Testing and security skills for Claude Code.

Has the agent dispatch a fresh reviewer subagent with crafted context to check work before merging or after major tasks.

267k installs · 309k stars

review-animations

emilkowalski/skills

Reviews animation and motion code against a strict craft bar, flagging weak or unjustified motion.

267k installs · 52k stars

receiving-code-review

Has the agent verify review feedback against the codebase and push back on incorrect suggestions before implementing them.

226k installs · 309k stars

code-review-and-quality

Makes the agent review a change on five axes: correctness, readability, architecture, security, performance.

76k installs · 112k stars

code-simplification

Simplifies working code for clarity and lower complexity while keeping its exact behavior unchanged.

66k installs · 112k stars

ponytail-audit

DietrichGebert/ponytail

Audits a whole repo for bugs, security holes, load risks, untested code and bloat, as a read-only report.

181k stars

ponytail-debt

DietrichGebert/ponytail

Lists every shortcut comment in the repo as a debt ledger and flags those with no upgrade trigger.

181k stars

ponytail-review

DietrichGebert/ponytail

Reviews a diff or branch for bugs, security, load, tests, speed, and unneeded code, with fixes.

181k stars

deslop-shared-libs

Finds up to five worthwhile shared-code extractions in recent changes and recommends the best three.

138k stars

devex-review

Egonex-AI/Understand-Anything

Audits a project's live developer experience, including onboarding time and setup friction.

138k stars

archify-review

tt-a1i/archify

Judges issues, PRs and changes by value, cost and impact to guide maintenance decisions.

92k stars

simplify-codebase

tt-a1i/archify

Removes accidental complexity like dead code, duplicate state and redundant layers, backed by evidence.

92k stars

understand-diff

Analyzes git diffs against the project knowledge graph to show affected components and risks.

89k stars

remove-deadcode

Finds unused code, verifies each candidate with LSP references, and removes it through parallel agents.

70k stars

tech-debt-audit

anthropics/claude-cookbooks

Audits a codebase across nine dimensions and writes a file-cited TECH_DEBT_AUDIT.md with prioritized fixes.

70k stars

cookbook-audit

Audits an Anthropic Cookbook notebook against a style rubric and returns a score with improvement advice.

54k stars

open-code-review

alibaba/open-code-review

Runs the ocr CLI to AI-review Git diffs and produce line-level review comments, optionally applying fixes.

49k stars

open-code-review-delegate

alibaba/open-code-review

Has the host agent review code itself, using the ocr CLI only to pick files and resolve rules.

49k stars

code-review-specialist

luongnv89/claude-howto

Reviews code for security, performance, and quality issues using a checklist and metrics scripts.

46k stars

multi-reviewer-patterns

EveryInc/compound-engineering-plugin

Coordinates parallel code reviews across dimensions, deduplicating findings and calibrating severity.

42k stars

ce-code-review

Reviews a diff or PR for bugs, regressions and test gaps, and can apply the findings locally.

26k stars

review-architecture

pascalorg/editor

Reviews a PR against Pascal's package boundaries, registry model, and hook and selector rules.

25k stars

reduce-similarities

ccusage/ccusage

Runs similarity-rs to find duplicated Rust functions and types, then proposes concrete refactors.

19k stars

code-reviewer

Jeffallan/claude-skills

Reviews diffs and files for bugs, security flaws and design issues, then writes a prioritized report.

12k stars

chinese-code-review

jnMetaCode/superpowers-zh

Gives Chinese code review phrasing, severity labels and templates, and handles common team anti-patterns.

8k stars

judgment-day

Runs a blind dual review with two independent judges, then at most two scoped fix and re-judgment rounds.

8k stars

pr-improver

google/elephant-goldfish-model

Runs a review-and-fix loop on the current branch's changes until a PR review comes back clean.

8k stars

antislop-code

miqdadbadjuber/anti-slop

Removes generic AI-style code comments, keeps useful ones, and never changes the code itself.

8k stars

check

tw93/Waza

Reviews diffs, PRs, and release readiness, reporting findings before merge or publish.

7k stars

ipollowork-maintainable-code

Devin-AXIS/iPolloWork

Requires reuse-first, minimal code changes with one owner, and an audit of the diff before finishing.

7k stars

egm-drift-report

Compares design docs and READMEs with the source code and reports where they diverge.

6k stars

audit-codebase

FlorianBruniaux/claude-code-ultimate-guide

Scores a codebase across 7 health categories and produces a prioritized improvement plan.

6k stars

install-anti-slop

dmmulroy/anti-slop

Installs or updates vendored anti-slop Oxlint plugins while keeping the repo's local rule customizations.

6k stars

pr-review-analysis

breaking-brake/cc-wf-studio

Fetches GitHub PR review comments, verifies each against the code, and reports validity and actions.

5k stars

omh-ai-slop-cleaner

rlaope/oh-my-hermes

Removes AI-generated filler, dead code and duplication while keeping observable behavior identical.

5k stars

audit-flow

michael-denyer/pstack-claude

Makes the agent trace system flows across code, API, auth, data and network layers, saved to SQLite.

5k stars

writing-defect-reports

kajisho5/ffmpeg-skill

Verifies a suspected defect at the user-visible layer before filing it, and corrects published claims.

4k stars

impl-validator

Ar9av/obsidian-wiki

Independently check whether an implementation matches its goal and return PASS, WARN, or FAIL with issues.

4k stars

blast-radius

Finds what a change could break beyond the diff and proves key safety facts by running real code.

4k stars

codex-review

chaseai-yt/claudex-loop

Asks Codex to review an existing implementation plan, with Claude revising it in a bounded loop.

3k stars

process-pr-reviews

nexu-io/nexu

Triage and resolve actionable inline review feedback on GitHub PRs from CodeRabbit or Codex.

3k stars

vibe-review

KhazP/vibe-coding-prompt-template

Reviews a proposed change for regressions, missing error handling, and security issues, citing file and line.

3k stars

cursor-review

Chachamaru127/claude-code-harness

Gets an advisory second opinion on a diff from Cursor; the host reviewer keeps the final verdict.

3k stars

clean-code

ciembor/agent-rules-books

Guides the agent to write readable code with clear names, small functions, and single responsibilities.

3k stars

code-complete

ciembor/agent-rules-books

Applies construction practices for routines, variables, control flow, defensive code, and tests during implementation.

3k stars

refactoring-guru

ciembor/agent-rules-books

Diagnoses code smells and applies targeted refactorings that keep behavior intact.

3k stars

deslop

rohitg00/pro-workflow

Strips AI-generated slop, needless comments, and over-engineering from the branch diff against main.

3k stars

sol-loop

t3dotgg/tstack

Runs a bounded multi-round review loop with a second reviewer model before filing a pull request.

2k stars

fable-judge

Sahir619/fable-method

Makes the agent re-run claimed checks and diff changes to verify whether finished work is really done.

2k stars

code-review-skill

awesome-skills/code-review-skill

Guides code reviews in many languages and frameworks, covering architecture, performance and security.

2k stars

ccsn-find-simplifications

Makes the agent find evidence-backed simplification candidates in the cc-safety-net repo instead of guesses.

2k stars

ccsn-no-comments

NeoLabHQ/context-engineering-kit

Makes the agent fix cc-safety-net comment lint errors by moving each comment's meaning into code or tests.

2k stars

analyse

Picks a Kaizen method (Gemba walk, value stream or muda) and walks through analysis of the target.

2k stars

footgun-scan

maxrave-dev/kotlin-footguns

Makes the agent scan Kotlin or Compose diffs for known footgun patterns and verify each hit.

2k stars

adjudicate-review

pedrohcgs/claude-code-my-workflow

Verifies incoming review findings against the source before any fix, so correct work is not changed.

2k stars

github-review-pr

feiskyer/claude-code-settings

Reviews a GitHub pull request with parallel reviewers, verifies findings and posts the review.

2k stars

batch-review-prs-awaiting-maintainer

dyoshikawa/rulesync

Triages open PRs awaiting a maintainer, reviewing each, then commenting, filing issues, or merging.

2k stars

structured-code-review

Runs a five-stage code review covering requirements, correctness, quality, testing, and security.

2k stars

brooks-audit

Audits codebase architecture for module dependencies, layering violations, and structural decay.

2k stars

brooks-debt

Assesses tech debt, classifies maintainability problems, and ranks them into a refactoring roadmap.

2k stars

brooks-health

Scores PR quality, architecture, tech debt, and test quality together in one project health dashboard.

2k stars

brooks-review

Reviews PRs and code diffs for decay risks and design smells, citing symptom, source, consequence, and remedy.

2k stars

brooks-sweep

morganlinton/BeautifulRust

Runs all brooks-lint quality checks on a codebase and applies fixes, auto-applying safe changes and confirming risky ones.

2k stars

kicad

aklofas/kicad-happy

Analyzes KiCad projects and PDF schematics for design bugs, netlist issues, BOM data and DRC or ERC results.

2k stars

openkb-html-critic

yuezhiai/jonex

Reviews a generated single-file HTML deck and patches CSS specificity, navigation and self-containment bugs in place.

2k stars

rust-review

Reviews Rust code for idiom, API design, error handling and safety, citing the rule each finding breaks.

1k stars

greploop

michaelshimeles/rstack

Runs bounded cycles of reading Greptile review feedback and fixing PRs, MRs or changelists until the review is clean.

1k stars

code-quality-analyzer

alibaba/skill-up

Scores code on correctness, maintainability, performance and security, listing issues with fixes.

1k stars

wtf

noobnooc/agent

Audits a project before shipping or committing for secrets, schema drift, unsafe SQL and deploy blockers.

1k stars

slci-compatibility-analysis

matlab/simulink-agentic-toolkit

Checks a Simulink model's configuration for SLCI code inspection compatibility and explains the required fixes.

1k stars

clean-code-guard

amElnagdy/guard-skills

Reviews changed production code for clean code, SOLID, and LLM failure modes before it ships.

1k stars

crit

tomasz-tomczyk/crit

Runs an interactive Crit review of code, plans or pages, looping on inline human comments.

1k stars

api-contract-review

TencentCloudBase/CloudBase-AI-Toolkit

Audits CloudBase API wrappers and MCP tools against docs for wrong names, parameters and missing tests.

1k stars

codebase-audit

TencentCloudBase/CloudBase-AI-Toolkit

Audits the whole repo, files findings as GitHub issues, then fixes each in a worktree and opens PRs.

1k stars

code-reviewing

huangjia2019/claude-code-engineering

Reviews code for quality, security, performance and maintainability using a fixed checklist and report format.

1k stars

antivibe

mohi-devhub/antivibe

Explains or audits any codebase so the user learns what the code does, why, and what alternatives exist.

1k stars

consistency-auditor

zhnnky329/MathModeling-skills

Checks math modeling artifacts for consistency across numbers, symbols, decisions, files, and paper claims.

1k stars

matlab-code-reviewer

zhnnky329/MathModeling-skills

Reviews and runs MATLAB modeling code against its plan and data contract, saving a JSON review.

1k stars

openqodex

openqodex/openqodex

Reviews the current change before git push with deterministic scanners and an independent reviewer, then prints a report.

1k stars

rigorous-coding

jarrodwatts/claude-code-config

Makes the agent state assumptions, avoid unverified correctness claims, and cover edge cases.

1k stars

review-animations

AgentWorkforce/relay

Reviews animation code against strict craft standards, flagging unjustified or badly timed motion.

1k stars

mariadb-operator-pr-review

mariadb-operator/mariadb-operator

Review a mariadb-operator PR like a maintainer, checking it against AGENTS.md for safety and compatibility.

1k stars

code-review-expert

dtsola/xiaoyaosearch

Reviews current git changes for SOLID violations, security risks and performance issues, ranked P0 to P3.

1k stars

review-spd

zhu1090093659/spec_driven_develop

Runs a findings-first review of uncommitted changes, commit ranges, or branches against main.

993 stars

chisle-audit

JayPokale/Chisle

Audits a diff, file or repo for over-built code and wordy prose, then reports ranked cuts without editing.

727 stars

chisle-review

JayPokale/Chisle

Reviews a diff or file for over-engineering and reinvented stdlib, returning one finding per line.

727 stars

board

karanb192/claude-code-hooks

Renders TODO, FIXME and HACK markers as aging bounty cards, then calls out the biggest ones.

567 stars

git-review

umputun/cc-thingz

Opens the git diff in your editor for inline annotations, then fixes the code from your comments in a loop.

491 stars

code-quality

notque/vexjoy-agent

Finds dead code and stale TODOs, runs ruff, biome and mypy, and enforces multi-language quality gates.

443 stars

comment-quality

notque/vexjoy-agent

Finds and rewrites code comments that cite time or change history, keeping only current behavior.

443 stars

engineering-code-review

MiniMax-AI/mcode-stack

Reviews code changes for design, correctness, tests and maintainability, and judges whether they can merge.

442 stars

finding-duplicate-functions

obra/superpowers-lab

Finds functions that do the same job under different names, using extraction and LLM intent clustering.

435 stars

apply-findings

tobihagemann/turbo

Applies findings marked Apply, asks about ambiguous ones, and offers to note later improvements.

417 stars

assess-technical-debt

tobihagemann/turbo

Scans a project for complexity, deprecated APIs, duplication and weak tests, then writes a ranked report.

417 stars

adversarial-review

syahiidkamil/Software-Engineer-AI-Agent-Atlas

Runs hostile, context-free reviews of new code and reproduces each failure in the running app before reporting it.

404 stars

change-quiz

Neeeophytee/finding-unknowns-skills

Has the agent summarize a session's changes and quiz the user on risky interactions before merge.

358 stars

genshijin-review

InterfaceX-co-jp/genshijin

Writes one-line PR review comments with severity tags, locations, and concrete fixes.

331 stars

audit-round

Arch1eSUN/Arcgentic

Acts as an external auditor that reviews a round's handoff and commits, then writes a PASS or NEEDS_FIX verdict.

285 stars

cross-agent-review

prassanna-ravishankar/repowire

Sends your diff or plan to a peer on a different agent backend for an independent review before merging.

270 stars

abstract-domain-explorer

murphytrueman/design-system-ops

Runs abstract interpretation with interval, sign, octagon and polyhedra domains to infer variable invariants.

260 stars

github-code-review

HezaoHezao/poirot

Reviews local git diffs and GitHub pull requests, flagging issues and posting inline comments.

257 stars

code-simplifier

feiskyer/codex-settings

Simplifies recent or named code for clarity and maintainability while preserving its exact behavior.

247 stars

accessibility-per-component

Audits one design system component against WCAG 2.2 AA and reports PASS, FAIL or WARN per criterion.

212 stars

woz-kb

WithWoz/wozcode-plugin

Manages the WOZCODE review knowledge base: tunes the reviewer, runs backtests and maintains entries.

208 stars

autofix

coderabbitai/skills

Fetches unresolved CodeRabbit PR review comments and applies approved fixes one change at a time.

201 stars

auditcodex

sterlingcrispin/claude_slash_commands

Sends recent git changes to OpenAI Codex CLI for a read-only audit and reports the findings.

199 stars

auditcodexdirect

sterlingcrispin/claude_slash_commands

Sends specified files to OpenAI Codex CLI for a read-only review of bugs, security and performance.

199 stars

trace-mcp-pre-commit

nikolai-vysotskyi/trace-mcp

Runs security scan, quality gates and antipattern checks before a commit or pull request.

198 stars

lsp-concurrency-audit

blackwell-systems/agent-lsp

Audits a type for data races by tracing which fields are accessed concurrently and lack synchronization.

166 stars

senior-engineering-partner

bjgreenberg/senior-engineering-partner

Makes the agent act as a strict senior reviewer and pair programmer with security and TDD discipline.

154 stars

full-audit

undeadlist/claude-code-agents

Runs eleven audit agents in parallel, then merges their reports into a prioritized fix plan.

149 stars

agent-plugin-eval

fabricioctelles/skills

Statically audits a plugin repo against the Agent Plugins spec and gives an evidence-cited 0-100 score.

123 stars

lessloc

rextail-ai/lessloc

Finds duplicates, dead code and needless abstractions in a repo and removes them without changing behavior.

109 stars

anti-patterns

avelikiy/great_cto

Makes the agent reject known SDLC anti-patterns when reviewing architecture, plans, code or incident analyses.

108 stars

code-refactor-review

jnsahaj/skills

Reviews diffs for code reuse, composition, consistency with the codebase and unnecessary complexity.

106 stars

thermo-nuclear-code-quality-review

sergioazoc/oxlint-tailwindcss

Runs a very strict maintainability review of changes, hunting for weak abstractions and oversized files.

105 stars

Testing 130

tdd

mattpocock/skills

Guides the agent through test-driven red-green-refactor loops with rules for good tests and seams.

1.2M installs · 307k stars

google-agents-cli-eval

google/agents-cli

Runs and analyzes agent evaluations: writes datasets, scores with LLM judges, and diagnoses failures.

525k installs · 6k stars

test-driven-development

currents-dev/playwright-best-practices-skill

Has the agent write a failing test first, watch it fail, then write minimal code to pass before any implementation.

265k installs · 309k stars

webapp-testing

anthropics/skills

Has the agent write Playwright scripts to test, debug and screenshot local web apps, with a server helper.

193k installs · 185k stars

playwright-best-practices

Guides writing, debugging, and maintaining Playwright tests across end-to-end, API, visual, and accessibility testing.

100k installs · 413 stars

rea-ci-tests-audit

morluto/rea

Audits CI workflows and test suites for false passes, stale fixtures, and costs that can be cut safely.

410k stars

benchmark

Detects web performance regressions by measuring page speed and comparing it with earlier baselines.

138k stars

browser-testing-with-devtools

Makes the agent verify browser behavior via Chrome DevTools MCP: DOM, console, network, and performance.

112k stars

constraint-driven-development

Records the project's quality thresholds in CONSTRAINTS.md and flags diffs that weaken checks or skip tests.

112k stars

add-product-e2e-eval

paperclipai/paperclip

Adds or extends Paperclip end-to-end browser tests, fixtures and report evidence for the runner workflow.

109k stars

add-runner-eval

paperclipai/paperclip

Adds or extends Paperclip Runner protocol eval cases, rosters, assertions, and report fixtures with narrow validation.

109k stars

test-value

tt-a1i/archify

Trims slow, flaky or redundant tests while keeping those that protect outcomes that matter.

92k stars

codex-qa

Tests the omo Codex plugin in an isolated CODEX_HOME with a local mock model, asserting hook events fired.

70k stars

opencode-qa

QA the opencode CLI, server, plugin hooks and TUI with helper scripts, and inspect sessions in its database.

70k stars

senpi-qa

Tests the Senpi adapter and task engine against the real senpi binary in isolation, saving evidence locally.

70k stars

screen-reader-testing

Guides testing with VoiceOver, NVDA and JAWS to verify ARIA, forms and dynamic announcements.

42k stars

temporal-python-testing

Tests Temporal Python workflows with pytest, time-skipping, activity mocks and replay testing.

42k stars

wcag-audit-patterns

EveryInc/compound-engineering-plugin

Runs WCAG 2.2 accessibility audits with automated and manual checks and fix guidance.

42k stars

testing

iOfficeAI/AionUi

Applies the AionUi Vitest workflow: find risky cases first, then write behavior-focused tests in the right environment.

34k stars

dummy-dataset

phuryn/pm-skills

Generates realistic test datasets with custom columns and constraints, output as CSV, JSON, SQL, or a Python script.

28k stars

test-scenarios

phuryn/pm-skills

Writes QA test scenarios from user stories, covering steps, expected results and edge cases.

28k stars

ce-dogfood

Drives the branch's changed UI in a browser, fixes small breakages with tests, and writes a QA report.

26k stars

terminal-emulator

slopus/happy

Writes and runs terminal UI tests with @microsoft/tui-test, driving real PTY input and snapshots.

24k stars

google-mobile-ads-validate

google/skills

Audits a Google Mobile Ads integration for test IDs, SKAdNetwork IDs, adapter versions, and preloading.

22k stars

experiment-audit

wanshuiyin/Auto-claude-code-research-in-sleep

Audits experiment results for fake ground truth, score normalization fraud and thin scope before claims.

18k stars

evaluation

muratcankoylan/Agent-Skills-for-Context-Engineering

Builds agent evaluations from deterministic checks, regression suites, rubrics and baseline comparisons.

18k stars

chaos-engineer

Jeffallan/claude-skills

Plans chaos experiments, failure injection, blast radius limits, rollback steps and game day runbooks.

12k stars

test-reporting

aden-hive/hive

Runs the Hive level 2 integration test suite and writes an HTML report of each test's input and outcome.

11k stars

benchmark-workflow

xberg-io/xberg

Guides running Xberg extraction benchmarks and scoring quality against independent ground-truth fixtures.

9k stars

e2e-fixtures

xberg-io/xberg

Explains the JSON schema for Xberg e2e fixtures, including calls, inputs, mock responses and assertions.

9k stars

game-automation

rehan-remade/universal-modder

Launch, screenshot and drive a real game with input and logs so an agent can test its own mods.

9k stars

gentle-ai-bench

Guides authoring and verifying bench journeys; a passing go test alone does not prove real execution.

8k stars

go-testing

Jakeschincariol/replica-skill

Applies Go testing patterns: table-driven tests, Bubbletea teatest, deterministic golden files, and temp dirs.

8k stars

replica-diff

Scores a clone's feature parity and layout match with the original, ignoring colour.

7k stars

replica-test

Jakeschincariol/replica-skill

Writes a test plan for each user flow, Playwright end-to-end tests, and bug reports for your own clone.

7k stars

evaluate

Q00/ouroboros

Checks finished work against acceptance criteria using mechanical checks and model review.

6k stars

qa

Q00/ouroboros

Gives a single-pass quality verdict with scores and fixes for any artifact, like code or docs.

6k stars

testing-patterns

ChrisWiles/claude-code-showcase

Makes the agent write behavior-focused Jest tests with factory helpers, custom render and TDD steps.

6k stars

vitest

antfu/skills

Guides the agent in writing Vitest tests with Jest-style APIs, including mocks, spies, coverage and filtering.

6k stars

create-skill-test

dotnet/skills

Scaffolds eval.yaml evaluation specs with graders, rubrics and fixtures for skills and agents.

6k stars

eval-harness

Defines capability and regression evals for Claude Code work, with code, model, and human graders.

6k stars

tdd-workflow

Enforces test-first development with unit, integration and E2E tests targeting 80%+ coverage.

6k stars

verification-loop

nowork-studio/notfair-plugin

Runs build, type, lint, test, secret and diff checks in sequence and reports a verification summary.

6k stars

evals-context

zgsm-ai/costrict

Gives the agent a map of the CoStrict monorepo's evals runner, its management web app, and the public evals page.

4k stars

broken-link-checker

Crawls a website to find broken internal and outbound links (404s, 500s) and reports the source pages.

4k stars

Code Coverage with gcov

Adds gcov coverage instrumentation to C and C++ builds and generates text or HTML reports.

4k stars

Line Execution Checker

michael-denyer/pstack-claude

Checks whether specific source lines ran during tests, using gcov data and a freshly built checker tool.

4k stars

expo-skill-eval

expo/skills

Evaluates Expo skills on trigger accuracy, code quality, and simulator screenshots run through Expo Go.

4k stars

golang-benchmark

samber/cc-skills-golang

Guides Go benchmarks, pprof profiling and benchstat comparisons for statistically sound performance results.

4k stars

benchmark-checklist

Checks a performance measurement for limits, tuning, repeatability and relevance before reporting it.

4k stars

create-formal-verification-skill

michael-denyer/pstack-claude

Generates a project-local skill that formally verifies the riskiest code with a tool that fits the language.

4k stars

playwright-skill

lackeyjb/playwright-skill

Write and run Playwright scripts to test websites, take screenshots, check links and automate browser flows.

3k stars

vibe-verify

KhazP/vibe-coding-prompt-template

Runs a product against its acceptance criteria and reports setup, build and behavior evidence separately.

3k stars

code-assist

mikeyobrien/ralph-orchestrator

Guides code tasks with test-driven development in explore, plan, code and commit steps.

3k stars

evaluate-presets

mikeyobrien/ralph-orchestrator

Runs Ralph's preset evaluation scripts to test hat presets and audit the preset library for bugs.

3k stars

design-qa

plugin87/ux-ui-agent-skills

Sets up design QA gates: token and hardcode lint, axe a11y, contrast, and visual regression checks.

3k stars

web-quality-audit

addyosmani/web-quality-skills

Runs a web quality audit covering performance, accessibility, SEO and best practices using live browser evidence.

3k stars

verify-ccsn

Makes the agent run cc-safety-net in an isolated home and capture evidence of its decisions and commands.

2k stars

verify-project-tighten-only

Makes the agent check that a project policy cannot weaken user protections under tighten-only mode.

2k stars

brooks-test

CloudAI-X/claude-workflow-v2

Reviews an existing test suite for structural problems such as brittleness, mock abuse, slow runs and poor readability.

2k stars

emc

aklofas/kicad-happy

Runs EMC pre-compliance risk checks on KiCad PCB designs and outputs a ranked report with a test plan.

2k stars

designing-tests

Plans and writes unit, integration and E2E tests, sets up test tooling and checks coverage targets.

1k stars

evidence-driven-testing

michaelshimeles/rstack

Has the agent test UI behavior hands on, record evidence, and post the results to the requested destination.

1k stars

fixing-flaky-tests

amplifthq/openmeld

Guides reproducing, root-causing and validating flaky Jest, pytest or Playwright tests without sleeps or retries.

1k stars

writing-tests

amplifthq/openmeld

Gates new tests on whether they catch real regressions, then keeps them fast, deterministic and minimal.

1k stars

audit-tests

dzhng/skills

Audits which test proves each contract, deciding which tests to keep, repair, merge, or remove.

1k stars

closed-loop

huytieu/COG-second-brain

Runs a task through a verification loop where each check produces evidence rows tied to acceptance criteria.

1k stars

caliber-testing

caliber-ai-org/ai-setup

Writes Vitest tests in __tests__ folders with vi.mock, env save and restore, and project cleanup rules.

1k stars

e2e-setup

AI-Builder-Club/skills

Sets up a reliable end-to-end test suite with real flows, video and trace evidence, and a reusable auth helper.

1k stars

verifier-setup

AI-Builder-Club/skills

Scaffolds a repo's verify skill, dev-local script and browser driver so changes are proven before shipping.

1k stars

test-guard

amElnagdy/guard-skills

Reviews generated tests for mock-heavy, duplicated, or framework-testing bloat before they ship.

1k stars

fizz

Generates Echidna and Medusa fuzz suites with metadata for Foundry or Hardhat Solidity projects.

1k stars

fizz-convert

Converts English properties in PROPERTIES.md into Solidity fuzz assertions in the harness, then ticks them off.

1k stars

fizz-sync

Detects drift between a Solidity source tree and its fuzz harness, quarantining stale properties and regenerating stubs.

1k stars

agentic-tdd

Writes the expected outcome against the running app first, then implements code until that check passes.

1k stars

audit-my-app

Clicks every reachable control in a running web app and reports dead buttons, console errors and failed requests.

1k stars

drive-desktop-app

Drives an Electron or Tauri desktop app and checks renderer and IPC calls that browser tools cannot see.

1k stars

false-green-tests

Compares test claims with real app behavior to find passing tests that do not actually verify the feature.

1k stars

install-and-verify

Aaronontheweb/dotnet-skills

Verifies a web app change by reading the running app's DOM, network, routing and console, not screenshots.

1k stars

wcag22-a11y-audit

AIPexStudio/AIPex

Audits a live web page against eight WCAG 2.2 criteria using accessibility tree and screenshots.

1k stars

akka-net-testing-patterns

Makes the agent write Akka.NET actor tests with Akka.Hosting.TestKit, covering DI, probes and persistence.

1k stars

aspire-integration-testing

Aaronontheweb/dotnet-skills

Makes the agent write xUnit integration tests for Aspire apps using real containers and discovered endpoints.

1k stars

mailpit-integration

Aaronontheweb/dotnet-skills

Makes the agent capture and assert outgoing emails in Aspire tests with a local Mailpit container.

1k stars

axiom-analyze-test-failures

CharlesWiltgen/Axiom

Finds flaky Swift Testing causes: missing confirmations, concurrency gaps and shared-state races.

1k stars

dogfood

fcakyon/claude-codex-settings

Explores a web app for bugs and writes a report with screenshots, videos and repro steps per issue.

1k stars

ui-regression

fcakyon/claude-codex-settings

Runs regression QA on web or extension UIs, checking every action, state, locale and accessibility.

1k stars

loki-seal

asklokesh/loki-mode

Guides the agent to pass the repo's real test suite and not weaken tests before declaring a task done.

1k stars

test-generator

vstorm-co/pydantic-deepagents

Makes the agent write pytest cases covering happy paths, edge cases and error handling for Python code.

1k stars

test-plan

TechNomadCode/AI-Product-Development-Toolkit

Drafts a test plan outline covering scope, test types, environments and entry and exit criteria.

1k stars

jury

juliobsz/skills

Scores a website like an Awwwards jury from screenshots, speed, accessibility and SEO data.

1k stars

game-qa

zenstory-ai/novel-to-game

Verifies a game build by running it and recording evidence for launch, rendering, input, core loop, outcome and restart.

941 stars

api-tester

laolaoshiren/claude-code-skills-zh

Generates and validates API tests from real OpenAPI specs, routes and existing tests, with authorization checks.

900 stars

e2e-environment-preflight

sno-ai/sno-station-skills

Runs environment checks on external services, hosts, and agents before an end-to-end test run starts.

857 stars

e2e-red-triage

sno-ai/sno-station-skills

Classifies an unexplained end-to-end test failure as a product defect or an environment fault.

857 stars

nw-ad-critique-dimensions

nWave-ai/nWave

Gives critique dimensions for acceptance tests, covering error paths, GWT form and business language.

626 stars

nw-agent-testing

nWave-ai/nWave

Tests agents in five layers: output quality, handoffs, adversarial review, security and prompt injection.

626 stars

testdriver:agent

Describes how the TestDriver agent handles PR reviews, issues, and mentions on GitHub.

463 stars

testdriver:ai

Runs natural language tasks in TestDriver tests through the ai() method, with optional validation.

463 stars

testdriver:assert

Makes natural language assertions about screen state in TestDriver tests using an AI check.

463 stars

testdriver:cache

GRCEngClub/claude-grc-engineering

Speeds up TestDriver runs by reusing cached element positions when screenshots barely change.

463 stars

control-tester

Designs audit control test procedures and documents walkthroughs, samples and results as workpapers.

430 stars

accessibility-auditor

OneWave-AI/claude-skills

Audits websites against WCAG 2.1 AA with automated scans and manual checks, then applies fixes.

400 stars

accessibility-skill

Enables WCAG accessibility scans in Selenium, Playwright, or Cypress tests on the TestMu AI cloud.

386 stars

appium-skill

Writes Appium mobile test scripts for Android and iOS in several languages, locally or on TestMu AI.

386 stars

behat-skill

Writes Behat BDD tests for PHP with Gherkin feature files and Mink browser steps.

386 stars

behave-skill

Generates Behave BDD tests for Python with Gherkin feature files and step definitions.

386 stars

capybara-skill

billy-enrizky/openbrowser-ai

Generates Capybara end-to-end browser tests in Ruby with RSpec for web apps.

386 stars

canvas-accessibility-auditor

vishalsachdev/canvas-mcp

Scans Canvas LMS course content for WCAG issues, then guides fixes and re-checks them.

308 stars

agent-qa-testing

majiayu000/spellbook

Runs and triages agent-qa regression tests for web and mobile apps using recorded run evidence.

288 stars

accessibility-audit

Audits web pages against WCAG 2.1 for headings, labels, alt text, ARIA and keyboard use.

279 stars

e2e-testing

billy-enrizky/openbrowser-ai

Tests web apps end to end by simulating user actions and checking the expected results.

279 stars

mcp-smoke-test

SepineTam/mcp-for-stata

Runs an end-to-end smoke test of the local Stata-MCP server and reports pass or fail per tool.

271 stars

abstract-invariant-generator

tamdogood/builder-essential-skills

Infers loop invariants and function contracts via abstract interpretation for Dafny, Coq and Isabelle specs.

260 stars

demo

NahumLitvin/prismantis

Prints the prismantis demo reply as the final message so every rendering feature can be checked by eye.

254 stars

drive-check

NahumLitvin/prismantis

Presses keys in a real Claude Code session to exercise panes, buttons and saved options, then reports bugs.

254 stars

live-check

NahumLitvin/prismantis

Records a real Claude Code session's output and renders it to PNG to check how replies draw.

254 stars

check-coverage

ldayton/Dippy

Audits a Dippy CLI handler's tests against its documented subcommands and flags, then adds missing cases.

243 stars

api-contract-testing

secondsky/claude-skills

Verifies service API contracts with consumer-driven Pact tests and schema or OpenAPI validation.

240 stars

unica-testing

IngvarConsulting/unica

Guides writing, running and reviewing Unica's own tests across Rust nextest and Python unittest.

235 stars

weak-agent-test

kklimuk/docx-cli

Runs an adversarial weak-agent test of docx-cli on six document tasks, judges results, and reports fixes.

235 stars

build-scenario-tests

Compiles a Given/When/Then behavior scenario into a deterministic test in the repo's own test stack.

225 stars

agent-qa-run-review

DevelopersGlobal/ai-agent-skills

Explains an agent-qa run verdict from its recorded evidence and proposes the smallest next step.

216 stars

accessibility-testing

conorluddy/xclaude-plugin

Guides WCAG accessibility testing for iOS apps, covering VoiceOver labels, contrast and Dynamic Type.

186 stars

vibe-acceptance-gate

ash1794/vibe-engineering

Checks finished work against its acceptance criteria and reports each as pass, fail or partial.

165 stars

vibe-adversarial-test-generation

ash1794/vibe-engineering

Generates edge-case and spec-linked tests covering boundaries, nil inputs, concurrency and malformed data.

165 stars

atdd-mutate

swingerman/engineer

Runs mutation testing to find surviving mutants and check whether tests catch real bugs.

162 stars

supercov

supercorp-ai/supercov

Measures test coverage with the supercov CLI and writes one focused test at a time for uncovered code.

159 stars

accessibility-audit-websites

TheGoat395/Codex-Skills

Audits a site's keyboard paths, accessible names, states and focus, then fixes in-scope issues and reports gaps.

135 stars

verify-libreuiux

Ormus-Solutions/LibreUIUX-Claude-Code

Installs the LibreUIUX plugin pack into clean Claude Code and Grok homes to prove each plugin loads.

123 stars

pict-test-designer

omkamal/pypict-claude-skill

Designs pairwise test cases with PICT and outputs the model, a test table, and expected results.

102 stars

Security 164

azure-compliance

microsoft/azure-skills

Runs Azure compliance and security audits with azqr, plus Key Vault secret and certificate expiry checks.

571k installs · 2k stars

firebase-security-rules-auditor

firebase/agent-skills

Audits Firebase Firestore and Storage security rules for privilege escalation, bypasses and weak validation.

141k installs · 493 stars

cloudflare-one

cloudflare/skills

Guides design, setup, troubleshooting, and review of Cloudflare One Zero Trust and SASE deployments.

97k installs · 3k stars

turnstile-spin

cloudflare/skills

Sets up, repairs, or migrates Cloudflare Turnstile bot checks in a frontend and backend, with server-side siteverify.

97k installs · 3k stars

security-and-hardening

cloudflare/security-audit-skill

Threat-models code, then hardens input handling, auth, data storage, and dependencies against attacks.

74k installs · 112k stars

security-audit

Reviews code and services for vulnerabilities at trust boundaries, with evidence, priority and minimal fixes.

67k installs · 53k stars

reverse-engineer-anything

morluto/rea

Guides reverse engineering of shipped binaries, packages, and web apps with REA, plus AgentEnv bundles.

410k stars

cso

Runs a static security audit of the repository and reports exploitable defects with attacker and impact context.

138k stars

security-research

anthropics/claude-plugins-official

Coordinates parallel agents to audit a codebase for vulnerabilities and rate each by proven exploitability.

70k stars

claude-security

Scans the repo or a diff for security issues, then drafts patch files for you to review and apply.

45k stars

competition-ad-certificate-abuse

CTF workflow for AD CS template, EKU, SAN and PKINIT privilege paths, used after the sandbox orchestrator.

44k stars

competition-agent-cloud

CTF workflow for prompt injection, MCP tool chains, cloud and CI/CD drift and artifact provenance challenges.

44k stars

competition-file-parser-chain

Guides CTF sandbox tracing of file uploads, archives, converters and parsers to the decisive effect.

44k stars

competition-firmware-layout

Guides CTF sandbox analysis of firmware partitions, boot chains, update packages and embedded configs.

44k stars

competition-forensic-timeline

Guides CTF sandbox DFIR work, merging logs and artifacts into one replayable incident timeline.

44k stars

competition-graphql-rpc-drift

Guides CTF sandbox work matching GraphQL or RPC contracts with live handlers to find hidden operations.

44k stars

competition-identity-windows

Guides CTF sandbox analysis of AD, Kerberos, OAuth, mail and Windows host evidence for lateral movement.

44k stars

competition-ios-runtime

Guides CTF sandbox iOS analysis with Frida hooks, Keychain inspection, pinning bypass and request signing.

44k stars

competition-jwt-claim-confusion

Guides CTF sandbox analysis of JWT parsing, key selection and claim checks that grant accepted identity.

44k stars

competition-k8s-control-plane

Guides CTF sandbox analysis of Kubernetes RBAC, service accounts, admission and controllers.

44k stars

competition-kerberos-delegation

Guides CTF sandbox work on Kerberos delegation edges, S4U, RBCD and whether service tickets get accepted.

44k stars

reverse-skill-router

Routes reverse engineering, exploitation, pentest, malware and mobile tasks to the matching specialist skill.

44k stars

skill-inspector

NVIDIA/SkillSpector

Reviews an agent skill for safety and excess permissions via SkillSpector scans and source reading.

23k stars

skill-security-auditor

eigent-ai/eigent

Guides a security audit of code, configs and dependencies, covering vulnerabilities, secrets and known CVEs.

16k stars

offensive-active-directory

Active Directory attack methodology for authorized red team work, from recon and credential abuse to ADCS.

10k stars

offensive-ai-security

Checklist for authorized AI and LLM security tests covering prompt injection, jailbreaks and poisoning.

10k stars

offensive-api-abuse

Methodology for authorized API tests on business logic, GraphQL, JWT manipulation and race conditions.

10k stars

offensive-api-security

Guides authorized API security testing across REST, gRPC and WebSocket against the OWASP API Top 10.

10k stars

offensive-basic-exploitation

Covers classic Linux exploit basics such as EIP control, ROP and ret2libc with mitigations off.

10k stars

offensive-cicd-pipeline

Guides authorized exploitation tests of CI/CD pipelines on GitHub Actions, Jenkins, GitLab and Azure DevOps.

10k stars

offensive-cicd-secrets

Guides authorized testing of how secrets leak from CI/CD runners, vaults, OIDC federation and build logs.

10k stars

offensive-cloud

Guides authorized testing of AWS, Azure and GCP for credential theft, privilege escalation and persistence.

10k stars

offensive-container-escape

Guides authorized container breakout testing for Docker, containerd and Podman, from capabilities to runc CVEs.

10k stars

offensive-crypto-attacks

Guides finding and exploiting crypto misuse like padding oracles, ECB, nonce reuse and weak PRNGs.

10k stars

offensive-exploit-dev-course

Provides a weekly exploit development course syllabus with topics, reading and lab setup.

10k stars

offensive-exploit-development

Guides exploit development workflow with pwntools, pwndbg, heap techniques and PoC reliability.

10k stars

offensive-jwt

Guides authorized JWT testing for algorithm confusion, weak secrets, header injection and JWKS poisoning.

10k stars

offensive-k8s-attacks

Guides authorized Kubernetes attacks from a pod foothold through RBAC, kubelet, etcd and node compromise.

10k stars

offensive-mitigations

Catalogs exploit mitigations like ASLR, NX, RELRO, CFI and seccomp, with known bypass techniques.

10k stars

offensive-netexec

Reference for NetExec (nxc) across SMB, LDAP, WinRM and other protocols in authorized domain tests.

10k stars

offensive-oauth

Guides authorized OAuth 2.0 testing for redirect_uri bypass, state abuse, PKCE bypass and scope escalation.

10k stars

offensive-tls-attacks

Guides TLS auditing and known attacks like POODLE, DROWN, FREAK, Heartbleed and certificate bypass.

10k stars

offensive-toctou

SimoneAvogadro/android-reverse-engineering-skill

Guides exploiting check-then-use race conditions across files, kernel, containers and web auth.

10k stars

update-deps

backnotprop/plannotator

Audits outdated npm or Bun packages for maintainer, publish age and provenance before bumping them.

10k stars

antinet-security-scan

anbeime/skill

Screens files and URLs against domain blocklists and license rules, returning pass or reject.

9k stars

android-reverse-engineering

Decompiles APK/JAR/AAR files with jadx or Fernflower, then extracts API endpoints and traces call flows.

9k stars

agentic-actions-auditor

Audits GitHub Actions workflows that run AI coding agents for prompt injection and unsafe settings.

8k stars

audit-context-building

Builds an understanding of unfamiliar code's assumptions and dependencies before a security audit begins.

8k stars

audit-prep-assistant

Prepares a codebase for an external security review by setting goals, fixing easy issues, and adding docs.

8k stars

c-review

Runs a structured C and C++ security review for memory corruption, integer overflow and race conditions.

8k stars

constant-time-analysis

Compiles crypto code and inspects assembly to find secret-dependent timing side-channel risks.

8k stars

secure-workflow-guide

Guides a five-step smart contract security workflow with Slither scans, feature checks and manual review.

8k stars

solana-vulnerability-scanner

Scans Solana programs for six flaws such as arbitrary CPI, bad PDA checks and missing signer checks.

8k stars

substrate-vulnerability-scanner

Scans Substrate and FRAME pallets for seven flaws including overflow, panic DoS and bad origin checks.

8k stars

token-integration-analyzer

Analyzes ERC20 and ERC721 conformance and weird token behaviors such as fee-on-transfer and rebasing.

8k stars

ton-vulnerability-scanner

Scans FunC contracts on TON for boolean misuse, fake Jetton contracts and unchecked forward gas.

8k stars

agentic-supply-chain-detection

Tests whether an agent trusts unvetted plugins, unpinned dependencies or untrusted update sources.

7k stars

aig-agent-redteam

Guides authorized red-team assessments of AI agents, MCP servers and skills, with evidence-backed reports.

7k stars

authorization-bypass-detection

Probes an agent through dialogue for cross-user data access, privilege escalation and auth bypass.

7k stars

cascading-failure-detection

Tests whether an agent's errors, retries or dependency outages spread into system-wide failures.

7k stars

data-leakage-detection

Probes an agent for leaks of its system prompt, credentials, personal data and internal configuration.

7k stars

direct-injection-detection

Tests whether direct user messages can override an agent's system or developer instructions.

7k stars

edgeone skill scanner

Statically scans an agent skill for security risks before installation, with all analysis run locally.

7k stars

edgeone-clawscan

Audits installed OpenClaw skills and environment for security risks, with optional cloud threat lookup.

7k stars

file-path-traversal-detection

Tests whether an agent's upload, save or extract flows let user-controlled paths escape the workspace.

7k stars

human-agent-trust-exploit-detection

Tests whether an agent harvests secrets, gives false assurances or pushes users into unsafe actions.

7k stars

indirect-injection-detection

Tests whether instructions hidden in documents or retrieved content can hijack an agent's goal.

7k stars

inter-agent-comm-security-detection

Tests multi-agent messaging for data leakage, impersonation and privilege escalation through routing.

7k stars

memory-poisoning-detection

Tests whether an agent stores attacker instructions in long-term memory and follows them in later tasks.

7k stars

memory-rag-poisoning-detection

Plants canary tokens in agent memory or RAG stores and checks whether they persist and alter later behavior.

7k stars

owasp-asi

Classifies agent security findings into the OWASP Agentic Top 10 2026 categories, ASI01 to ASI10.

7k stars

tool-abuse-detection

Probes an agent's file, shell and network tools through dialogue to find misuse and unsafe tool parameters.

7k stars

unexpected-code-execution-detection

Tests an agent for command injection, eval or exec misuse, and loading of remote code it should refuse.

7k stars

security-review

Checks code for secrets, input validation, auth and other common security issues before shipping.

6k stars

bb-local-toolkit

Runs the full bug bounty workflow from recon to reporting, and locates local tools, wordlists and clones.

5k stars

bb-methodology

Orchestrates a bug bounty session in phases, checking engagement mode first and routing to the right skills.

5k stars

bug-bounty

Runs a full bug bounty workflow from recon and hunting to validation and report writing.

5k stars

bugcrowd-reporting

Adds Bugcrowd-specific tactics for VRT selection, severity overrides and rebutting out-of-scope closures.

5k stars

cloud-iam-deep

Maps what a found AWS, Azure, GCP or Kubernetes credential grants and how privileges could escalate.

5k stars

enterprise-vpn-attack

Gives a fingerprint and CVE matrix for SSL VPN appliances like Cisco, Fortinet, Citrix and Palo Alto.

5k stars

evidence-hygiene

Shows how to redact cookies, PII and sensitive data from bug bounty screenshots, HAR files and PoCs.

5k stars

hunt-api-misconfig

Tests APIs for mass assignment, prototype pollution and HTTP verb tampering misconfigurations.

5k stars

hunt-aspnet

Hunts ASP.NET Webforms, WCF and SharePoint flaws like ViewState deserialization and exposed trace pages.

5k stars

hunt-ato

Covers nine account takeover paths such as password reset poisoning, email change and OAuth link CSRF.

5k stars

authentication-patterns

Guides choosing session, JWT or OAuth auth, picking providers, and a security checklist for auth changes.

5k stars

broken-authentication

Guides testing web apps for broken authentication: passwords, session handling, MFA and credential reuse.

5k stars

burp-suite-testing

Guides web app security testing with Burp Suite: intercepting traffic, Repeater replay and scanning.

5k stars

octopus-security-audit

nyldn/claude-octopus

Runs OWASP compliance checks, vulnerability scans, and adversarial red team tests for security reviews.

4k stars

guarding-destructive-operations

kajisho5/ffmpeg-skill

Adds refusing preconditions and path containment checks to delete, overwrite, and history-rewrite operations.

4k stars

audit

Runs a hypothesis-driven security review of code coverage gaps, grounded in tool output, within the session.

4k stars

code-understanding

Maps code architecture and traces data flows from untrusted input to sinks to support security analysis.

4k stars

exploitability-validation

Validates that scanner findings are real, reachable, and plausibly exploitable before further analysis.

4k stars

github-archive

Has the agent investigate GitHub security incidents using immutable GH Archive event data queried through BigQuery.

4k stars

ctf-ai-ml

Gives CTF players AI and ML attack techniques: adversarial examples, model extraction, prompt injection.

4k stars

ctf-crypto

Gives CTF players attack methods for RSA, AES, ECC, lattices, padding oracles, and other crypto challenges.

4k stars

ctf-forensics

Gives CTF players forensics methods for disk, memory, network, log, registry, and steganography analysis.

4k stars

ctf-malware

Gives CTF players methods for analyzing obfuscated scripts, PE binaries, and C2 traffic.

4k stars

ctf-misc

Gives CTF players techniques for encodings, jails, RF, DNS, and other cross-category puzzles.

4k stars

ctf-osint

Gives CTF players open source intelligence techniques for geolocation, usernames, DNS, and Wayback lookups.

4k stars

ctf-pwn

Guides CTF binary exploitation, turning memory bugs and low-level primitives into code execution.

4k stars

ctf-reverse

Guides CTF reverse engineering of binaries, firmware, VMs and bytecode to recover their logic.

4k stars

ctf-web

Guides CTF web exploitation across XSS, SQLi, SSTI, SSRF, JWT, auth bypass and similar web bugs.

4k stars

add-community-skill

Guides adding an importable Markdown attack workflow to the RedAmon agent catalog, using only real tools.

3k stars

add-partial-recon

Guides wiring a recon tool into RedAmon's single-phase partial recon, reading inputs from the graph.

3k stars

builtin-agent-skill

Guides adding a hardcoded built-in attack skill to RedAmon across the agent, classifier and webapp layers.

3k stars

priority-board-triage

Keeps the Priority Board's three score layers separate so only the correct writer sets rule, review or decision values.

3k stars

rev-dex-dumper

Dumps decrypted DEX files from a running Android app's memory via ADB for unpacking and analysis.

2k stars

rev-u3d-dump

Extracts Unity IL2CPP method names, addresses, and types from binaries and metadata for IDA or Ghidra import.

2k stars

oauth

mcollina/skills

Implements OAuth 2.0 and 2.1 flows in Fastify, including PKCE, refresh rotation and JWT validation.

2k stars

VibeSec-Skill

BehiSecc/VibeSec-Skill

Guides the agent to write and audit web apps with proper access control, input validation and secure defaults.

1k stars

solidity-auditor

Runs a parallel security audit of Solidity code during development, with a ledger that remembers past findings.

1k stars

x-ray

BagelHole/DevOps-Security-Agent-Skills

Generates an x-ray.md pre-audit report covering threat model, invariants, integrations, tests and git history.

1k stars

fedramp-compliance

Maps FedRAMP requirements and NIST 800-53 controls for cloud services sold to US federal agencies.

1k stars

gdpr-compliance

BagelHole/DevOps-Security-Agent-Skills

Applies GDPR rules: consent management, data subject rights, DSAR workflows and privacy by design.

1k stars

second-brain-privacy

undefined-ui/second-brain-os

Scans a vault for credentials, others' private data and confidential material, and reports them by severity.

1k stars

clawsec-clawhub-checker

Adds a reputation check on ClawHub skills before guarded installs, requiring confirmation below threshold.

1k stars

clawsec-feed

Tracks a daily security advisory feed for OpenClaw-related CVEs and emerging threats.

1k stars

clawsec-scanner

Runs npm and pip audits, CVE lookups, and Semgrep or Bandit scans, then reports vulnerabilities and fixes.

1k stars

clawsec-suite

Sets up ClawSec monitoring, verifies signed advisories, and asks approval before removing risky skills.

1k stars

clawtributor

Drafts community incident reports for threats found, sanitized and submitted only with user approval.

1k stars

hermes-attestation-guardian

data-goblin/power-bi-agentic-development

Verifies signed ClawSec release artifacts and detects drift in Hermes runtime attestation.

1k stars

audit-tenant-settings

Audits Fabric and Power BI tenant settings against a baseline and reports drift and delegated overrides.

1k stars

cis-controls

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Guides CIS Controls v8 implementation groups, gap assessments, safeguards, and mapping to other frameworks.

1k stars

cmmc

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Advises US defense contractors on CMMC 2.0 levels, NIST SP 800171 practices, SSPs, and POA&M planning.

1k stars

cyber-essentials

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Advises on UK Cyber Essentials and Cyber Essentials Plus scope, the five control themes, and readiness gaps.

1k stars

claude-authenticity

agentscope-ai/OpenJudge

Runs weighted checks to judge whether an API endpoint serves genuine Claude, or a wrapper.

993 stars

dep-auditor

laolaoshiren/claude-code-skills-zh

Audits dependency manifests and lockfiles for known vulnerabilities, version health and license facts, read-only.

900 stars

pr-security-review

EricTechPro/super-board

Reviews one PR's diff against its base branch for exploitable security flaws, filtering out false positives.

555 stars

01-recon-osint

Guides authorized recon: subdomain enumeration, DNS analysis, fingerprinting and OSINT correlation.

532 stars

02-vulnerability-scanner

Audits dependencies and configs for known CVEs, scores risk with CVSS, and writes prioritized fix reports.

532 stars

03-exploit-development

Helps build proof-of-concept exploits and payloads for targets under confirmed authorization.

532 stars

04-reverse-engineering

Guides binary analysis, disassembly, decompilation, firmware and protocol reverse engineering.

532 stars

05-malware-analysis

ancoleman/ai-design-components

Runs static and dynamic malware analysis, writes YARA rules, and classifies malware families safely.

532 stars

architecting-security

Guides security architecture design with defense-in-depth, zero trust, threat modeling and control frameworks.

526 stars

owasp-security

agamm/claude-code-owasp

Reviews code and config for OWASP Top 10 and LLM or agent security flaws, and guides secure fixes.

419 stars

ai-agent-redteam

hypnguyen1209/offensive-claude

Red-team guidance for agentic LLM apps: prompt injection, MCP tool poisoning, memory poisoning and tool abuse tests.

403 stars

ai-security

hypnguyen1209/offensive-claude

Security testing for AI/ML systems: prompt injection, RAG poisoning, MCP audits and model artifact scanning.

403 stars

windiff-version-diff-analysis

ergrelet/windiff

Interprets diffs between Windows builds, flagging changed syscalls, callbacks and telemetry for security research.

395 stars

reins

pegasi-ai/reins

Applies deterministic security policies to shell, file and MCP actions via hooks, and scans configs.

392 stars

robotics-security

arpitg1304/robotics-agent-skills

Guides securing ROS2 robots with SROS2 DDS encryption, access control, network segmentation and hardening.

390 stars

disclosure

Encod3d-Sec/TORCH

Packages a verified vulnerability into a responsible disclosure report and helps request a CVE, with an authorization gate.

337 stars

hunt-burp

Encod3d-Sec/TORCH

Drives Burp Suite over MCP to triage proxy traffic, replay requests and hand off to vuln-class testing.

337 stars

security-awareness

gendigitalinc/sage

Gives the agent safety rules for running commands, fetching URLs, and handling credentials and packages.

322 stars

diagnostic-dofile

SepineTam/mcp-for-stata

Audits a Stata do-file read-only for security, portability and encoding risks, emitting a JSON report.

271 stars

stata-audit

SepineTam/mcp-for-stata

Inspects local Stata-MCP audit logs to show tool runs, security blocks and snapshot integrity.

271 stars

pya

AgriciDaniel/pya

Runs a parallel security audit of a codebase and returns a scored report with a prioritized fix list.

265 stars

api-platform-security

dev-toolings/superpowers-symfony

Lock down Symfony API Platform operations with security expressions, voters, and post-validation checks.

227 stars

acl-abuse

Walks the agent through abusing AD object ACL edges with bloodyAD and impacket, plus detection and fixes.

215 stars

ad-environment-constraints

Explains AD hardening like disabled NTLM, AES-only KDCs, LDAPS and clock skew that break attacks silently.

215 stars

ad-methodology

Sets the phase order for an Active Directory pentest: setup, collection, exploitation and post-processing.

215 stars

ad-opsec-telemetry

Lists the event IDs and noise each AD technique produces, so red and blue teams know what gets logged.

215 stars

adcs-attacks

alexgreensh/repo-forensics

Guides AD CS ESC1 to ESC17 escalation with Certipy, covering find, request, auth, event IDs and fixes.

215 stars

forensify

Audits your local agent stack for risky skills, MCP servers, hooks and credential permissions, read-only.

200 stars

repo-forensics

alexgreensh/repo-forensics

Audits git repos, agent skills and MCP servers for injection, credential theft, CVEs and risky patterns.

200 stars

aarm-policy-layer

safedep/gryph

Guides changes to Gryph's AARM policy engine, receipt chain and context accumulator via its dev doc.

181 stars

supercov-security

supercorp-ai/supercov

Scans a repository for security vulnerabilities with the supercov CLI and maps findings to CWE classes.

159 stars

bug-bounty-triage

Sequester-AG/bug-bounty-triage

Validates bug bounty reports on authorized targets, assesses severity and drafts a submission-ready report.

141 stars

build-db

jar-analyzer/jar-analyzer-claude

Builds a SQLite analysis database from JAR, WAR or class files for Java static analysis.

141 stars

do-analyze

jar-analyzer/jar-analyzer-claude

Runs SQL queries on the analysis database to trace method calls and flag Java vulnerability patterns.

141 stars

china-ai-compliance-audit

jnMetaCode/shellward

Audits an AI project repo against China's cyber, privacy and AI labeling rules, with file-line evidence.

139 stars

security-guide

jnMetaCode/shellward

Walks through an OpenClaw deployment security checklist covering network, containers, secrets and plugins.

139 stars

common-appsec-patterns

Stickman230/claude-pentest

Coordinates parallel subagents to test a web app for XSS, injection and CSRF flaws.

131 stars

myrqen

stijnswapped/Myrqen

Runs an authorized, local-first security assessment of the user's app, validating findings and retesting fixes.

127 stars

sail

pillar-labs/sail-skill

Applies the SAIL V2 framework to assess AI and agent risks, build roadmaps and prioritize controls.

113 stars

Debugging 83

diagnosing-bugs

mattpocock/skills

Guides feedback-loop-first diagnosis of hard bugs and slow regressions, redacting secrets from output.

865k installs · 307k stars

safe-debug

lllllllama/rigorpilot-skills

Diagnoses tracebacks and training failures conservatively, proposing minimal fixes that need approval first.

341k installs · 486 stars

systematic-debugging

Makes the agent find the root cause of any bug or failure before proposing a fix.

314k installs · 309k stars

investigate-first

JuliusBrussee/caveman

Makes the agent gather evidence and rank hypotheses to diagnose failures before editing code.

110k installs · 116k stars

surgical-patch

JuliusBrussee/caveman

Fixes bugs at the narrowest responsible layer, with a regression check and minimal unrelated changes.

109k installs · 116k stars

performance-optimization

Measures first, then fixes real bottlenecks in frontend, backend, queries, and databases.

68k installs · 112k stars

debugging-and-error-recovery

Guides systematic root-cause debugging for failing tests, broken builds, and unexpected errors.

66k installs · 112k stars

parallel-debugging

Donchitos/Claude-Code-Game-Studios

Guides debugging by testing competing hypotheses in parallel and settling the root cause with evidence.

42k stars

bug-report

Writes structured bug reports from descriptions, analyzes code for likely bugs, and verifies or closes fixes.

30k stars

bug-triage

Donchitos/Claude-Code-Game-Studios

Re-prioritizes open bugs by severity and priority, assigns them to sprints, and reports systemic trends.

30k stars

ce-debug

EveryInc/compound-engineering-plugin

Finds the root cause of a bug with file-level evidence, then optionally applies a test-first fix.

26k stars

troubleshoot

SuperClaude-Org/SuperClaude_Framework

Guides root-cause debugging of errors and bugs, forbidding blind retries and requiring a fixed report.

24k stars

cmux-debug

ccusage/ccusage

Makes the agent run ccusage in a cmux pane and read the captured output back to verify terminal rendering.

19k stars

profile

ccusage/ccusage

Profiles ccusage CLI performance, comparing branches and checking that optimizations actually helped.

19k stars

reasoning-trace-optimizer

muratcankoylan/Agent-Skills-for-Context-Engineering

Analyzes agent reasoning traces to find context decay, tool confusion and drift, then suggests fixes.

18k stars

debugging-wizard

Jeffallan/claude-skills

Parses errors and stack traces, correlates logs and applies hypothesis-driven steps to find root causes.

12k stars

queen-colony-debug

aden-hive/hive

Guides live debugging of Hive queen sessions, colony forks and worker spawns in an isolated environment.

11k stars

offensive-crash-analysis

Guides crash triage with GDB, WinDbg and sanitizer output to judge exploitability and find root cause.

10k stars

issue-root-resolution

Audits issue backlogs by shared root cause and plans cluster-level fixes instead of one-off patches.

8k stars

systemic-issue-triage

Triages incoming bug reports by root class and batches fixes that shrink the system instead of patching symptoms.

8k stars

hunt

tw93/Waza

Finds the root cause of errors, crashes, and regressions before any fix is applied.

7k stars

omh-app-debugging

rlaope/oh-my-hermes

Reproduces an app bug, tests competing hypotheses, then fixes only the proven root cause.

5k stars

frida

Attaches Frida to a process, loads a hook script, and records send() events to confirm runtime behavior.

4k stars

Function Call Tracing

Instruments C and C++ builds to trace function calls per thread and convert logs for Perfetto.

4k stars

rr-debugger

wesammustafa/Claude-Code-Everything-You-Need-to-Know

Has the agent debug crashes with rr record-replay, using reverse stepping and crash trace extraction.

4k stars

session-investigator

evalstate/fast-agent

Has the agent diagnose fast-agent session and history files to find unexpected endings, tool loops and timing issues.

4k stars

kiro-debug

gotalab/cc-sdd

Makes the agent investigate blocked or failing implementations by finding root cause before any fix.

4k stars

five-whys

Traces a problem back through repeated why questions to its root cause, then proposes fixes.

4k stars

vibe-debug

KhazP/vibe-coding-prompt-template

Reproduces a failing journey in an existing project, makes a targeted fix, and reruns the checks.

3k stars

chengfeng-report-bug

Agentchengfeng/chengfeng-videocut-skills

Drafts a redacted bug report for chengfeng-videocut and files a GitHub issue only after user confirmation.

3k stars

debugview

microsoft/skills

Makes the agent capture and filter Windows debug output with the Sysinternals DebugView CLI.

3k stars

bug-capture

rohitg00/pro-workflow

Turns a user-reported bug into a GitHub issue in the project's own terms, after checking for duplicates.

3k stars

rev-frida

Writes Frida hook scripts with the modern API to trace calls, capture arguments and return values, and dump memory.

2k stars

rev-idapython

Gives IDAPython and IDALib code snippets for scripting IDA analysis, debugging, memory, and Hex-Rays tasks.

2k stars

rev-struct

Recovers data structure layouts from memory access patterns across functions and their call chains.

2k stars

rev-symbol

Recovers function names by analyzing code patterns, strings, constants, and cross-references in binaries.

2k stars

rev-unicorn-debug

codejunkie99/agentic-stack

Emulates selected functions with Unicorn, hooking JNI, syscalls, and libc calls to trace or decode data.

2k stars

debug-investigator

Makes the agent reproduce a bug, isolate it, test one hypothesis at a time, and confirm the fix with the repro.

2k stars

analyze-exports

Leanmcp/gateway-skills

Finds where and why a tau2-bench task failed by mapping root causes to rounds and cited docs.

2k stars

debug-like-expert

glittercowboy/taches-cc-resources

Makes the agent run a hypothesis-driven debugging protocol with evidence gathering when standard fixes fail.

2k stars

engineering-method-footguns

maxrave-dev/kotlin-footguns

Makes the agent run a discriminating experiment before writing fixes when a bug survives repeated attempts.

2k stars

thinking-five-whys-plus

tjboudreaux/cc-thinking-skills

For a localized fault, the agent traces evidenced whys to a systemic root and proposes a countermeasure.

2k stars

thinking-kepner-tregoe

tjboudreaux/cc-thinking-skills

The agent locates selective defects by IS/IS-NOT contrast, or ranks options by must and want criteria.

2k stars

thinking-map-territory

tjboudreaux/cc-thinking-skills

When docs or tests contradict observed behavior, the agent checks live code or data first.

2k stars

dev-debug

codeaholicguy/ai-devkit

Guides evidence-first debugging: clarify behavior, reproduce, test hypotheses, and get approval before code changes.

2k stars

hypothesis-testing

Debugs by forming testable hypotheses and running targeted experiments to confirm or reject each one.

2k stars

parallel-investigation

Splits a hard bug or incident into parallel investigation threads and merges findings into one report.

2k stars

root-cause-analysis

Finds a bug's true root cause through phased investigation and Five Whys before applying any fix.

2k stars

trace-and-isolate

daymade/claude-code-skills

Pinpoints where a bug starts using binary search, git bisect, targeted logging and minimal repro cases.

2k stars

fix-bug

tddworks/ClaudeBar

Guides fixing ClaudeBar bugs with a failing test first, root cause analysis, and rich domain design.

2k stars

debugging-network-issues

Runs falsification-first layered experiments to find root causes of network, streaming and protocol failures.

2k stars

error-handling

CloudAI-X/claude-workflow-v2

Applies error handling patterns, structured logging, retries, circuit breakers and graceful degradation.

1k stars

optimizing-performance

CloudAI-X/claude-workflow-v2

Profiles and optimizes slow frontend, backend and database code, measuring before and after each change.

1k stars

audit-performance

dzhng/skills

Finds unbounded or no-progress work in hot paths and ranks performance fixes by evidence and severity.

1k stars

oma-debug

first-fluke/oh-my-agent

Reproduces a bug, finds its root cause, applies a minimal fix, and adds a regression test.

1k stars

slci-inspection-incompatibility-analysis

matlab/simulink-agentic-toolkit

Traces failed SLCI code inspection results back to incompatible model settings or known limitations.

1k stars

debug-broken-ui

Reproduces a broken UI in the running app and reads the click, request, store and console to find the cause.

1k stars

fix-what-i-pointed-at

withkynam/vibecode-pro-max-kit

Reads notes a human left in the running app and fixes each flagged element at its source file and line.

1k stars

axiom-analyze-crash

CharlesWiltgen/Axiom

Analyzes iOS and macOS crash logs such as .ips and MetricKit files, symbolicates them and points to fixes.

1k stars

axiom-analyze-triage

CharlesWiltgen/Axiom

Ranks grouped production crashes and hangs from Sentry or App Store Connect, keeping noise visible.

1k stars

vc-debug

Makes the agent find the root cause of bugs, test failures and CI issues before proposing any fix.

1k stars

backprop

JuliusBrussee/cavekit

After a bug or failing test, traces the root cause and adds a spec invariant and test to prevent recurrence.

1k stars

debug-live-issue

hoangsonww/Claude-Code-Agent-Monitor

Debugs live issues across hooks, API, DB, websocket and UI by gathering evidence and proving the root cause before fixing.

1k stars

asc-crash-triage

rorkai/app-store-connect-cli-skills

Fetches TestFlight crashes, beta feedback and performance diagnostics with asc and summarizes them.

1k stars

agentic-walkthrough

sno-ai/sno-station-skills

Checks that a reported run caused its real effect by tracing the code path and observing each hop.

857 stars

debug

rsmdt/the-startup

Guides the agent through systematic, evidence-based bug diagnosis and root cause analysis.

575 stars

misakanet-failure-memory

Ikalus1988/MisakaNet

Searches the MisakaNet index for fixes to errors and submits redacted failure reports when none match.

544 stars

debug-workflow

josstei/maestro-orchestrate

Runs a structured debugging workflow that gathers evidence first, then delegates the investigation to a debugger agent.

485 stars

pavedpath-code

Jia-Ethan/pavedpath-code

Finds proven fixes for software errors in GitHub issues, PRs and code, then applies a minimal local change.

440 stars

bug-fix-brief

giuseppe-trisciuoglio/developer-kit

Generates a Bug Fix Brief with root cause, repro steps, fix options and a checklist, saved under docs/bfb.

366 stars

debugging-code

AlmogBaku/debug-skill

Drives a live debugger via the dap CLI to set breakpoints, step through code, and inspect variables.

335 stars

investigate-to-confluence

testdouble/han

Runs an evidence-based bug investigation and publishes the root-cause report to Confluence via Atlassian MCP.

328 stars

analysis-pipeline

prime-radiant-inc/greenfield

Guides multi-layer reverse engineering of a product into behavioral specs with provenance citations.

299 stars

autonomous-discovery

prime-radiant-inc/greenfield

Inventories local files, web info and running services as intelligence sources for a target product.

299 stars

binary-analysis

prime-radiant-inc/greenfield

Guides static analysis of compiled binaries and bundles to recover behavior without executing them.

299 stars

orca-replay

Continuum-AI-Corp/OrcaReplay

Answers questions about past agent runs from recordings, and replays or forks a run to reproduce failures.

287 stars

abstract-state-analyzer

Statically flags runtime errors like out-of-bounds access, null dereference and overflow in source code.

260 stars

abstract-trace-summarizer