Security skills
Read straight from the source repositories, not from submitted listings. Every skill shows what it does, what is inside, where it came from — and whether attention around its source is actually growing.
scripts
scriptsscripts
writesscripts
scriptsscriptswritesscripts
scripts
scripts
scripts
scriptsscriptswritesscriptsscripts
scriptswritesscriptswritesscripts
scriptsscriptswritesscriptsscripts
scriptswritesscriptswritesscriptsscriptswritesscriptsscripts
writesscriptsscripts
scripts
writesscripts
scripts
scripts
scriptswritesscriptsscripts
scriptsscriptswritesscripts
scriptsscriptsscriptsscriptsscriptsscripts
scripts
scriptsscriptsWhat is an agent skill?
A folder with a SKILL.md inside — instructions, and often scripts and assets, that an AI agent loads when the task matches. Claude Code, Codex, Cursor and Copilot all read the same format, so one skill usually works across them.
Where does this catalog come from?
We read 660 source repositories straight from their file trees rather than from submitted listings — what you see is what is actually published. 98 repositories were rejected because they advertise skills but contain none: link lists, not folders.
Why is there no install counter?
Because install counts live in the registry that serves `npx skills add`, and that is not ours — publishing a number we cannot verify would be worse than showing none. Instead we show where a skill comes from and whether attention around its source is actually growing, measured from our own weekly snapshots.
Do you deduplicate?
Yes, and it matters more than expected. Aggregator repositories republish the same skill in several places — one source carried 6,317 SKILL.md files for 2,001 actual skills. We collapse by folder name and keep the canonical copy, so the catalog counts things, not copies.