ツール

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

Collection of 2,400+ installable SKILL.md skills across development, security, cloud and ops, AI, marketing and more, with the AAS Core local MCP and an installer that help agents search, pick skills and preview install plans. Formerly antigravity-awesome-skills.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Compliance skill from Anthropic's official operations plugin: maps controls, owners and evidence for SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, schedules audits, runs gap analyses, and outputs audit-readiness checklists and evidence collection plans. Have legal or compliance experts review.

Runs an extremely strict maintainability review of the current branch: hunts for restructurings that make the change dramatically simpler and flags files pushed past 1,000 lines, ad-hoc conditionals, thin wrappers and needless casts. From Cursor's official plugins; invoke manually.

Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Explains the current topic visually with the smallest view that makes the point: pseudocode, call trees, component or file trees, Mermaid diagrams or diffs, and a focused HTML diagram or short deck when the idea is too dense. Invoked manually.

Interviews you to design an agentic control loop for your codebase in control-theory terms: a set point, a sensor built from existing tooling, a controller that picks small low-risk changes, and a coding agent that opens PRs. Builds each part to run locally before wiring a scheduled CI workflow.

Skills for solving CTF challenges across web, pwn, crypto, reverse engineering, forensics, OSINT and malware analysis, plus a script that installs common CTF tools in one go. Follows the Agent Skills spec and installs with npx skills.

Draws a code change or part of a codebase as an animated architecture or data-flow diagram. The agent writes a JSON graph, validates and renders it to SVG with the PR Lens CLI, then pushes it to a prlens.dev canvas or attaches it to a GitHub, GitLab or Bitbucket pull request.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.

250+ human-reviewed legal skills from practicing lawyers, in-house counsel and academics, mostly US and EU law: compliance, GDPR, legal research, litigation, contract review and drafting, the EU AI Act. Install all or pick one; output is a draft for a lawyer to review.

Elastic's official skills teaching agents to use Elasticsearch and Kibana correctly: index design, ES|QL queries, search relevance tuning, dashboards, observability troubleshooting and security alert triage. Currently a technical preview.

200+ skills for construction firms: export Revit, IFC and DWG quantities to Excel, estimate with international unit rates, produce daily and photo site reports, and track budget and schedule variance. Needs Python 3.9+; Revit/DWG conversion is Windows-only; some need Docker or an OpenAI key.