ツール

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

Diffusion model inference in pure C/C++: one sd-cli command runs SD, FLUX, Qwen Image, Wan and more locally to create or edit images and short videos, with Metal acceleration on Mac. No cloud needed; bring your own model weights and use a release binary or build from source.

Consensus's official Codex plugin: uses its remote MCP to search 220 million peer-reviewed papers for literature reviews, bibliographies, research gap analysis and cited writing. Needs a Consensus sign-in; the free tier returns a limited number of results.

OpenAI's official Codex plugin that guides sequencing analysis from BCL/FASTQ: QC, RNA-seq differential expression, single-cell, variant calling and metagenomics, favoring nf-core and other public pipelines with reproducible run logs. Checks for local tools first. Research use only.

OpenAI's official Codex plugin that uses the local API of the Zotero desktop app to search your library, export BibTeX, insert citations into LaTeX or Markdown drafts, and import new references after you confirm. Requires Zotero desktop.

Creates, edits and validates reproducible Python and SQL Jupyter notebooks: organizes cells as reports or tutorials, checks conclusions against actual output and reruns top to bottom before handoff. Maintained by OpenAI in the Data Analytics plugin of openai/plugins.

OpenAI's official life-science skills: 49 skills query public databases such as UniProt, ClinVar, gnomAD and AlphaFold through Python scripts, with a router skill that breaks down questions, normalizes entities and compiles sourced evidence. Written mainly for Codex.

OpenAI's official Codex plugin with about 50 skills that route questions to genetics, omics, pathway, protein structure, chemistry and clinical evidence sources, can split the work across parallel subagents, and synthesize sourced conclusions.

Build with OpenAI best practices inside Codex: call the OpenAI API, build and deploy agents with the Agents SDK, create ChatGPT apps and prepare submission materials, and create API keys directly. Maintained by OpenAI; Codex only.

Manage Kubernetes clusters in natural language: translates intent into kubectl operations and runs them, and can serve as an MCP server for other agents. Uses Gemini by default (API key required) and also supports OpenAI and local models. Maintained by Google Cloud.

Open-source LLM evaluation platform: one opencompass command picks the model and datasets and runs the evaluation across hundreds of benchmarks. Works with local Hugging Face models and API models, with vLLM and LMDeploy for faster inference.

A more intuitive find-and-replace tool than sed: uses JavaScript/Python-style regex syntax, supports literal string mode and in-place file edits, which suits agents doing bulk text rewrites.

Turns articles, reports, papers or notes into a .pptx of full-slide images with speaker notes, in 12 styles such as lectures and thesis defenses; slide text is not editable. Needs Python 3; uses Codex's built-in image generation, or an OpenAI-compatible image API key in Claude Code.

Converts and two-way syncs Jupyter notebooks with plain Python scripts or Markdown, so agents can edit research and teaching notebooks like ordinary text and diffs stay readable. Needs a local Python environment; install with pip.

Cleans a LaTeX project before arXiv submission: removes comments, auxiliary files and unused .tex files and images, and can compress images, so internal notes are not published with the source. From Google Research; installable with Homebrew on macOS.

Python library and CLI for extracting main web content: fetches pages, crawls via sitemaps and RSS feeds, strips headers, footers and other noise, and outputs TXT, Markdown, JSON, XML and more with metadata. Also processes downloaded HTML offline.

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

Anthropic's official OS-level sandbox CLI: restricts file and network access for agents, MCP servers and any command without containers, using sandbox-exec on macOS and bubblewrap on Linux. Currently a research preview.

One command extracts or summarizes web pages, PDFs, YouTube videos, podcasts and media files, with JSON output. Summaries can use many model APIs, local models or a logged-in Codex or Claude CLI; plain extraction needs no key. Also has a browser sidebar extension.

Open-source alternative to NotebookLM's podcast feature: turns web pages, PDFs, images, YouTube videos or text into two-host conversational audio, useful for lecture notes or articles. Uses Gemini and OpenAI API keys by default, or local models plus free Edge TTS.

Open-source offline machine translation built on OpenNMT, usable as a CLI, Python library or GUI. Download language packages as needed; when no direct model exists it pivots through an intermediate language. Suits text you would rather not upload to the cloud.

14 n8n workflow skills: expression syntax, MCP tool usage, node configuration, validation and troubleshooting, Code nodes, AI Agent workflows and self-hosted n8n deployment. Meant to be used with the n8n-mcp server.

Veteran suite of CSV command-line tools: in2csv converts Excel and JSON to CSV, csvcut, csvgrep and csvsort filter and sort, csvstat computes statistics, and csvsql runs SQL directly against CSV files.