Skip to content

Browse Secure Claude Skills

Search verified agent skills and review security grades before installing · full A–Z index

Visual PrAPosts a concise visual outline as a GitHub pull request comment. Use only when the user explicitly asks for visual-pr.developmentgobashVotes: 0GitHub stars: 123
Comprehension LadderA[UDS] Turn one hard-to-follow AI output into easier forms: controlled text, a Mermaid diagram, a single-file HTML explainer. All forms come from one shared outline, so the form changes and the facts do not. Use when: an AI explanation, spec or code walk-through is too dense to judge, a non-specialist must approve something from it, you want a diagram or an offline explainer page of it. Not for: writing new content or adding analysis — this skill only re-forms a text that exists; generating do...developmentrustgoVotes: 0GitHub stars: 76
Comprehension LadderA[UDS] 把一段难懂的 AI 输出换成较好懂的形式：受控文字、Mermaid 图、单文件 HTML 解说页。所有形式都来自同一份大纲，所以形式会变，事实不会变。 Use when: AI 的说明、规格或代码解说太密、读的人看不出该不该核准；非专业的人必须靠它做核准；想要它的图或离线解说页。 Not for: 写新内容或加新分析——本技能只把既有的文字换形式；从源代码产生文档——请用 /docgen；为专家读者缩短文字——直接改写即可。 Keywords: comprehension ladder, explainer, controlled language, Mermaid, HTML explainer, outline, plain language, understand AI output, 理解阶梯, 受控语言, 流程图, 解说页, 换形式不换事实.developmentdocumentationVotes: 0GitHub stars: 76
Comprehension LadderA[UDS] 把一段難懂的 AI 輸出換成較好懂的形式：受控文字、Mermaid 圖、單檔 HTML 解說頁。所有形式都來自同一份大綱，所以形式會變，事實不會變。 Use when: AI 的說明、規格或程式碼解說太密、讀的人看不出該不該核准；非專業的人必須靠它做核准；想要它的圖或離線解說頁。 Not for: 寫新內容或加新分析——本技能只把既有的文字換形式；從原始碼產生文件——請用 /docgen；為專家讀者縮短文字——直接改寫即可。 Keywords: comprehension ladder, explainer, controlled language, Mermaid, HTML explainer, outline, plain language, understand AI output, 理解階梯, 受控語言, 流程圖, 解說頁, 換形式不換事實.developmentdocumentationVotes: 0GitHub stars: 76
Video EditingACut, normalize, caption, and inspect short-form video and audio with ffmpeg, or analyze a reel from its actual media. Use when a clip, recording, or reel URL is supplied and the deliverable is an edit or an analysis of the footage. Writing captions or posts needs no skill.developmentgoVotes: 0GitHub stars: 29
Codex PetABuild or repair a Codex pet sprite atlas with the deterministic assembly and QA pipeline. Use only for Codex pet assets; general image or media work needs no skill.developmentVotes: 0GitHub stars: 29
Secret SerializationAFinds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stri...developmentjavascripttypescriptVotes: 0GitHub stars: 1,037
TasksA**Outcome** The audit method in [`../docs/research/R8-context-economy-for-coding-agents.md`](../docs/research/R8-context-economy-for-coding-agents.md) becomes something another project invokes rather than reads: a skill that runs the sixteen steps in two phases, walks the `F1`–`F5` checklist, and produces the two documents. **Packaging, not rewriting** — if it turns into a rewrite, the shaping rules failed and that is the finding.developmentrustgoVotes: 0GitHub stars: 2
UpstreamA> **Handover record — sent 2026-08-14.** > **Route:** one issue on this project's own repository, > [`uchimata2/handoff-skill#75`](https://github.com/uchimata2/handoff-skill/issues/75). The body is > this document with its links made absolute; the rows are identical. > **The route is retired for anything found after 2026-08-15** ([T-164](../../tasks/T-164-retire-the-cross-repo-register-in-favour-of-a-branch.md)): > the next defect this project finds in the handoff skill arrives as a branch wi...developmentgoshellVotes: 0GitHub stars: 2
Preflight AuditAAudit an app for security holes before it ships, then fix them and prove the fix. Use when the user asks if the app is safe or ready to launch, wants a security review or pre-deploy check, pasted or exported an app from Lovable, Bolt, v0, Cursor or Claude Code, or asks to harden Supabase, Firebase, Stripe, auth, uploads, dependencies or API keys. Reads the whole project, no git history needed.developmentpythonrustVotes: 0GitHub stars: 2
Golden AgentsAUse when initializing a new git repo with AI guidance, upgrading existing repos with inadequate AI guidance, or when user says "set up AI guidance" or "add AGENTS.md" - detects repo state and offers appropriate workflow.developmentjavascriptpythonVotes: 0GitHub stars: 8
Test Driven DevelopmentAUse when implementing any feature or bugfix, before writing implementation codedevelopmenttypescriptgoVotes: 0GitHub stars: 8
Swift IosAOpinionated rules for production native iOS apps in Swift and SwiftUI, covering the Observation framework, Swift concurrency (async/await, actors, Sendable), URLSession networking against a JSON API, Keychain credential storage, StoreKit 2 purchases with server-side entitlements, testing, and App Store / TestFlight release workflows. Use when building or reviewing SwiftUI views, view models, networking, authentication, in-app purchases, concurrency code, or preparing an App Store submission.developmentgoswiftVotes: 0GitHub stars: 2
Python FastapiAOpinionated rules for production Python APIs built with FastAPI, Pydantic v2, SQLAlchemy 2.0 (async), Alembic, and PostgreSQL, including JWT/OAuth authentication, authorization, error handling, pagination, background jobs, and testing. Use when creating or reviewing FastAPI endpoints, request/response schemas, services, database access, dependencies, auth, settings, workers, or API tests, or when debugging slow or failing API requests.developmenttypescriptpythonVotes: 0GitHub stars: 2
PostgresqlAOpinionated rules for PostgreSQL and PostGIS behind an application API, covering schema design, constraints, indexing, query optimization, transactions and concurrency, cursor pagination, zero-downtime migrations with Alembic, and geospatial queries. Use when designing tables, writing or reviewing migrations, adding indexes, reading EXPLAIN output, fixing slow queries or lock contention, handling race conditions, or implementing location and radius search.developmentgosqlVotes: 0GitHub stars: 2
Nextjs FrontendAOpinionated rules for production Next.js App Router frontends built with React, TypeScript, Tailwind CSS, shadcn/ui, TanStack Query, and Zustand, talking to a separate backend API. Use when creating or reviewing pages, layouts, Server and Client Components, Server Actions, Route Handlers, proxy/middleware, data fetching, caching, mutations, forms, or client state, and when deciding where frontend logic and state should live.developmentjavascripttypescriptVotes: 0GitHub stars: 2
Fullstack ArchitectACoordinates system-level decisions for production applications built with Next.js, FastAPI, PostgreSQL/PostGIS, Expo, and native iOS, and delegates layer details to the nextjs-frontend, python-fastapi, postgresql, expo-react-native, and swift-ios skills. Use when starting a new product or a feature that spans more than one layer, designing an architecture, choosing how web and mobile share an API, or deciding on authentication, authorization, API contracts, validation, caching, pagination, ba...developmentjavascripttypescriptVotes: 0GitHub stars: 2
Expo React NativeAOpinionated rules for production Expo and React Native apps using Expo Router, TanStack Query, Zustand, EAS Build, EAS Update, and EAS Submit, including secure token storage, push notifications, deep linking, permissions, native dependencies, and App Store / Play Store release workflows. Use when building or reviewing Expo screens, navigation, data fetching, auth, notifications, links, or permissions, when adding a native dependency, or when deciding whether a change ships as an OTA update or...developmentjavascriptrustVotes: 0GitHub stars: 2
Pixel Call PathATrace a named code entry to a named destination when the request asks how execution reaches that point; exclude generic explanations, text searches, and edits.developmentVotes: 0GitHub stars: 26
AssetsAMake fast bounded classification decisions through `pixel classify` — labels plus per-label criteria in, a calibrated probability distribution and confidence out. Use when a task or a harness needs a typed judgment — intent routing, risk scoring, yes/no gates, triage, severity grading — without writing Jev integration code. Also use when building or improving an agent harness that should route, gate or grade on cheap model verdicts.developmenttypescriptrustVotes: 0GitHub stars: 26