GITHUB AGENT SKILLS / 技能收录
给你的 AI 助手
装上专业技能
我们从 GitHub 持续收录、审核并分类优质的 Agent Skills，按职业与使用场景整理，复制一行命令即可安装到 Claude Code、Cursor 等智能体。
按职业浏览 Agent Skills
为不同岗位挑选的高频技能
按使用场景浏览 Agent Skills
从你要完成的任务出发
按创作者浏览 Agent Skills
按 GitHub Stars 排序的优秀创作者
Microsoft
@microsoft
openclaw
@openclaw
OpenAI
@openai
The Apache Software Foundation
@apache
GitHub
@github
Anthropic
@anthropics
AutoGPT
@Significant-Gravitas
Garry Tan
@garrytan全部 Skills 196852
semgrep
Run Semgrep static analysis scans and create custom detection rules. Use when asked to scan code with Semgrep, find security vulnerabilities, write custom YAML rules, or detect specific bug patterns. IMPORTANT: Also use when users ask to 'scan for bugs', 'check code quality', 'find vulnerabilities', or 'audit this code' - even without naming Semgrep. Pattern-based scanning across 30+ languages.
wds-4-ux-design
Transform ideas into detailed visual specifications through scenario-driven design
seed-golden-journey
Use when an app needs a keystone acceptance test that proves the real product works end to end, not just that units pass or coverage is high. Scaffolds a HELD-OUT golden-journey test that launches the REAL app, drives the ONE primary user journey, and asserts a REAL artifact on disk (ffprobe media file, a downloaded file) rather than element-present. Parameterized for Electron, web, and CLI.
wds-3-scenarios
Create UX scenario outlines from Trigger Map through structured micro-steps
security-threat-model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Not for general architecture summaries or code review.
wds-2-trigger-mapping
Map business goals to user psychology through structured workshops
security-scan
Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
security-review
Use when adding authentication, handling user input, secrets, API endpoints, or payment/sensitive features -- gives a security checklist and patterns. NOT for scanning your .claude config (use security-scan).
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history. Not for general maintainer lists or non-security ownership questions.
wds-1-project-brief
Establish project context - foundation for all design work
wds-0-project-setup
Project onboarding - determine project type, complexity, tech stack, and route to correct phase
security-bounty-hunter
Hunt for exploitable, bounty-worthy security issues in repositories. Focuses on remotely reachable vulnerabilities that qualify for real reports instead of noisy local-only findings.
wds-0-alignment-signoff
Create alignment around your idea before starting the project
security-best-practices
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
bmad-workflow-builder
Builds workflows and skills through conversational discovery and validates existing ones. Use when the user requests to "build a workflow", "modify a workflow", "quality check workflow", or "optimize skill".
bmad-validate-prd
Validate a PRD against standards. Use when the user says "validate this PRD" or "run PRD validation"
search-first
Research-before-coding workflow. Search for existing tools, libraries, and patterns before writing custom code. Invokes the researcher agent.
bmad-testarch-trace
Generate traceability matrix and quality gate decision. Use when the user says "lets create traceability matrix" or "I want to analyze test coverage"