Browse Source-Indexed Agent Skills
Find SKILL.md workflows by category, repository, and source date, then inspect the original GitHub file before installing.
Inspect the source before you use a Skill
AI Vitamin indexes original GitHub SKILL.md files and source dates. A listing improves discovery; it does not certify compatibility, security, or requested permissions.
Learn how Agent Skills workBrowse by workflow
550 source-indexed records across 10 categories.
AI Agents & Models
Agent design, models, prompting, context, MCP, and evaluation workflows.
73 source recordsDevelopment & Engineering
Software delivery, codebases, APIs, SDKs, debugging, and developer workflows.
107 source recordsDesign & Frontend
Product design, UX, UI systems, frontend implementation, and visual work.
53 source recordsData, Research & Analysis
Research, data work, analytics, databases, visualisation, and evidence synthesis.
38 source recordsDocuments & Productivity
Documents, presentations, spreadsheets, knowledge work, and personal productivity.
37 source recordsWriting, Content & Marketing
Writing, editing, SEO, communications, content production, and marketing work.
61 source recordsCloud, DevOps & Infrastructure
Deployment, cloud platforms, CI/CD, operations, observability, and infrastructure.
44 source recordsAutomation & Integrations
Workflow automation, browser tasks, connected services, and cross-tool integrations.
16 source recordsSecurity, Quality & Compliance
Security, testing, quality assurance, accessibility, reviews, and compliance work.
108 source recordsBusiness & Operations
Product planning, sales, support, project delivery, and operational workflows.
13 source recordsSource records · Page 11
Only this page of records is included in the HTML response.
analyzing-certificate-transparency-for-phishing
Monitor Certificate Transparency logs using crt.sh and Certstream to
Source checked 2026-09-01analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files
Source checked 2026-09-01analyzing-cyber-kill-chain
'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
Source checked 2026-09-01analyzing-disk-image-with-autopsy
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and embedded artifacts, keyword searching, and building investigation timelines with visual reports. Use for structured analysis of a forensic disk image or when stakeholders need visual reports from evidence.
Source checked 2026-09-01analyzing-docker-container-forensics
Investigate compromised Docker containers by analyzing images, layers,
Source checked 2026-09-01analyzing-email-headers-for-phishing-investigation
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
Source checked 2026-09-01analyzing-ethereum-smart-contract-vulnerabilities
Perform static and symbolic analysis of Solidity smart contracts using
Source checked 2026-09-01analyzing-indicators-of-compromise
'Analyzes indicators of compromise (IOCs) including IP addresses, domains,
Source checked 2026-09-01analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
Source checked 2026-09-01analyzing-kubernetes-audit-logs
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access, and builds SIEM detection rules from the event patterns. Use when investigating a suspected cluster compromise, reconstructing what an attacker did through the API server, or writing Kubernetes-specific detection content. Keywords: audit policy, audit log, kube-apiserver, exec into pod, RBAC change, anonymous access, detection rules. Do not use for syscall-level detection inside a running container - use detecting-container-runtime-threats-with-falco. '
Source checked 2026-09-01analyzing-linux-audit-logs-for-intrusion
'Uses the Linux Audit framework (auditd) with ausearch and aureport utilities
Source checked 2026-09-01analyzing-linux-system-artifacts
Examine Linux system artifacts (auth logs, cron/systemd persistence,
Source checked 2026-09-01analyzing-lnk-file-and-jump-list-artifacts
Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,
Source checked 2026-09-01analyzing-memory-forensics-with-lime-and-volatility
'Performs Linux memory acquisition using LiME (Linux Memory Extractor)
Source checked 2026-09-01analyzing-mft-for-deleted-file-recovery
Analyze the NTFS Master File Table ($MFT) with MFTECmd, analyzeMFT,
Source checked 2026-09-01analyzing-network-flow-data-with-netflow
Parse NetFlow v9 and IPFIX records to detect volumetric anomalies, port
Source checked 2026-09-01analyzing-network-packets-with-scapy
Use Scapy to craft, send, sniff, and dissect TCP/UDP/ICMP/DNS packets, analyze pcap files, implement SYN scans, and detect anomalous traffic such as fragmented or malformed packets. Use when performing authorized network reconnaissance, protocol-level forensic analysis, or building traffic anomaly detection during security testing.
Source checked 2026-09-01analyzing-network-traffic-for-incidents
'Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including
Source checked 2026-09-01analyzing-network-traffic-with-wireshark
'Captures and analyzes network packet data using Wireshark and tshark
Source checked 2026-09-01analyzing-office365-audit-logs-for-compromise
Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect
Source checked 2026-09-01analyzing-outlook-pst-for-email-forensics
Parse Microsoft Outlook PST and OST files using libpff and pst-utils to extract message content, headers, attachments, deleted items, and MAPI metadata, including recovery of items from the Recoverable Items folder. Use when conducting email forensic investigations, legal e-discovery, or incident response that requires reconstructing communication patterns or tracing message routing from Outlook archives.
Source checked 2026-09-01analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX
Source checked 2026-09-01analyzing-prefetch-files-for-execution-history
Parse Windows Prefetch files (versions 17, 23, 26, 30) with tools like PECmd, WinPrefetchView, or python-prefetch to determine program execution history, including run counts, execution timestamps, and referenced files/DLLs. Use when building a timeline of program execution on a Windows system, confirming whether a suspicious binary ran, or correlating execution evidence with other forensic artifacts during an investigation.
Source checked 2026-09-01analyzing-sbom-for-supply-chain-vulnerabilities
'Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON
Source checked 2026-09-01analyzing-security-logs-with-splunk
'Leverages Splunk Enterprise Security and SPL (Search Processing Language)
Source checked 2026-09-01analyzing-slack-space-and-file-system-artifacts
Examine NTFS slack space, MFT entries, the USN Change Journal, and Alternate Data Streams (ADS) to recover hidden or residual data, reconstruct deleted-file metadata, and reconstruct available file-system change activity from USN records. Use during deep forensic analysis of an NTFS image when standard file recovery is insufficient, such as hunting for data hidden in ADS.
Source checked 2026-09-01analyzing-threat-actor-ttps-with-mitre-attack
Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
Source checked 2026-09-01analyzing-threat-actor-ttps-with-mitre-navigator
'Map advanced persistent threat (APT) group TTPs to the MITRE ATT&CK framework using the attackcti Python library to query STIX/TAXII data for group-technique associations, then generate ATT&CK Navigator layer files to visualize and compare defensive coverage against adversary profiles. Use when profiling an APT group''s techniques, building Navigator coverage heatmaps, or assessing technique coverage gaps against a specific threat actor.
Source checked 2026-09-01analyzing-threat-intelligence-feeds
'Analyzes structured and unstructured threat intelligence feeds to extract
Source checked 2026-09-01deploy-to-vercel
Deploy applications and websites to Vercel. Use when the user requests deployment actions like "deploy my app", "deploy and give me the link", "push this live", or "create a preview deployment".
Source checked 2026-08-26vercel-cli-with-tokens
Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive login — e.g. "deploy to vercel", "set up vercel", "add environment variables to vercel".
Source checked 2026-08-26vercel-optimize
Use for Vercel cost and performance optimization on deployed projects, especially Next.js, SvelteKit, Nuxt, and limited Astro apps. Collect Vercel metrics, usage, project config, and code scan results first; investigate only metric-backed candidates; produce ranked recommendations grounded in verified files and version-aware Vercel/framework docs. Trigger for Vercel bill reduction, slow or expensive routes, caching opportunities, Function Invocations, Build Minutes, Fast Data Transfer, Core Web Vitals, Bot Management, Fluid compute, or cost breakdown requests.
Source checked 2026-08-26vercel-react-best-practices
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Source checked 2026-08-26vercel-react-view-transitions
Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.
Source checked 2026-08-26web-design-guidelines
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
Source checked 2026-08-26writing-guidelines
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
Source checked 2026-08-26