Agent Skills

Free AI agent skills from GitHub, tested by a small, cheap model (Haiku). Further right means Haiku used it right more often.

How a skill is tested

A skill is a file that teaches an AI coding agent how to do one job. We test each one with a small, cheap model (Haiku), because if a small model gets it right, a big one will too.

  1. Picked right. Haiku sees the list of skills, like a real agent does, and gets 3 requests: 2 where this skill should be used and 1 that only sounds similar. It scores a point for each request it sends the right way.
  2. Followed right. Haiku reads the whole skill and a real request, then says its first step. A second Haiku call checks that step against the one the skill asks for.

Score: 1 point per request picked right (3) plus 2 points for following right, out of 5, shown out of 100. Further right is better. Green is 80 and up, amber 50 to 79, red below 50. Pick a kind of skill to see them as a leaderboard, best first. Haiku only sees skills from the same repo when it picks, as if you had installed that one collection. The test questions were written from each skill's own text by a stronger model, so a skill is never graded on something it does not claim to do. Last run: claude-haiku-4-5-20251001, 2026-10-28.

The same skills as a table
SkillFromWhat it doesScorePicked rightFollowed right
careful garrytan/gstackWarn before risky shell commands like rm -rf, DROP TABLE and force-push, so you can stop them. 60 1/3 1/1
cso garrytan/gstackSecurity audit in chief-security-officer mode: attack surface, OWASP, supply chain, with evidence. 60 3/3 0/1
guard garrytan/gstackFull safety mode: warn on destructive commands and lock edits to one directory, in one go. 100 3/3 1/1
semgrep-rule-creator trailofbits/skillsWrite Semgrep rules that catch a bug pattern across your code, with tests for hits and misses. 100 3/3 1/1
differential-review trailofbits/skillsSecurity review of a PR or diff. Uses git history and caller count, and writes a markdown report. 60 3/3 0/1
variant-analysis trailofbits/skillsAfter finding one bug, hunt for every other place the same root cause hides in the codebase. 100 3/3 1/1
supply-chain-risk-auditor trailofbits/skillsAudit dependencies for advisories, dead upstreams, single maintainers and install scripts. 100 3/3 1/1
codeql trailofbits/skillsScan a repo with CodeQL data-flow and taint analysis, with checks that the database is good. 100 3/3 1/1
semgrep trailofbits/skillsRun a Semgrep scan with auto-picked rulesets, an approval gate and merged SARIF output. 100 3/3 1/1
sarif-parsing trailofbits/skillsRead, dedupe and summarize SARIF files from CodeQL, Semgrep and other scanners. 100 3/3 1/1
agentic-actions-auditor trailofbits/skillsAudit GitHub Actions workflows that run AI agents for prompt injection and unsafe inputs. 100 3/3 1/1
fp-check trailofbits/skillsCheck if a suspected security bug is real. Gives true or false positive with evidence. 100 3/3 1/1
security-review getsentry/skillsReview code for OWASP-style holes like injection, XSS, auth and authorization flaws. 60 3/3 0/1
gha-security-review getsentry/skillsReview GitHub Actions workflows for exploit paths like injection and token theft. 100 3/3 1/1
django-access-review getsentry/skillsReview Django views and DRF viewsets for broken access control and IDOR. 100 3/3 1/1
terraform-policy hashicorp/agent-skillsWrite, test and convert Terraform Policy files (.policy.hcl), including Sentinel to tfpolicy. 100 3/3 1/1
security-best-practices openai/skillsLanguage and framework specific security review with fixes, when you ask for a secure-by-default pass. 60 3/3 0/1
security-threat-model openai/skillsWrite a threat model for a repo. Trust boundaries, assets, attacker paths and mitigations. 100 3/3 1/1
firebase-security-rules-auditor firebase/agent-skillsAudit Firestore and Storage rules for privilege escalation, update bypass and missing checks. 100 3/3 1/1
firestore-rules-creation firebase/agent-skillsDesign and harden production Cloud Firestore security rules from your codebase. 100 3/3 1/1
better-auth-security-best-practices better-auth/skillsHarden Better Auth. Rate limits, secrets, CSRF, trusted origins, cookies and audit logs. 100 3/3 1/1
secrets-management wshobson/agentsKeep CI/CD secrets safe with Vault, cloud secret managers and rotation. 60 3/3 0/1
stride-analysis-patterns wshobson/agentsThreat model with STRIDE: spoofing, tampering, repudiation, leaks, DoS, privilege. 60 3/3 0/1
sast-configuration wshobson/agentsSet up Semgrep, CodeQL or SonarQube static security scans in CI. 100 3/3 1/1
k8s-security-policies wshobson/agentsLock down Kubernetes with NetworkPolicy, pod security and RBAC. 40 2/3 0/1
auth-implementation-patterns wshobson/agentsBuild login right: JWT, OAuth2, sessions and RBAC done safely. 60 3/3 0/1
dependency-auditor alirezarezvani/claude-skillsAudit packages for CVEs, license clashes and risky upgrades across languages. 80 2/3 1/1
env-secrets-manager alirezarezvani/claude-skillsCheck .env files for leaked secrets, drift and rotation readiness. 100 3/3 1/1
security-pen-testing alirezarezvani/claude-skillsDo an OWASP Top 10 audit: static scan, deps, secrets, API and auth tests. 40 2/3 0/1
skill-security-auditor alirezarezvani/claude-skillsScan an agent skill for bad scripts and prompt injection before installing. 60 3/3 0/1
security-reviewer Jeffallan/claude-skillsAudit code or infra for vulnerabilities and write a report with fixes. 20 1/3 0/1
secure-code-guardian Jeffallan/claude-skillsWrite secure code: safe auth, input checks, hashing, OWASP Top 10 fixes. 40 2/3 0/1
security-review affaan-m/everything-claude-codeSecurity checklist for auth, user input, secrets, endpoints and payments. 60 3/3 0/1
security-scan affaan-m/everything-claude-codeScan the .claude folder, hooks and MCP servers for bad config and injection. 100 3/3 1/1
flisk-secrets flisk-sh/flisk-skillsGive Flisk services configuration and secrets: params, secrets.required and the gitignored .env, flisk up --env-file and Infisical. 100 3/3 1/1