ツール

Skills from security firm Trail of Bits: 40+ plugins for code auditing, CodeQL and Semgrep static analysis, differential review, smart-contract and cryptography audits, fuzzing and more. Also installable as a Claude Code or Codex plugin marketplace.

Collection of 2,400+ installable SKILL.md skills across development, security, cloud and ops, AI, marketing and more, with the AAS Core local MCP and an installer that help agents search, pick skills and preview install plans. Formerly antigravity-awesome-skills.

The 180+ skills bundled with the 90+ plugins in the wshobson/agents marketplace, covering development across many languages and frameworks, testing, ops, security, data and LLM apps. Install individually with npx skills or gh skill; skills only, without subagents or commands.

EU GDPR compliance skill covering lawful bases, consent management, access and deletion requests, data retention and breach notification, with checklists and sample code so legal and engineering can review privacy together. No account or API key; have a lawyer check conclusions.

Community-maintained cybersecurity skill library: 800+ skills across 34 domains including threat hunting, incident forensics, penetration testing and cloud security, mapped to MITRE ATT&CK and NIST CSF. Not by Anthropic; offensive skills are for authorized testing only.

Compliance skill from Anthropic's official operations plugin: maps controls, owners and evidence for SOC 2, ISO 27001, GDPR, HIPAA and PCI DSS, schedules audits, runs gap analyses, and outputs audit-readiness checklists and evidence collection plans. Have legal or compliance experts review.

Anthropic's official data skill that guides agents to write, translate and optimize SQL across Snowflake, BigQuery, Databricks, PostgreSQL and other warehouse dialects, including CTEs, window functions and analytical aggregations.

Manages BigQuery datasets, tables and jobs with the bq and gcloud CLIs, runs SQL queries and loads data, with references for client libraries, MCP and Terraform. Google's official skill; requires a Google Cloud project.

Google's official skill library, focused on Google Cloud: 100+ skills for gcloud, Cloud Run, GKE, BigQuery, IAM, monitoring and logging, and the Well-Architected Framework, plus Ads and Analytics.

Teaches agents the Hugging Face Hub CLI hf: search and download models, manage datasets, Spaces, Buckets and repos, and run Jobs and inference endpoints. The skill content is generated from your local CLI, so install hf first. Maintained by Hugging Face.

Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.

Skills for solving CTF challenges across web, pwn, crypto, reverse engineering, forensics, OSINT and malware analysis, plus a script that installs common CTF tools in one go. Follows the Agent Skills spec and installs with npx skills.

Postgres rules ranked by impact: query optimization, indexing, connection pooling, RLS security, schema design and lock troubleshooting, with wrong-vs-right SQL examples, applicable to any Postgres. Maintained by Supabase.

Skills Sentry's engineering team uses itself: code review, bug finding, security review, writing commits and PRs, and iterating on a PR until CI passes. Maintained by Sentry; some skills follow its internal conventions.

250+ human-reviewed legal skills from practicing lawyers, in-house counsel and academics, mostly US and EU law: compliance, GDPR, legal research, litigation, contract review and drafting, the EU AI Act. Install all or pick one; output is a draft for a lawyer to review.

dbt Labs' official skills: write and edit dbt models, add unit tests and docs, set up the MetricFlow semantic layer, debug failed jobs, and handle dbt version upgrades and cross-platform migrations. Most skills need dbt installed and an existing project.

Helps agents write geospatial SQL for PostGIS, DuckDB, BigQuery and Snowflake: inspect schemas and keep query costs in check, then render results as interactive maps to review and correct. Needs Python and your own database or warehouse; maps use Dekart, which can run locally in Docker.

Official DuckDB skills: query local or S3 CSV, Parquet, Excel and JSON files with SQL or plain language, attach databases, convert formats, analyze spatial data and look up documentation. Needs the DuckDB CLI; tested only on macOS and Linux.

Elastic's official skills teaching agents to use Elasticsearch and Kibana correctly: index design, ES|QL queries, search relevance tuning, dashboards, observability troubleshooting and security alert triage. Currently a technical preview.