AGENT SKILLS · 任务装备
值得安装的 Agent Skills
汇总公开仓库中已验证的 Skills。安装前先看清它能做什么、包内包含什么、热度如何，以及来源是否可靠。
- 目录范围
- 已验证
- Skills
- 22,603
- 仓库
- 3475
- 最近同步
- 2026年10月30日
lvcasmadeitimplement-it
Implement and verify exactly one ready Ticket from TODO.md; use when the user names an issue ID and its acceptance criteria can be completed in the current repository.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 10月8日
mixiopromixio-episode
Use when creating or maintaining a Mixio episode’s source text, scenes, shots, and relations through Studio primitives.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 10月16日
mraliasgrill-me
Stress-test a plan, design, architecture, or proposal by interviewing the user one question at a time until key decisions, tradeoffs, assumptions, and risks are resolved. Use when the user asks to be grilled, wants a plan challenged, or needs design review through pointed questioning.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 10月12日
securityskillscontainer-image-hardening
Harden Dockerfiles and container images — multi-stage builds, non-root users, minimal base images, and vulnerability gates. Use when building production containers or reviewing Dockerfiles.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 8月26日
shomod9need-reading-material
The user is in need for inspiration. Find them high quality sources to read.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 10月16日
sanyuan0704code-review-expert
Expert code review of current git changes with a senior engineer lens. Detects SOLID violations, security risks, and proposes actionable improvements.
- 1小时安装量
- 1
- GitHub Stars
- 3941
- 最近更新
- 5月11日
dingtalk-real-aidingtalk-calendar
钉钉日历与会议室。Use when 用户说 约会议/查日程/订会议室/查闲忙/加参会人/改期/取消会议/今天的日程/本周日程/共同空闲。不做视频会议发起/邀请入会/会中控制（走 dingtalk-misc）、AI 听记（走 dingtalk-minutes）、待办任务（走 dingtalk-todo）。命令前缀：dws calendar。
- 1小时安装量
- 1
- GitHub Stars
- 3716
- 最近更新
- 10月16日
quodsolerue-procedural-generation
Use when generating world content or geometry procedurally in Unreal Engine: PCG graphs, custom PCG nodes in C++, runtime mesh building, instancing and seeded noise. Also use when the user mentions 'PCG', 'UPCGComponent', 'UPCGSettings', 'IPCGElement', 'UPCGBasePointData', 'surface sampler', 'static mesh spawner', 'runtime generation', 'CreateMeshSection', 'UProceduralMeshComponent', 'UDynamicMeshComponent', 'Geometry Script', 'AddInstance', 'HISM', 'spline mesh', 'PerlinNoise', 'FRandomStream',
- 1小时安装量
- 1
- GitHub Stars
- 391
- 最近更新
- 9月28日
netlifynetlify-frameworks
Deploy and configure web frameworks on Netlify — build settings and SSR/edge adapters plus local platform emulation and env vars. Use when setting up or fixing a framework deploy (Next.js / Astro / Nuxt / SvelteKit / Remix / React Router / TanStack Start / SolidStart / Gatsby / Angular / Vite / Express / Hydrogen / Hugo / Eleventy / Vue / React), adding SSR or edge functions or middleware wired to Netlify context, fixing SPA redirect and catch-all rules, setting a build command or publish direct
- 1小时安装量
- 1
- GitHub Stars
- 41
- 最近更新
- 10月15日
meituaudio-song-generate
歌词驱动的完整歌曲生成（含人声），也支持强节奏成品级纯音乐。仅当用户明确要求生成歌曲/音频成品，并提供或同意补充风格与歌词参数时触发；普通音乐讨论、歌词创作、闲聊式演唱请求不触发。
- 1小时安装量
- 1
- GitHub Stars
- 34
- 最近更新
- 8月28日
caizongyuandevelopment-timeline
Record development stages and verification evidence, then generate offline HTML reports of delivery, waits, rework, and improvements. Use for PM milestone delivery, pauses, handoffs, or development retrospectives.
- 1小时安装量
- 1
- GitHub Stars
- 0
- 最近更新
- 10月6日
anthropicssector-overview
Create comprehensive industry and sector landscape reports covering market dynamics, competitive positioning, key players, and thematic trends. Use for client requests, sector initiations, thematic research pieces, or internal knowledge building. Triggers on "sector overview", "industry report", "market landscape", "sector analysis", "industry deep dive", or "thematic research".
- 1小时安装量
- 1
- GitHub Stars
- 4万
- 最近更新
- 9月21日
sickn33ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
- 1小时安装量
- 1
- GitHub Stars
- 4.8万
- 最近更新
- 10月14日
browserbaseautobrowse
Self-improving browser automation via the auto-research loop. Iteratively runs a browsing task, reads the trace, and improves the navigation skill (strategy.md) until it reliably passes. Supports parallel runs across multiple tasks using sub-agents. Use when you want to build or improve browser automation skills for specific website tasks.
- 1小时安装量
- 1
- GitHub Stars
- 3733
- 最近更新
- 9月29日
agricidanielseo-ecommerce
Analyze ecommerce SEO across product pages, product schema, Shopping visibility, marketplace signals, and keyword gaps. Use only for stores, catalogs, or product listings.
- 1小时安装量
- 1
- GitHub Stars
- 1.9万
- 最近更新
- 10月4日
dotnettooling
Implementation details for the EF Core dotnet-ef CLI and tooling. Use when changing dotnet-ef commands, the ef wrapper, EFCore.Tools (PMC), or EFCore.Tasks MSBuild integration.
- 1小时安装量
- 1
- GitHub Stars
- 1.5万
- 最近更新
- 10月15日
elementalsoulsbugcrowd-reporting
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulsevidence-hygiene
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {isadmin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: proto injection in JSON merge / Object.assign / lodash .merge → polluted prototype reaches sink (RCE in Node, XSS in
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-aspnet
Hunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-business-logic
Hunting skill for business logic vulnerabilities. Built from 12 public bug bounty reports. Covers coupon-race-stacking (Instacart, Stripe, Reverb), negative-quantity-in-cart price tampering (Upserve, Eternal/Zomato), decimal/fraction price-field overflow (Shipt), client-side checkout amount trust on PayPal redirect (WordPress.org), price-per-unit mass-assignment (Krisp), and archived-price swap / cart-TOCTOU (Stripe). Use when hunting business logic — heavy emphasis on financial-impact-demonstra
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-cicd
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pullrequesttarget Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachabl
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-clickjacking
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日
elementalsoulshunt-dispatch
Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.
- 1小时安装量
- 1
- GitHub Stars
- 5106
- 最近更新
- 10月15日