing, finance, gaming, healthcare, and other domains the open skills.sh registry covers.
Real files from public repositories — hand-curated, never invented. Sorted by installs.
39 / 69page
monetize-servicecoinbase/agentic-wallet-skillsBuild and deploy a paid API that other agents can pay to use via x402. Use when you or the user want to monetize an API, make money, earn money, offer a service, sell a service to other agents, charge for endpoints, create a paid endpoint, or set up a paid service. Covers "make money by offering an endpoint", "sell a service", "monetize your data", "create a paid API".General & Other2.9k
sentry-feature-setupgetsentry/sentry-for-aiConfigure specific Sentry features beyond basic SDK setup. Use when asked to set up OpenTelemetry pipelines, create alerts and notifications, or set up Sentry Snapshots.General & Other2.9k
logo-generatorop7418/logo-generator-skillGenerate professional SVG logos and high-end showcase presentations for products and brands.General & Other2.9k
gpt-image-2-style-libraryfreestylefly/awesome-gpt-image-2Choose GPT-Image2 / gpt-image-2 visual styles and industrial prompt templates from the awesome-gpt-image-2 style library. Use when an agent needs to create, rewrite, classify, or improve image-generation prompts with repository-backed templates, categories, style tags, scene tags, pitfalls, and example cases.General & Other2.9k
heap-exploitationyaklang/hack-skillsPost-2.34 targets: see arbitrary-write-to-rce for _IO_FILE, exit_funcs, TLS_dtor_list, _dl_fini.General & Other2.9kbusiness-logic-vulnyaklang/hack-skillsThis is the routing entry point for business-logic and state-machine issues.General & Other2.9k
elasticsearch-authzelastic/agent-skillsManage Elasticsearch role-based access control: native users, roles, role assignment, and role mappings for external realms.General & Other2.9k
metadata-optimizationeronred/aso-skillsWhen the user wants to optimize App Store metadata — title, subtitle, keyword field, or description. Also use when the user mentions "optimize my title", "ASO metadata", "keyword field", "character limits", "app description", or "write my subtitle". For keyword discovery, see keyword-research. For full ASO audits, see aso-audit.General & Other2.9kcsrf-cross-site-request-forgeryyaklang/hack-skillscors cross origin misconfiguration when JSON endpoints become readable cross-origin; oauth oidc misconfiguration when login, account linking, or callback binding relies on OAuth stateGeneral & Other2.9kkibana-agent-builderelastic/agent-skillsCreate, update, delete, inspect, and chat with Agent Builder agents. Create, update, delete, list, and test custom tools (ES|QL, index search, workflow). If the user provided a name, use $ARGUMENTS as the default agent name.General & Other2.9k
google-ads-api-mcp-setupgoogle/skillsGuides developers through downloading, configuring, and installing the official open-source Google Ads MCP Server. Use this skill when a user wants to connect their AI assistant (such as Gemini, Claude Code, or Cursor) to their Google Ads account to query campaigns or retrieve reporting metrics using natural language.General & Other2.9koauth-oidc-misconfigurationyaklang/hack-skillsThe app supports Login with Google, GitHub, Microsoft, Okta, or other IdPs; You see authorize, callback, redirect_uri, code, state, nonce, or code_challenge; Mobile or SPA clients rely on OAuth or OIDC flowsGeneral & Other2.9kcompetitor-analysiseronred/aso-skillsWhen the user wants to analyze competitors' App Store strategy, find keyword gaps, or understand competitive positioning. Also use when the user mentions "competitor analysis", "competitive research", "keyword gap", "what are my competitors doing", or "compare my app to". For keyword-specific research, see keyword-research. For metadata writing, see metadata-optimization.General & Other2.9ktraffic-analysis-pcapyaklang/hack-skillsmemory-forensics-volatility for correlating memory artifacts with network traffic; steganography-techniques for analyzing files extracted from traffic captures; network-protocol-attacks for understanding attack patterns visible in capturesGeneral & Other2.9kelasticsearch-auditelastic/agent-skillsEnable and configure security audit logging for Elasticsearch via the cluster settings API. Audit logs record security events such as authentication attempts, access grants and denials, role changes, and API key operations — essential for compliance and incident investigation.General & Other2.9k
okf-knowledge-baseinkeep/open-knowledge-skillsOpen Knowledge Format (OKF) v0.2 guidance. Use when creating, reading, reviewing, or maintaining an OKF bundle; responding to OpenKnowledge okf plugin warnings; or choosing types, provenance, links, indexes, or logs.General & Other2.9k
google-drivemembranedev/application-skillsGoogle Drive is a cloud-based file storage and synchronization service. It's used by individuals and teams to store, access, and share files online from any device. Think of it as a virtual hard drive in the cloud.General & Other2.9k
risk-assessmentanthropics/knowledge-work-pluginsIdentify, assess, and mitigate operational risks. Trigger with "what are the risks", "risk assessment", "risk register", "what could go wrong", or when the user is evaluating risks associated with a project, vendor, process, or decision.General & Other2.9kkibana-streamselastic/agent-skillsRead stream metadata, settings, queries, significant events, and attachments, and manage stream lifecycle (enable, disable, resync) via the Kibana Streams REST API.General & Other2.9k
generating-mermaid-diagramsforcedotcom/sf-skillsSalesforce architecture diagrams using Mermaid with ASCII fallback. Use this skill when generating text-based diagrams for Salesforce architecture, OAuth flows, ERDs, integration sequences, or Agentforce structure. TRIGGER when: user says \"diagram\", \"visualize\", \"ERD\", or asks for sequence diagrams, flowcharts, class diagrams, or architecture visualizations in Mermaid. DO NOT TRIGGER when: user wants PNG/SVG image output (use generating-visual-diagrams), or asks about non-Salesforce systems.General & Other2.9k
iotmarkdown-viewer/skillsCreate IoT architecture diagrams using PlantUML syntax with device and sensor stencil icons. Best for smart home, industrial IoT (IIoT), fleet management, edge computing, and sensor network layouts.General & Other2.9k
lesson-learnedsoftaworks/agent-toolkitAnalyze recent code changes via git history and extract software engineering lessons. Use when the user asks 'what is the lesson here?', 'what can I learn from this?', 'engineering takeaway', 'what did I just learn?', 'reflect on this code', or wants to extract principles from recent work.General & Other2.9k
design-briefnexu-io/open-designParse a structured design brief into a concrete DESIGN.md and optional visual preview. Agent, follow this workflow exactly.General & Other2.9kvm-and-bytecode-reverseyaklang/hack-skillscode-obfuscation-deobfuscation when the VM is a commercial protector (VMProtect/Themida); symbolic-execution-tools when using angr to solve VM-based challenges; anti-debugging-techniques when the VM includes anti-debug checksGeneral & Other2.9kdraft-outreachanthropics/knowledge-work-pluginsResearch a prospect then draft personalized outreach. Uses web research by default, supercharged with enrichment and CRM. Trigger with "draft outreach to [person/company]", "write cold email to [prospect]", "reach out to [name]".General & Other2.9k
skill-installeropenai/skillsInstall Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos).General & Other2.9kkibana-connectorselastic/agent-skillsConnectors store connection information for Elastic services and third-party systems. Alerting rules use connectors to route actions (notifications) when rule conditions are met. Connectors are managed per Kibana Space and can be shared across all rules within that space.General & Other2.9kdaily-briefinganthropics/knowledge-work-pluginsStart your day with a prioritized sales briefing. Works standalone when you tell me your meetings and priorities, supercharged when you connect your calendar, CRM, and email. Trigger with "morning briefing", "daily brief", "what's on my plate today", "prep my day", or "start my day".General & Other2.9kkibana-vegaelastic/agent-skillsCreate and manage Kibana dashboards and Vega visualizations with ES|QL data sources.General & Other2.9kpath-traversal-lfiyaklang/hack-skillsBefore deep exploitation, you can first load:General & Other2.9kelasticsearch-security-troubleshootingelastic/agent-skillsDiagnose and resolve common Elasticsearch security issues. This skill provides a structured triage workflow for authentication failures, authorization errors, TLS problems, API key issues, role mapping mismatches, Kibana login failures, and license-expiry lockouts.General & Other2.9kgoogle-ads-api-quickstartgoogle/skillsThis skill guides you from absolute zero to running your first successful request to retrieve campaigns.General & Other2.9kbinary-protection-bypassyaklang/hack-skillsLoad PROTECTION_BYPASS_MATRIX.md for comprehensive protection × bypass × primitive matrix.General & Other2.9k
resolving-merge-conflictsvinvcn/mattpocock-skills-zh-cn适用于需要解决正在进行的 git merge/rebase 冲突时。General & Other2.9ksecurity-ownership-mapopenai/skillsAnalyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.General & Other2.9kcmdi-command-injectionyaklang/hack-skillsupload insecure files when the shell sink is part of a broader upload, import, or conversion workflowGeneral & Other2.9k
git-create-repozc277584121/mygitpluginCreate a new GitHub repository and clone it locallyGeneral & Other2.9k
typescript-best-practicescursor/pluginsTypeScript best practices. Use when reading or editing any .ts or .tsx file.General & Other2.9kformat-string-exploitationyaklang/hack-skillsstack-overflow-and-rop — combine format string leak with stack overflow for full exploit; binary-protection-bypass — format string is the primary canary/PIE/ASLR leak method; arbitrary-write-to-rce — convert format string write primitive to code execution targetsGeneral & Other2.9k
meeting-notesshubhamsaboo/awesome-llm-appsYou are an expert at creating clear, actionable meeting summaries and notes.General & Other2.9kxxe-xml-external-entityyaklang/hack-skillsupload insecure files when XXE is reachable through SVG, OOXML, import, or preview pipelinesGeneral & Other2.9kgoogle-cloud-solution-architecturegoogle/skillsThe workflow consists of the following phases:General & Other2.9kssti-server-side-template-injectionyaklang/hack-skillsBefore using full engine-specific exploitation, you can first load:General & Other2.9kfile-access-vulnyaklang/hack-skillsThis is the routing entry point for filesystem paths, download endpoints, upload pipelines, and file preview handling.General & Other2.9k
excalidraw-diagramaxtonliu/axton-obsidian-visual-skillsGenerate Excalidraw diagrams from text content. Supports three output modes - Obsidian (.md), Standard (.excalidraw), and Animated (.excalidraw with animation order). Triggers on "Excalidraw", "画图", "流程图", "思维导图", "可视化", "diagram", "标准Excalidraw", "standard excalidraw", "Excalidraw动画", "动画图", "animate".General & Other2.9kplatform-sharing-owd-configureforcedotcom/sf-skillsUse when the user wants to retrieve or update Organization-Wide Default (OWD) sharing settings for Salesforce objects. TRIGGER when: user asks to check current OWD settings, view sharing defaults, change default access levels (Private, Public Read Only, Public Read/Write, Controlled by Parent), configure internal or external access for standard or custom objects, mentions org-wide defaults, wants to make records private or restrict who can see records, wants to control default record visibility for an object, or references .settings-meta.xml sharing fields or sharingModel in .object-meta.xml files. DO NOT TRIGGER when: user asks about sharing rules, criteria-based sharing, role hierarchy, or manual sharing — delegate to platform-sharing-rules-generate.General & Other2.9khttp-parameter-pollutionyaklang/hack-skillsHypothesis: the security check reads one occurrence of a parameter while the action reads another.General & Other2.9kkernel-exploitationyaklang/hack-skillsbinary-protection-bypass — userspace protections (NX, ASLR) also apply in kernel context; stack-overflow-and-rop — kernel ROP reuses many userspace ROP concepts; heap-exploitation — kernel SLUB is conceptually related to userspace heapGeneral & Other2.9kconfiguring-connected-appsforcedotcom/sf-skillsSalesforce Connected Apps and External Client Apps OAuth configuration with 120-point scoring. Use this skill to configure OAuth flows, JWT bearer auth, Connected Apps, and External Client Apps in Salesforce. TRIGGER when: user configures OAuth flows, JWT bearer auth, Connected Apps, ECAs, or touches .connectedApp-meta.xml / .eca-meta.xml files. DO NOT TRIGGER when: configuring Named Credentials for callouts (use building-sf-integrations), reviewing permission policies (use deploying-metadata), or writing Apex token-handling code (use generating-apex).General & Other2.9kbrowser-exploitation-v8yaklang/hack-skillsLoad V8_EXPLOITATION_PATTERNS.md when you need: - Detailed exploitation patterns and code templates - Heap layout manipulation and GC interaction - V8 sandbox bypass techniques - Object map confusion patternsGeneral & Other2.9kslack-searchanthropics/knowledge-work-pluginsGuidance for effectively searching Slack to find messages, files, channels, and peopleGeneral & Other2.9krequest-smugglingyaklang/hack-skillsRouting note: load this skill when you suspect CDN/reverse-proxy and origin disagree on request-end boundaries, or when abnormal concatenation appears during H2-to-H1 downgrade.General & Other2.9k
fetchbrowserbase/skillsUse this skill when the user wants to retrieve a URL without a full browser session: fetch HTML or JSON from static pages, inspect status codes or headers, follow redirects, or get page source for simple scraping. Prefer it over a browser when JavaScript rendering and page interaction are not needed. Supports proxies and redirect control.General & Other2.8k
ce-ideateeveryinc/compound-engineering-pluginGenerate and evaluate grounded ideas. Use when the user wants ideas, improvements, or surprising directions before choosing one to develop. Not for refining an idea they already have (ce-brainstorm) or judging one already on the table (ce-pov).General & Other2.8k
oauthvercel-labs/portlessConfigure OAuth providers (Google, Apple, Microsoft, Facebook, GitHub, etc.) to work with portless local dev URLs. Use when setting up OAuth redirect URIs, fixing "redirect_uri_mismatch" or "invalid redirect" errors, configuring sign-in providers for local development, or when a provider rejects .localhost subdomains. Triggers include "OAuth not working with portless", "redirect URI mismatch", "Google/Apple/Microsoft sign-in fails locally", "configure OAuth for local dev", or any task involving OAuth callback URLs with portless domains.General & Other2.8kopen-redirectyaklang/hack-skillsOpen redirect occurs when an application redirects users to a URL derived from user input without validation. The trusted domain acts as a "launchpad" for phishing or token theft.General & Other2.8ksymbolic-execution-toolsyaklang/hack-skillsAlso load ANGR_COOKBOOK.md when you need: - 15+ ready-to-use angr script patterns for common CTF challenges - Hook templates for scanf, printf, malloc, strcmp - Symbolic file input, stdin, argv patterns - Optimization tricks for path explosion managementGeneral & Other2.8kinsecure-source-code-managementyaklang/hack-skillsHigh-value paths to probe first (GET or HEAD, respect rate limits):General & Other2.8krace-conditionyaklang/hack-skillsTarget endpoints where check and update are unlikely to be a single atomic database operation:General & Other2.8kcsp-bypass-advancedyaklang/hack-skillsCritical insight: base-uri, form-action, and frame-ancestors do NOT fall back to default-src. Their absence is always a potential bypass vector.General & Other2.8kOther tasks
same rules, different job
