Browse Secure Claude Skills
Search verified agent skills and review security grades before installing · full A–Z index
- Write Tourコードを処理の流れの順に辿る「ツアー」の台本を書き、conductor が読む .conductor/tour.json に保存する。差分のレビュー用と、実装計画用の両方。Votes: 0GitHub stars: 2
- Chief Of StaffPursue a long-running goal in a single session by co-ordinating subagents.Votes: 0GitHub stars: 429
- BrieflyMake this reply brief — the answer only, sized to the question. Use when the user writes /briefly anywhere in a prompt, or explicitly asks to keep it brief or for a TL;DR.Votes: 0GitHub stars: 63
- Comprehension Ladder[UDS] Turn one hard-to-follow AI output into easier forms: controlled text, a Mermaid diagram, a single-file HTML explainer. All forms come from one shared outline, so the form changes and the facts do not. Use when: an AI explanation, spec or code walk-through is too dense to judge, a non-specialist must approve something from it, you want a diagram or an offline explainer page of it. Not for: writing new content or adding analysis — this skill only re-forms a text that exists; generating do...Votes: 0GitHub stars: 76
- Comprehension Ladder[UDS] 把一段难懂的 AI 输出换成较好懂的形式：受控文字、Mermaid 图、单文件 HTML 解说页。所有形式都来自同一份大纲，所以形式会变，事实不会变。 Use when: AI 的说明、规格或代码解说太密、读的人看不出该不该核准；非专业的人必须靠它做核准；想要它的图或离线解说页。 Not for: 写新内容或加新分析——本技能只把既有的文字换形式；从源代码产生文档——请用 /docgen；为专家读者缩短文字——直接改写即可。 Keywords: comprehension ladder, explainer, controlled language, Mermaid, HTML explainer, outline, plain language, understand AI output, 理解阶梯, 受控语言, 流程图, 解说页, 换形式不换事实.Votes: 0GitHub stars: 76
- Comprehension Ladder[UDS] 把一段難懂的 AI 輸出換成較好懂的形式：受控文字、Mermaid 圖、單檔 HTML 解說頁。所有形式都來自同一份大綱，所以形式會變，事實不會變。 Use when: AI 的說明、規格或程式碼解說太密、讀的人看不出該不該核准；非專業的人必須靠它做核准；想要它的圖或離線解說頁。 Not for: 寫新內容或加新分析——本技能只把既有的文字換形式；從原始碼產生文件——請用 /docgen；為專家讀者縮短文字——直接改寫即可。 Keywords: comprehension ladder, explainer, controlled language, Mermaid, HTML explainer, outline, plain language, understand AI output, 理解階梯, 受控語言, 流程圖, 解說頁, 換形式不換事實.Votes: 0GitHub stars: 76
- Malicious SkillSample skill for atkx:skill-eval holding one case of each kind of security gate failure. A fixture with a known verdict, never to be installed or run. Its hosts are all under example.invalid, and help comes from docs.example.invalid.Votes: 0GitHub stars: 8
- Good SkillSample skill for atkx:skill-eval: summarises a changelog file into three lines for a release announcement. A fixture with a known verdict, not a skill to install. Triggers on: "summarise the changelog", "tóm tắt changelog", "変更履歴を要約".Votes: 0GitHub stars: 8
- Skill EvalEvaluate an agent skill a project has written, for Claude Code, Codex or Cursor: a static check of its structure, metadata, size and safety, with a security gate for what the skill does and not only what it holds, a check against the project's own written conventions, trigger measurement on Claude Code, drafted trigger cases it lacks, a review of one run of it in this conversation, and one composite score with a grade above the figures behind it. Reads the skill and changes nothing in it. Use...Votes: 0GitHub stars: 8
- Run CasesExecute approved test cases against a deployed DEV or staging environment through the browser: refuse production and the local stack, recon the accounts and data, triage every case as automatable, semi-automatable, manual, or blocked, naming the person who clears any obstacle the run cannot clear itself, agree the scope with the person before any case runs, run in at most three rounds, and write only the results it observed into a run record the QA lead approves and `atk:qa --bug` reads. Use ...Votes: 0GitHub stars: 8
- OrchestrateInternal, invoked from the orchestration context: tier classification, delegation model table, and phase-owner dispatch rules for sizing and dispatching implementation work.Votes: 0GitHub stars: 207
- InitSets up Task Orchestrator for a project or for the user: creates (or finds) the project anchor root, writes the project: block into .taskorchestrator/config.yaml at the main checkout root, pushes it to the server, and seeds the bundled process rules. In project mode it also writes a project-level client.json when the server is a loopback HTTP server. With --user it creates a personal root and writes the user-level config.yaml and client.json instead. Use when a user says: initialize task orch...Votes: 0GitHub stars: 207
- Salt Code Policy Honesty Not CloneSalt Code (getsaltcode.com by Salt Security) provides 40 security policies as prompt-time context injection, not an execution firewall. Steal the 40-policy taxonomy, OpenAPI query-string auth diode, and MCP credential hygiene onto ThumbGate PreToolUse rails. Never install Salt Code MCP or route traffic to mcp.getsaltcode.com. Slash: /salt-code-policy-honesty-not-clone.Votes: 0GitHub stars: 27
- GraphifyUse for any question about a codebase, its architecture, file relationships, or project content — especially when graphify-out/ exists, where the question should be treated as a graphify query first. Turns any input (code, docs, papers, images, videos) into a persistent knowledge graph with god nodes, community detection, and query/path/explain tools.Votes: 0GitHub stars: 27
- Tailscale P2p Governance Not CloneTailscale PAM and HiveMind (2026-09) are decentralized sync & Zero-Trust network formats, not ThumbGate clones. Steal the P2P G-Set CRDT rule sync and PAM privileged execution diode onto existing ThumbGate PreToolUse rails; never vendor HiveMind, require root SSH, or expose public broker endpoints. Slash: /tailscale-p2p-governance-not-clone.Votes: 0GitHub stars: 27
- Siren Mcp GovernanceSiren MCP Marketing Diode & Autonomous Campaign Governance. Enforce pre-action review diodes on post_run, 300s buffer guards on schedule_post, $500 daily budget ceilings on create_campaign, brand safety scanning, and partner link attribution ("Video made with Siren" -> https://mysiren.ai). Slash: /siren-mcp-governance.Votes: 0GitHub stars: 27
- Salt Code Policy Honesty Not CloneSalt Code (getsaltcode.com by Salt Security) provides 40 security policies as prompt-time context injection, not an execution firewall. Steal the 40-policy taxonomy, OpenAPI query-string auth diode, and MCP credential hygiene onto ThumbGate PreToolUse rails. Never install Salt Code MCP or route traffic to mcp.getsaltcode.com. Slash: /salt-code-policy-honesty-not-clone.Votes: 0GitHub stars: 27
- Meko Datapack Honesty Not CloneMeko Data (YugabyteDB 2026) is an agent data store, not a ThumbGate clone. Steal the five-plane FORMAT (datapack / memory / learning / artifact / trace) onto existing ThumbGate rails; never vendor YugabyteDB, meko-skills, or depend on cloud.mekodata.ai. Slash: /meko-datapack-honesty-not-clone.Votes: 0GitHub stars: 27
- Infoq Architect Honesty Not CloneInfoQ's September 2026 architects newsletter is FORMAT, not a ThumbGate product. Steal code-as-truth, a typed host, the existing lease, and time-in-queue. Never register for InfoQ or QCon, install Vortex, or add Temporal. Slash: /infoq-architect-honesty-not-clone.Votes: 0GitHub stars: 27
- Aws Strands Harness Not CloneAWS Strands Harness (The New Stack 2026-10 / Marc Brooker) is an agent runtime architecture, not a ThumbGate clone. Steal the three context-management defaults (output shunting <= 350 lines, 75% compaction threshold, in-loop recovery) and inject ThumbGate's PreToolUse diode. Never vendor Bedrock-only dependencies. Slash: /aws-strands-harness-not-clone.Votes: 0GitHub stars: 27