Claude Skills
The open format is called Agent Skills and works in Claude Code, Codex, Cursor and other agents — most people know it as Claude Skills.
Every Agent Skill we could find on GitHub, deduplicated by content. 86 696 files from 2 113 authors, of which 68 413 are unique — the rest is the same skill repackaged into someone else's repository. For each one: what it weighs in tokens, whether it ships runnable scripts, and which MCP servers it needs.
Consulte sur le système de design d'un produit et produit `docs/DESIGN.md` + un preview HTML (spécimen typo + palette + 1 mockup d'écran). Propose un système cohérent et opinioné (aesthetic, typographie, color, layout, spacing, motion) avec breakdown SAFE/RISK. Utilise sur /design, "crée le design system", "écris DESIGN.md", "design depuis zéro", "système de design", "design consultation", "fais-moi un design system", ou dès qu'il faut formaliser l'identité visuelle d'un projet. Pair naturel de /cadre (PRD amont) et /planifie (plan d'impl aval).
Commit les changements, se synchronise avec main distant, push la branche courante et crée une Pull Request. Refuse de tourner directement sur main. Utilise sur /livre, ou quand l'utilisateur veut livrer/expédier son travail : \"commit et push\", \"ouvre une PR\", \"livre ça\", \"ship\", \"envoie la PR\", \"finalise et pousse\". Aval naturel de /branche.
Découper un PRD en phases indépendamment livrables par tranches verticales (tracer bullets), puis produire ou étendre `docs/PLAN.md` selon un template fixe (décisions architecturales + phases avec user stories, livrable, critères d'acceptation, dépendances). Utilise sur /planifie, "découpe le PRD", "fais le plan d'implémentation", "casse-moi ça en phases", "écris le plan", "étends le plan", "tracer bullets", "vertical slices", ou dès qu'il faut transformer un PRD en plan d'exécution versionné. Aval naturel de /cadre.
Compact the current conversation into a handoff document for another agent to pick up.
> Skill routing and workflow orchestration. Selects Inline Plan or Spec-backed Plan, routes to the correct workflow skill, and manages transitions between phases. Use when starting any conversation or task to determine which planning mode and skill apply.
> Implementation subagent dispatch patterns. Use when independent implementation work is available and subagents can execute it. Covers parallel dispatch, shared-tree patch snapshots, one combined review per completed batch, and serial integration.
Configure a repository for Atelier's development workflow. Use only when explicitly invoked; inspect existing guidance, issue-tracker and domain-document conventions, preview the proposed configuration, and write only after approval. It does not install Atelier or initialize external tooling.
> comments, and merge. Triggers on "open a PR", "make a PR", "merge this PR", "merge the MR", "read PR comments", "leave a comment on the PR", "respond to a comment", "ship this", or when a feature branch is ready for review.
Generate and validate conventional commit messages following the conventionalcommits.org spec. Use whenever the user wants to commit code, mentions commit messages, git commit, or asks to create a commit. Triggers on "commit", "git commit", "conventional", or when reviewing commit message format.
Multi-agent code review with parallel specialized reviewers, architecture validation, and challenge validation. Use `rq` to request a review of diffs (defaults to main branch), `rs` to respond to review findings. Triggers on "review this", "review my code", "code review", "check for bugs", "audit this", when examining PRs, pull requests, branches, or diffs. Always asks user before applying fixes.
> Disciplined debugging methodology. Triggers on bug reports, test failures, "debug this", "diagnose this", unexpected behavior, build failures, integration issues, or performance regressions. Find root cause before a permanent corrective fix; contain urgent harm safely first.
> Build and sharpen a project's domain model. Use when the user wants to pin down domain terminology or a ubiquitous language, record an architectural decision, or when another skill needs to maintain the domain model.
> Grill the user relentlessly about a plan, decision, or idea, maintaining the project's domain model (CONTEXT.md, ADRs) as decisions crystallise. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
> Conversational design workshop for substantial work. Interviews the human one question at a time, explores 2-3 approaches with trade-offs, and presents the design section by section for approval before writing the spec. Combines requirements discovery with codebase research and architecture design. Use when the user explicitly requests a spec or when atelier-orchestrator selects a Spec-backed Plan. Ambiguous design or discovery requests route through atelier-orchestrator.
> Execute an approved Spec-backed Plan from plan.json. Uses task tracking when useful, enforces TDD, and reports between batches. Trigger when the user says "implement", "go", "start", or "do it" after approving a persisted plan. Do NOT use without an approved Spec-backed Plan.
> Write approved implementation plans in one of two modes. Explicit Inline mode creates a conversational plan for bounded work. Spec-backed Plan converts an approved design.md into plan.json and optional tracked tasks. Trigger after atelier-orchestrator selects a mode, when the user asks to plan work, or after spec-brainstorm completes. Direct invocation without a selected mode uses Spec-backed Plan. Do NOT use for research or execution.
> Post-implementation completion workflow for Spec-backed Plans. Use after spec-implement completes to validate, review, create stacked commits, and open a PR via code-pull-request. Triggers only with an active Spec-backed Plan after spec-implement completes, including when the user says "finish", "done", or "complete" in that context.
>- Crawl an entire documentation or design-system website into one LLM-ready Markdown corpus. Discovers every page from the site's sitemap.xml (with a same-origin link-following fallback when there is no sitemap), extracts each page's main content as clean Markdown, downloads each page's images (and inline base64 images) into a local folder referenced by relative paths, and renders JavaScript-heavy pages with a headless browser. Use this whenever someone wants the WHOLE of a multi-page docs site, design-system site, API reference, component library, or knowledge base turned into Markdown — for example "crawl this docs site", "turn this design system site into markdown", "make an LLM or RAG corpus from these docs", "mirror the entire documentation", "archive the whole knowledge base", or "give an AI the full X documentation". It applies even when the user never says the word "crawl" — any request to capture, ingest, archive, or convert a whole site's documentation pages into text fits. The design-md skill also calls it during research to gather a brand's published design-system docs. Do not use it for reading or summarizing a single page, for scraping structured data such as prices into a spreadsheet, or for generating a sitemap.
Pull a Korean brand's published design.md from the ko-design-md catalog (getdesign.kr) and apply its design language — colors, typography, spacing, radius, components, do's & don'ts — to the UI you are building in the CURRENT project. Use this skill whenever the user wants to build or restyle UI in the *style of* a catalogued Korean service — phrases like "토스 디자인으로 만들어줘", "당근 스타일로 이 화면 다시 꾸며줘", "getdesign 카탈로그에서 배민 디자인 가져와서 적용", "KRDS 톤으로 폼 잡아줘", "make this look like Toss", "use the Karrot design system here", or "/use-design-md". Works in ANY repository — it fetches over the network, no local catalog needed. Do NOT use this to ADD a brand to the catalog or edit catalog entries — that is the separate `design-md` producer skill, which only runs inside the ko-design-md repo. If the requested brand isn't in the catalog, say so plainly rather than inventing a design.md.
Add a new design.md catalog entry to ko-design-md. Use this skill IMMEDIATELY when the user wants to onboard a new brand into THIS project's catalog — produce services/{slug}.md (Stitch v0.1 format) plus services/{slug}.tokens.json (token-card sidecar) plus public/preview/{slug}/{light,dark}.html plus the OG image. Trigger phrases include "add to design.md catalog", "new design.md entry for X", "onboard X to ko-design-md", "X를 ko-design-md에 추가", "X의 design.md 만들어줘", "/design-md", "X 카탈로그 항목 만들기", or any variant where the user is asking to populate this catalog with a new brand entry. Do NOT use for editing prose in an existing entry, fixing one frontmatter field, generating non-catalog design docs, or working in any other repository. The skill operates only inside the ko-design-md repo and verifies this via `package.json` name.
Generate App Store and Google Play screenshot designs. Use when the user wants to create store listing images, screenshot mockups, or promotional graphics for a mobile app. Builds on appshot-core foundation.
Foundation skill for Appshot. Defines the Remotion project architecture, primitives library, config schema, device presets, and store requirements. Owns the shared extraction phase used by appshot-videos and appshot-images.
Generate product demo videos for websites and SaaS apps using Remotion. Scans the target project's codebase, proposes custom scenes with browser mockups, and writes bespoke .tsx scene files using shared animation primitives. Web apps only. Use when the user wants to create a demo video, product walkthrough, landing page hero video, or marketing video for a website or web app. Builds on appshot-core foundation.
Generate App Store / Google Play preview videos using Remotion. Scans the target app's codebase, proposes custom scenes, and writes bespoke .tsx scene files using shared animation primitives. Mobile apps only (iOS/Android). Use when the user wants to create a demo video, app preview, promo video, or marketing video for a mobile app. Builds on appshot-core foundation.
Use when a Hermes session involves UI design, interface craft, Figma, design systems, shadcn/ui, Tailwind, Atomic Design, research synthesis, component specs, design audits, or code generation from design evidence.
Use when a task spans interface understanding, design-system memory, UI audits, design CI, Figma, shadcn or Tailwind code generation, research, or agent design workflows and needs the correct Memi capability selected.
Use when an OpenCode task involves UI design, interface craft, Figma, design systems, shadcn/ui, Tailwind, Atomic Design, research synthesis, component specs, design audits, or design-to-code generation.
Use when an OpenClaw workspace task involves UI design, interface craft, Figma, design systems, shadcn/ui, Tailwind, Atomic Design, research synthesis, design audits, component specs, or code generation from design evidence.
Use when reviewing or changing a React, Next.js, Tailwind, or shadcn interface and you need evidence-backed findings for accessibility, hierarchy, tokens, states, and responsive design before editing code.
Use when a Grok Build task involves UI design, interface understanding, Figma, design systems, shadcn/ui, Tailwind, UX audits, Atomic Design, component specs, MCP, or design-to-code generation.
Use when a repository needs deterministic pull-request checks for new accessibility, design-token, component-structure, responsive, and UI-state regressions with file-level evidence.
Use when an agent is about to build or refactor interface code and needs a compact, repository-specific brief covering existing tokens, components, routes, conventions, and verification commands.
Use when a coding agent must design, scaffold, implement, or verify an iOS or macOS SwiftUI interface with Apple-platform state, accessibility, availability, testing, and Xcode evidence.
Access to the user's Т-Инвестиции / Tinkoff (T-Invest) brokerage account via the T-Invest API — portfolio, positions, cash, quotes and prices, operations, dividends, commissions, yield/returns, bonds, stocks, funds, screeners, and trades on explicit command. Data and analytics, not investment advice. Use whenever the user asks about their own portfolio, account, securities, a quote or price, operations, dividends, returns or trading, or mentions Т-Инвестиции / Тинькофф / T-Invest or a ticker (SBER, GAZP). Data comes from the T-Invest API via the bundled CLI — do not answer from memory.
> SOC Analyst role bundle covering Tier 1 through Tier 3 operations. Orchestrates alert triage, threat hunting, incident investigation, and detection engineering workflows. Auto-invoked when the user needs help with security monitoring, alert analysis, threat hunting hypotheses, incident timelines, or detection rule development. Sequences the appropriate security skills based on the operational engagement type.
> Application Security Engineer role bundle for security design, testing, and code review of applications. Orchestrates new application reviews, PR security reviews, API security assessments, and AI feature security reviews. Auto-invoked when the user needs help with application threat modeling, secure code review, API security testing, or evaluating the security of LLM-powered application features.
> Reviews AI/ML systems for data privacy and governance risks including training data privacy, PII exposure in prompts and completions, data retention policies, model memorization risks, and regulatory compliance. Auto-invoked when reviewing systems that process personal data through LLMs, train or fine-tune models on user data, or deploy AI in regulated industries. Produces a structured assessment
> Reviews AI agent architectures for security risks including permission model design, least-privilege enforcement, human-in-the-loop gate placement, blast radius containment, audit trail completeness, rollback capability, and multi-agent trust boundaries. Auto-invoked when reviewing agentic AI systems where LLMs invoke tools, take autonomous actions, or operate in multi-agent configurations. Produces a structured architecture security assessment mapped to OWASP Agentic AI threats and NIST AI RMF 1.0.
> Reviews agentic AI systems against the OWASP Top 10 security risks for autonomous AI agents. Auto-invoked when reviewing multi-agent architectures, AI agent deployments, or systems where LLMs have tool access and act autonomously. Covers permission models, tool security, memory integrity, trust boundaries, and human oversight. Produces a structured assessment with risk ratings and architectural recommendations.
> Security Engineer role bundle for building security into products and infrastructure. Orchestrates code review, pipeline hardening, vulnerability response, and infrastructure review workflows. Auto-invoked when the user needs help with secure development practices, CI/CD security, vulnerability management, or infrastructure security assessment. Sequences the appropriate security skills based on engineering engagement type.
> Cloud Security Engineer role bundle for cloud security posture management, IaC review, container security, and identity governance across AWS, Azure, and GCP. Orchestrates cloud-specific posture reviews and zero trust program assessments. Auto-invoked when the user needs help with cloud security configuration, IaC hardening, container orchestrator security, or identity governance in cloud environments.
> Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the user asks for security program guidance, compliance assessment, risk posture evaluation, or board reporting preparation. Sequences the appropriate security skills based on engagement type.
> Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.
> Reviews LLM-powered applications against the OWASP Top 10 for Large Language Model Applications (2025 edition). Auto-invoked when reviewing code that integrates LLM APIs, builds RAG pipelines, or deploys AI-powered features. Produces a structured findings report mapped to LLM01-LLM10 with severity ratings, CWE mappings, and prioritized remediation guidance.
> Analyzes project dependencies for known vulnerabilities, license risks, and supply chain integrity. Auto-invoked when package manifests (package.json, requirements.txt, go.mod, pom.xml, Cargo.toml) are shared or when discussing dependency security. Produces an SBOM assessment with CVE findings triaged by EPSS and CISA KEV, license compliance check, and supply chain risk rating.
> Runs a structured STRIDE threat model on any system design, API specification, or codebase. Auto-invoked when the user discusses architecture, shares a system diagram or design document, or asks "what could go wrong?" Produces threat actor profiles, component-threat matrix, a threat register with STRIDE classification, data-flow diagram template, trust boundary identification, and prioritized mitigations mapped to MITRE ATT&CK techniques.
> Reviews AI/ML model supply chains for security risks including model provenance verification, training data lineage, fine-tuning pipeline integrity, inference dependency review, and backdoor detection. Auto-invoked when reviewing systems that download pre-trained models, fine-tune foundation models, or deploy models from third-party sources. Produces a structured assessment mapped to OWASP supply chain techniques.
> Covers direct injection (user input manipulating model behavior) and indirect injection (external content containing hidden instructions). Auto-invoked when reviewing LLM applications that process external content, build RAG pipelines, or accept user input that reaches a language model. Produces a test report with categorized findings and defense recommendations.
> Performs a structured security code review against OWASP ASVS 4.0.3 verification requirements and CWE Top 25. Auto-invoked on pull request reviews, when code touching authentication, authorization, cryptography, or input handling is shared. Produces findings mapped to ASVS controls and CWE identifiers with severity ratings and specific remediation guidance.
> Auto-invoked when reviewing web application code, server configurations, or when a user asks for a general security review of a web application. Produces structured findings mapped to A01-A10 with CWE references, severity ratings, and specific remediation guidance.
> Performs an Azure security posture review against the CIS Microsoft Azure Foundations Benchmark v2.1.0. Auto-invoked when reviewing Azure infrastructure, Entra ID configurations, NSG rules, Defender for Cloud settings, or Key Vault access policies. Walks through all nine benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> Performs a GCP security posture review against the CIS Google Cloud Platform Foundation Benchmark v2.0.0. Auto-invoked when reviewing GCP infrastructure, IAM bindings, VPC firewall rules, Cloud Audit Logs, or GCS bucket security. Walks through all seven benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes manifests, Helm charts, or container orchestration configurations. Evaluates image security, runtime hardening, RBAC, Pod Security Standards, network policies, and secrets management. Produces a prioritized findings report with remediation guidance.
> Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.
> Performs a HIPAA Security Rule compliance review against all Administrative, Physical, and Technical Safeguards defined in 45 CFR Part 164, Subpart C. Auto-invoked when discussing healthcare data security, ePHI protection, HIPAA audit readiness, or business associate compliance. Evaluates required and addressable implementation specifications, identifies gaps, and produces a remediation roadmap aligned to HHS enforcement priorities.
> Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail settings, VPC security groups, or RDS encryption. Walks through all five benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
> (Clauses 4-10) and all 93 Annex A controls reorganized into four themes. Auto-invoked when discussing ISO 27001 certification readiness, ISMS implementation, or Statement of Applicability development. Identifies control gaps, scores implementation maturity, and produces a remediation roadmap aligned to the 2022 revision structure.
> Performs a NIST Cybersecurity Framework 2.0 assessment across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories and subcategories. Auto-invoked when discussing cybersecurity maturity, risk posture evaluation, or NIST CSF alignment. Develops current and target organizational profiles, assesses maturity tiers, maps informative references, and produces a prioritized improvement roadmap.
> Performs a PCI DSS v4.0 compliance review across all 12 requirements and their sub-requirements. Auto-invoked when discussing payment card security, cardholder data protection, PCI compliance validation, or merchant/service provider assessment. Covers scope reduction strategies, SAQ vs ROC determination, compensating controls, customized approach, and the new targeted risk analysis requirements introduced in v4.0.
> Performs a SOC 2 Type II readiness gap analysis against AICPA Trust Services Criteria. Auto-invoked when discussing SOC 2 compliance, audit preparation, or security program maturity. Walks through all Common Criteria (CC1-CC9) plus selected additional criteria, identifies gaps, and produces a remediation roadmap with evidence requirements and 90-day action plan.
Claude Skills — questions
Answers built from the skills we actually parsed.