Tools

Static security analysis for CI/CD config: finds template injection, credential leaks, excessive permissions and more in GitHub Actions workflows, also covers Dependabot and pre-commit configs, and auto-fixes some findings.

Veteran suite of CSV command-line tools: in2csv converts Excel and JSON to CSV, csvcut, csvgrep and csvsort filter and sort, csvstat computes statistics, and csvsql runs SQL directly against CSV files.

Generates template-driven charts as single-file HTML: picks a chart from real Lupi, Basics, Glance, Maps and Interactive gallery implementations based on data shape, or fills one of 12 Chinese and English report templates. Defaults to Mono grayscale with semantic color presets. Written in Chinese.

Google's official skills for building ADK agents: dev workflow, scaffolding, the ADK Python API, evaluation with LLM judges and adaptive rubrics, deployment to Agent Runtime, Cloud Run or GKE, publishing and observability. Works with agents-cli; local dev needs only an AI Studio key.

Posit's open-source scientific and technical publishing system built on Pandoc: embed Python, R or Julia code in Markdown or Jupyter notebooks, then quarto render produces HTML, PDF, Word, slides, websites and books.

Semi-automated research workflow for computer science and AI researchers: ideation, Zotero literature management, experiment analysis and reports, paper writing and polishing, and rebuttals, with optional Obsidian knowledge base. 40+ skills; also installable as a Claude Code plugin.

Semi-automated research assistant for CS and AI researchers that links ideation, Zotero literature management, experiment analysis and reporting, paper writing and reviewer responses, and keeps project knowledge in Obsidian. Branches for Codex and other agents exist.

250+ MCP tools for Ghidra: decompilation, cross-references, data-flow analysis, bulk renaming and commenting, P-code emulation and live debugging, with headless mode support. Requires Java 21 and Ghidra 12.1, and the plugin must be built and deployed first.

Anthropic's official OS-level sandbox CLI: restricts file and network access for agents, MCP servers and any command without containers, using sandbox-exec on macOS and bubblewrap on Linux. Currently a research preview.

From the FinanceToolkit author: computes ratios, valuation, risk and macro indicators with 500+ transparent formulas, for company comparisons and first-pass due diligence. Hosted, no install; enter a Financial Modeling Prep key on first connect (free tier: US stocks, 5 years). Verify results.

LM Studio's official CLI: list, load and unload local models, start and stop the local API server, and check status and logs; ls, ps and other commands support --json output for scripts and agents. Requires the LM Studio desktop app.

Detects shot changes in video and splits long footage into scenes, exporting cut lists and per-scene thumbnails, useful for shot analysis, organizing footage and finding edit points. Runs locally; needs Python 3.10+, plus FFmpeg or mkvmerge for splitting.

Classic CLI for reading and writing metadata in hundreds of file types including images, video, audio and PDF, covering EXIF, GPS, IPTC, XMP and camera makers' proprietary tags, with batch editing, stripping and conversion. Requires Perl.

CLI and TypeScript runtime for discovering and calling MCP servers from the terminal and scripts: list tool signatures and call tools directly, or generate a standalone CLI or typed client from a server. Auto-imports existing MCP configs from Claude Code, Codex and others.

Draws bar charts, histograms, line charts, scatter plots and box plots in the terminal from CSV/TSV on stdin, so you can glance at data distributions at the end of a shell pipeline. The command is uplot.

Empirical social science skills from Stanford REAP and CoPaper.AI, bundling 77 in-house and third-party collections: topic selection, literature reviews, DID/RD/IV identification, regression tables in Python, Stata or R, robustness audits and paper writing. Stata flows need Stata installed.

Generates 26+ chart types with AntV, including line, bar, Sankey, word cloud, mind map and pivot table, returning image links. Officially maintained by Ant Group's AntV team; uses a public rendering service by default and can be self-hosted.

Teaches agents to code against the latest Gemini API and Python/TypeScript SDKs: multi-turn chat, function calling, structured output, and image and speech generation, while avoiding deprecated older models. Maintained by Google's Gemini team.

Gemini API development skills: gemini-api-dev (core API and SDKs), gemini-live-api-dev (real-time bidirectional audio/video streaming) and gemini-omni-flash-api (Omni video generation and editing), filling in APIs released after model training cutoffs. Maintained by Google's Gemini team.

Create, read and modify xlsx workbooks without Microsoft Excel installed: formulas, formatting and conditional formatting, charts, pivot tables and tables. Runs locally over stdio or as a remote HTTP service.

Terminal tool for offline IP geolocation and CDN provider lookup, supporting QQwry, GeoIP2, ip2region and other databases. Pipe output from dig, nslookup and similar commands through it to annotate IPs automatically.

Open-source marketing plugin with 48 skills: SEO and AI search optimization (GEO), GA4 and Search Console analysis, ad diagnostics for Google, Meta, X, LinkedIn, Reddit and TikTok, and WordPress upkeep. Some SEO skills need only a URL; live data requires NotFair OAuth and linked accounts.

Knownsec's open-source Python-use agent: describe a task in plain language and it writes and runs Python on your machine, e.g. tidying Excel files, summarizing attendance or screening resumes. Needs Python 3.11+ and a model API key such as DeepSeek; code runs locally, so back up important files.

Hugging Face's official hf CLI: search, download and upload models and datasets, manage repos and storage buckets, and run jobs on Hugging Face's cloud. Output adapts automatically for agents, and hf skills add installs companion skills. Uploads and similar actions need a login.