4,118 free skills · page 40 of 69
General & Other skills
Skills that are genuinely useful but don’t fit a dev-tool-specific bucket — legal and compliance, creative writing, finance, gaming, healthcare, and other domains the open skills.sh registry covers.
Real files from public repositories — hand-curated, never invented. Sorted by installs.
40 / 69page
crlf-injectionyaklang/hack-skillsCRLF = \r\n (Carriage Return + Line Feed, %0D%0A). HTTP headers are separated by CRLF. If user input is reflected in a response header without sanitization, injecting CRLF characters creates new headers or even a response body.General & Other2.8kdependency-confusionyaklang/hack-skillsManifests listing package names that look internal (short unscoped names, org-specific tokens, product codenames) without a hard-private registry lock.; Evidence the same name might exist—or be squattable—on a public registry with a higher semver than the private feed publishes.; Lockfiles missing,…General & Other2.8kweb-cache-deceptionyaklang/hack-skillsAlso load CACHE_POISONING_TECHNIQUES.md when you need: - Web Cache Poisoning vs Web Cache Deception — clear distinction and attack flow comparison - Unkeyed header poisoning (X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, multiple Host headers) - Unkeyed parameter poisoning (utm_content,…General & Other2.8k
decision-recordsskymavis/skillsThis skill owns the registry tool decisions.py, symlinked into the repo at scripts/decisions.py (run decisions.py install to set up the symlink + a CI check). The tool finds the repo's docs/ by walking up from the CWD, so run it from anywhere in the repo:General & Other2.8kmobile-ssl-pinning-bypassyaklang/hack-skillsandroid-pentesting-tricks for broader Android testing beyond SSL bypass; ios-pentesting-tricks for broader iOS testing beyond SSL bypass; api-sec once traffic is intercepted for API-level testingGeneral & Other2.8k
tasteaffaan-m/eccA creative-direction (taste) layer for music videos and short-form edits in the angelcore / cloud-trance / hyperpop visual family. Distills a named-genre aesthetic vocabulary, a mood + color + light system, and a beat-synced editing grammar, then chains ECC's video skills (video-editing, fal-ai-media, remotion-video-creation, motion-*, content-engine) into one production pipeline. Use when the work is not just making a video function but making it feel intentional, when building a music video, a fancam/edit, a moodboard-driven reel, or when choosing a coherent visual direction for AI-generated b-roll.General & Other2.8k
skill-scannergetsentry/skillsScan agent skills for security issues. Use when asked to "scan a skill",General & Other2.8k
ads-mathagricidaniel/claude-adsCalculate and model paid-media CPA, CPL, CPC, CPM, ROAS, MER, break-even targets, contribution margin, LTV:CAC, impression-share opportunity, budgets, forecasts, and experiment economics. Use for PPC math, ad calculator, break-even analysis, ROAS calculator, CPA calculator, budget forecast, LTV CAC, or MER.General & Other2.8k
openclaw-configadisinghstudent/ara.soManage OpenClaw bot configuration - channels, agents, security, and autopilot settingsGeneral & Other2.8k
base44-remote-devbase44/skillsVendored from base44-dev/apper PR #11608 (docs/features/bring-your-own-model/base44-remote-dev/SKILL.md). Keep in sync with the upstream source if it changes. -->General & Other2.8khttp-host-header-attacksyaklang/hack-skillsThe Host header is used by web applications and infrastructure for:General & Other2.8k
apify-lead-generationapify/agent-skillsGenerates B2B/B2C leads by scraping Google Maps, websites, Instagram, TikTok, Facebook, LinkedIn, YouTube, and Google Search. Use when user asks to find leads, prospects, businesses, build lead lists, enrich contacts, or scrape profiles for sales outreach.General & Other2.8k
git-commit-pushzc277584121/mygitpluginCommit changes and push to origin without creating a PRGeneral & Other2.8k
xyq-nest-skillpippit-dev/pippit-skills通过小云雀的 AI 能力进行综合创作，支持生成和编辑图片/视频。覆盖场景包括：生成（文生图、文生视频、图生视频、做动画、画一个xxx、来段xxx）、编辑修改（把xxx换成yyy、去掉xxx、加上xxx、改成xxx、调整xxx、局部修改、改镜头）、风格转换（风格迁移、转绘、换风格）、视频续写延长、复刻视频/TVC/宣传片、短剧/短漫剧生成、音乐MV生成、产品广告/展示片制作、分镜/故事板设计、教育视频/短视频制作。当用户提到小云雀、xyq、上传参考图/视频、查看生成进度时也应触发。关键判断：只要用户的请求涉及 AI 视频的创作、生成、编辑、修改，无论措辞如何（如"画只猫"、"做个海报"、"做个视频"、"这个视频帮我改一下"、"帮我复刻这段视频"、"用这首歌做个MV"、"一句话生成短剧"），都必须触发此技能。General & Other2.8k
ce-commit-push-preveryinc/compound-engineering-pluginCommit, push, and open a PR. Use when asked to ship/open a PR, or for PR-description-only flows like writing, rewriting, or describing a PR body.General & Other2.8kjndi-injectionyaklang/hack-skillsJNDI (Java Naming and Directory Interface) provides a unified API for looking up objects from naming/directory services (RMI, LDAP, DNS, CORBA).General & Other2.8k
wind-alicewind-information-co-ltd/wind-skills调用万得 Alice Agent（A2A 协议，SSE 流式）执行指定 Skill 并获取分析结果的 CLI 工具。当用户要求"用 Alice 跑某个 Skill"、"出一份某公司的调研问题清单"、"做一页纸投资备忘"、"核验一段金融信息"等需要点名 Alice 子 Skill 的场景使用。General & Other2.8kactive-directory-acl-abuseyaklang/hack-skillsactive-directory-kerberos-attacks for Kerberos attacks often chained with ACL abuse; active-directory-certificate-services for certificate-based attacks after ACL exploitation; ntlm-relay-coercion for relay attacks that can set ACLs (LDAP relay)General & Other2.8kcsv-formula-injectionyaklang/hack-skillsCharacters that may trigger formula evaluation when a cell is opened in Excel, LibreOffice Calc, or similar (often only if the cell is interpreted as a formula):General & Other2.8ksubdomain-takeoveryaklang/hack-skillsssrf-server-side-request-forgery when a subdomain takeover is used to bypass SSRF allowlists trusting .target.com; cors-cross-origin-misconfiguration when CORS trusts .target.com — takeover → full cross-origin read; xss-cross-site-scripting takeover gives you script execution under target origin…General & Other2.8k
competitive-briefanthropics/knowledge-work-pluginsResearch competitors and generate a positioning and messaging comparison with content gaps, opportunities, and threats. Use when building sales battlecards, when finding positioning gaps and messaging angles competitors haven't claimed, or when a competitor makes a move and you need to assess the impact.General & Other2.8k
creative-directornexu-io/open-designAI creative director with recursive self-assessment: 20+ methodologies (SIT, TRIZ, Bisociation, SCAMPER, Synectics), 3-axis evaluation calibrated against Cannes/D&AD/HumanKind, 5-phase process from brief to presentation.General & Other2.8kclickjackingyaklang/hack-skillsClickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.General & Other2.8k
pua-entanweai/puaPerformance-coaching mode for repeated failures, passive behavior, completion-quality issues, or explicit try-harder requests. Uses structured troubleshooting and evidence-first delivery habits.General & Other2.8k
nx-run-tasksnrwl/nx-ai-agents-configHelps with running tasks in an Nx workspace. USE WHEN the user wants to execute build, test, lint, serve, or run any other tasks defined in the workspace.General & Other2.8k
unity-developerrmyndharis/antigravity-skillsBuild Unity games with optimized C# scripts, efficient rendering,General & Other2.8k
query-metricsaxiomhq/skillsRuns metrics queries against Axiom MetricsDB via scripts. Discovers available metrics, tags, and tag values. Use when asked to query metrics, explore metric datasets, check metric values, or investigate OTel metrics data.General & Other2.8k
m07-concurrencyactionbook/rust-skillsCRITICAL: Use for concurrency/async. Triggers: E0277 Send Sync, cannot be sent between threads, thread, spawn, channel, mpsc, Mutex, RwLock, Atomic, async, await, Future, tokio, deadlock, race condition, 并发, 线程, 异步, 死锁General & Other2.8kconfig-gcaffaan-m/eccGarbage collection for your Claude Code configuration. Periodically scans ~/.claude (skills, memory, hooks, permissions, MCP servers, caches) for redundant, stale, orphaned, or low-value items, then walks the user through a confirm-each-deletion cleanup. Use when the user says "clean up my config", "config GC", "too many skills", "audit my setup", "my .claude is bloated", or asks for a periodic config review.General & Other2.8k
finance-newssundial-org/awesome-openclaw-skillsMarket news briefings with AI summaries. Use when asked about stock news, market updates, portfolio performance, morning/evening briefings, financial headlines, or price alerts. Supports US/Europe/Japan markets, WhatsApp delivery, and English/German output.General & Other2.8k
paper-auditbahayonghang/academic-writing-skillsReviewer-style audit and submission gate for academic papers in .tex, .typ, or .pdf. Use for peer-review critique, readiness/gate decisions, blocker triage, revision roadmaps, journal-style reports, and re-audits. Do not use for source editing, sentence polishing, bibliography search, or compile repair.General & Other2.8k
SQLite Database Expertmartinholovsky/claude-skills-generatorExpert in SQLite embedded database development for Tauri/desktop applications with focus on SQL injection prevention, migrations, FTS search, and secure data handlingGeneral & Other2.8k
search-for-servicecoinbase/agentic-wallet-skillsSearch and browse the x402 bazaar marketplace for paid API services. Use when you or the user want to find available services, see what's available, discover APIs, or need an external service to accomplish a task. Also use as a fallback when no other skill clearly matches — search the bazaar to see if a paid service exists. Covers "what can I do?", "find me an API for...", "what services are available?", "search for...", "browse the bazaar".General & Other2.8ksaml-sso-assertion-attacksyaklang/hack-skillsEnterprise SSO uses SAML requests or responses; You see SAMLRequest, SAMLResponse, XML assertions, or ACS endpoints; Login flows involve an external IdP and browser POST/redirect bindingGeneral & Other2.8k
adk-dev-guidegoogle/adk-docsIf this is a long session, re-read the relevant skill before each phase — /adk-cheatsheet before writing code, /adk-eval-guide before running evals, /adk-deploy-guide before deploying, /adk-scaffold before scaffolding. Context compaction may have dropped earlier skill content.General & Other2.8kactive-directory-kerberos-attacksyaklang/hack-skillsactive-directory-acl-abuse for ACL-based AD attacks often chained with Kerberos; active-directory-certificate-services for ADCS-based persistence (golden certificate); ntlm-relay-coercion for NTLM relay attacks that complement Kerberos abuseGeneral & Other2.8k
kibana-auditelastic/agent-skillsEnable and configure audit logging for Kibana via kibana.yml. Kibana audit logs cover application-layer security events that Elasticsearch does not see: saved object CRUD (dashboards, visualizations, index patterns, rules, cases), login/logout, session expiry, space operations, and Kibana-level RBAC…General & Other2.8khash-attack-techniquesyaklang/hack-skillsTwo messages with same prefix but different content, producing identical MD5.General & Other2.8k
htmlplannotator/effective-htmlCreate or redesign self-contained single-file HTML artifacts with a visual direction shaped by the user's brief, project, and subject. Use when HTML is the deliverable for a report, explainer, landing page, presentation, tool, mixed artifact, or broad request. This is the collection's only implicit router. Route clear wireframe, prototype, mockup, plan, or diagram requests to the matching direct-invocation specialist when available. Do not use for ordinary application implementation when a standalone HTML file is not the deliverable.General & Other2.8k
agy-delegateamelnagdy/delegate-skillsYou are the orchestrator. This skill lets you hand a bounded coding task to a separate implementer - the Google Antigravity CLI (agy) - then review what it produced and land it yourself. You write the brief and own the judgment; Antigravity does the typing in its own conversation; you verify and…General & Other2.8kactive-directory-certificate-servicesyaklang/hack-skillsactive-directory-acl-abuse for ACL-based attacks that enable ESC4 (template modification); active-directory-kerberos-attacks for Kerberos techniques after obtaining certificates; ntlm-relay-coercion for ESC8 (relay to HTTP enrollment endpoint)General & Other2.8k
run-testsdotnet/skillsDetect the project system, test platform, and framework, then use the repository-compatible build and test runner.General & Other2.8ksentry-sdk-upgradegetsentry/sentry-for-aiUpgrade the Sentry JavaScript SDK across major versions. Use when asked to upgrade Sentry, migrate to a newer version, fix deprecated Sentry APIs, or resolve breaking changes after a Sentry version bump.General & Other2.8khttp2-specific-attacksyaklang/hack-skillsh2c is HTTP/2 without TLS, negotiated via the HTTP/1.1 Upgrade mechanism. Many reverse proxies forward the Upgrade: h2c header without understanding it, allowing attackers to bypass proxy-level access controls.General & Other2.8k
freee-api-skillfreee/freee-mcpfreee-mcp / freee-sign-mcp と連携するスキル。会計・人事労務・請求書・工数管理・販売・IT管理・サーベイ・サイン（電子契約）の詳細APIリファレンスと使い方ガイドを提供。freee の経費申請・取引登録・勤怠打刻・給与明細・見積書・試算表・仕訳・従業員管理・工数登録・売上管理・SaaSアカウント管理・備品管理・サーベイ企画/実施回の取得・電子契約の文書管理などの操作やAPI仕様を調べたいときに使う。ユーザーが freee のデータ操作、会計処理、人事労務管理、請求・見積、プロジェクト工数管理、販売管理、IT管理、サーベイ、電子契約について質問や操作を依頼してきた場合は、明示的に freee と言及していなくても、このスキルの利用を検討すること。サインは別途 freee-sign-mcp の設定が必要。General & Other2.8karbitrary-write-to-rceyaklang/hack-skillsReplace a function pointer in the Global Offset Table.General & Other2.8klinux-privilege-escalationyaklang/hack-skillscontainer-escape-techniques when the target is a container and you need to escape to host; linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp; linux-lateral-movement after obtaining root for pivoting to adjacent hostsGeneral & Other2.8k
flight-ticket-searchnomadamas/k-skillGoogle Flights 공개 검색 표면을 무료로 조회해 항공권 후보, 예약 검색 링크, 날짜/월/연도별 최저가·평균가 비교를 보수적으로 제공한다. 돌쇠에서는 공식 표면을 통한 후속 액션까지 진행한다.General & Other2.8kprototype-pollutionyaklang/hack-skillsRouting note: prioritize PP when you see deep merges, recursive assign, JSON.parse followed by Object.assign, or URL queries converted to nested objects.General & Other2.8kdefi-attack-patternsyaklang/hack-skillsFlash loans provide uncollateralized borrowing within a single transaction. The entire borrow → use → repay cycle must complete atomically; if repayment fails, the transaction reverts as if nothing happened.General & Other2.8k
platform-lightning-type-widget-coordinateforcedotcom/sf-skillsOrchestrate Apex-backed Lightning Type + HXL widget generation. TRIGGER only when the prompt EXPLICITLY invokes Lightning Types: user says 'Lightning Type', 'CLT', 'Custom Lightning Type', 'Apex-backed type', references '@apexClassType/...', asks to build a widget or card for a named Lightning Type, asks to create a new Lightning Type and widget together, or grounds a widget in a specific Apex class as its schema. DO NOT TRIGGER when the prompt names only a subject, domain, feature, or entity noun. Also DO NOT TRIGGER when: authoring only a Custom Lightning Type (use platform-custom-lightning-type-generate), only an Apex class (use platform-apex-generate), editing an existing widget without any Lightning Type change, or grounding a widget on an object/JSON-based Lightning Type (lightning__objectType with primitives).General & Other2.8kai-ml-securityyaklang/hack-skillsPython's pickle module executes arbitrary code during deserialization. PyTorch .pt/.pth files use pickle by default.General & Other2.8kdangling-markup-injectionyaklang/hack-skillsYou need dangling markup when ALL of these are true:General & Other2.8kdns-rebinding-attacksyaklang/hack-skillsThe browser same-origin policy binds protocol + host + port. The host is resolved via DNS at connection time. If an attacker controls the DNS server for attacker.com, they can:General & Other2.8kgit-summarize-weeklyzc277584121/mygitpluginSummarize weekly GitHub contributions for writing weekly reportsGeneral & Other2.8knetwork-protocol-attacksyaklang/hack-skillstunneling-and-pivoting after establishing MitM position for traffic redirection; ntlm-relay-coercion for relaying captured NTLM hashes from poisoning attacks; unauthorized-access-common-services for exploiting services discovered during network attacksGeneral & Other2.8kwindows-av-evasionyaklang/hack-skillswindows-privilege-escalation when privesc tools are blocked by AV; windows-lateral-movement when lateral movement tools trigger EDR; active-directory-kerberos-attacks when Rubeus/Mimikatz are detectedGeneral & Other2.8kgit-fork-clonezc277584121/mygitpluginFork a GitHub repo and clone it locally with proper remote setupGeneral & Other2.8kintercity-bus-bookingnomadamas/k-skillSearch and assist Korean 시외버스/Tmoney bookings using official HTTP/API-first flows; use for 시외버스 예매, 시간표, 좌석/요금 조회, and official checkout-entry handoff. 돌쇠에서는 공식 표면을 통한 후속 액션까지 진행한다.General & Other2.8klinux-lateral-movementyaklang/hack-skillslinux-privilege-escalation if you need root on the current host before pivoting; linux-security-bypass when restricted shells or security modules block lateral movement tools; container-escape-techniques when the target network includes containerized hostsGeneral & Other2.8kOther tasks
same rules, different job
