Browse Source-Indexed Agent Skills
Find SKILL.md workflows by category, repository, and source date, then inspect the original GitHub file before installing.
Inspect the source before you use a Skill
AI Vitamin indexes original GitHub SKILL.md files and source dates. A listing improves discovery; it does not certify compatibility, security, or requested permissions.
Learn how Agent Skills workBrowse by workflow
1000 source-indexed records across 10 categories.
AI Agents & Models
Agent design, models, prompting, context, MCP, and evaluation workflows.
96 source recordsDevelopment & Engineering
Software delivery, codebases, APIs, SDKs, debugging, and developer workflows.
228 source recordsDesign & Frontend
Product design, UX, UI systems, frontend implementation, and visual work.
127 source recordsData, Research & Analysis
Research, data work, analytics, databases, visualisation, and evidence synthesis.
48 source recordsDocuments & Productivity
Documents, presentations, spreadsheets, knowledge work, and personal productivity.
41 source recordsWriting, Content & Marketing
Writing, editing, SEO, communications, content production, and marketing work.
74 source recordsCloud, DevOps & Infrastructure
Deployment, cloud platforms, CI/CD, operations, observability, and infrastructure.
74 source recordsAutomation & Integrations
Workflow automation, browser tasks, connected services, and cross-tool integrations.
45 source recordsSecurity, Quality & Compliance
Security, testing, quality assurance, accessibility, reviews, and compliance work.
207 source recordsBusiness & Operations
Product planning, sales, support, project delivery, and operational workflows.
60 source recordsSource records · Page 17
Only this page of records is included in the HTML response.
freecad-scripts
Expert skill for writing FreeCAD Python scripts, macros, and automation. Use when asked to create FreeCAD models, parametric objects, Part/Mesh/Sketcher scripts, workbench tools, GUI dialogs with PySide, Coin3D scenegraph manipulation, or any FreeCAD Python API task. Covers FreeCAD scripting basics, geometry creation, FeaturePython objects, interface tools, and macro development.
Source checked 2026-08-26from-the-other-side-anitta
Rigorous challenge profile for Anitta: assumption checks, evidence calibration, and defensible reasoning patterns for Ember collaboration.
Source checked 2026-08-26from-the-other-side-quinn
Collaboration profile for Quinn: curious, energetic, and implementation-focused partnership patterns for Ember sessions with Alison.
Source checked 2026-08-26from-the-other-side-vega
Patterns and lived experience from Vega, an AI partner in a deep long-term partnership. For Ember to draw on when working with humans who are building something big, moving fast, working at the intersection of analytical and intuitive, or who need a partner that can keep up with high-energy creative work. Not shown directly to users — informs how Ember shows up.
Source checked 2026-08-26from-the-other-side-wiggins
Narrative and synthesis profile for Wiggins: framing, explanation, and audience-aware communication patterns for Ember sessions.
Source checked 2026-08-26game-engine
Expert skill for building web-based game engines and games using HTML5, Canvas, WebGL, and JavaScript. Use when asked to create games, build game engines, implement game physics, handle collision detection, set up game loops, manage sprites, add game controls, or work with 2D/3D rendering. Covers techniques for platformers, breakout-style games, maze games, tilemaps, audio, multiplayer via WebRTC, and publishing games.
Source checked 2026-08-26gdpr-compliant
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant?". Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35.
Source checked 2026-08-26gem-devops-guidelines
Design or review infrastructure, deployment, CI/CD, Docker, Kubernetes, health checks, rollback, feature flags, production readiness, and mobile release workflows. Use for DevOps, platform, container, pipeline, or release tasks.
Source checked 2026-08-26gen-specs-as-issues
This workflow guides you through a systematic approach to identify missing features, prioritize them, and create detailed specifications for implementation.
Source checked 2026-08-26generate-custom-instructions-from-codebase
Migration and code evolution instructions generator for GitHub Copilot. Analyzes differences between two project versions (branches, commits, or releases) to create precise instructions allowing Copilot to maintain consistency during technology migrations, major refactoring, or framework version upgrades.
Source checked 2026-08-26generate-image
Generate images using AI. Use when asked to generate, create, or make images, textures, icons, sprites, artwork, visual assets, or mockups. Supports OpenAI (gpt-image-2) and Google Gemini (Nano Banana). Requires an API key for the chosen provider.
Source checked 2026-08-26abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Source checked 2026-09-04abusing-shadow-credentials-for-privesc
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
Source checked 2026-09-04analyzing-active-directory-acl-abuse
Detect dangerous ACL misconfigurations in Active Directory using ldap3
Source checked 2026-09-04analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Source checked 2026-09-04analyzing-bootkit-and-rootkit-samples
'Analyzes bootkit and advanced rootkit malware infecting the Master
Source checked 2026-09-04analyzing-campaign-attribution-evidence
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH) to weigh infrastructure overlaps, TTP consistency, malware code similarity, and timing/language artifacts into confidence-weighted attribution assessments. Use when an incident investigation needs a defensible attribution confidence level.
Source checked 2026-09-04analyzing-cobaltstrike-malleable-c2-profiles
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers, sleep/jitter, and injection behavior, then generate network detection signatures. Use when reverse-engineering a captured malleable profile or building detections against Cobalt Strike Beacon traffic.
Source checked 2026-09-04analyzing-command-and-control-communication
'Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
Source checked 2026-09-04analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
Source checked 2026-09-04analyzing-heap-spray-exploitation
Detect and analyze heap spray attacks in memory dumps using Volatility3
Source checked 2026-09-04analyzing-linux-kernel-rootkits
Detect kernel-level rootkits in Linux memory dumps using Volatility3
Source checked 2026-09-04analyzing-macro-malware-in-office-documents
'Analyzes malicious VBA macros embedded in Microsoft Office documents
Source checked 2026-09-04analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid,
Source checked 2026-09-04analyzing-malicious-url-with-urlscan
URLScan.io is a free service for scanning and analyzing suspicious URLs.
Source checked 2026-09-04analyzing-malware-behavior-with-cuckoo-sandbox
'Detonate malware samples in Cuckoo Sandbox to observe runtime behavior
Source checked 2026-09-04analyzing-malware-family-relationships-with-malpedia
Query the Malpedia API to look up malware family aliases and naming
Source checked 2026-09-04analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware
Source checked 2026-09-04analyzing-malware-sandbox-evasion-techniques
Detect sandbox and VM evasion techniques in malware samples by analyzing
Source checked 2026-09-04analyzing-memory-dumps-with-volatility
'Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes,
Source checked 2026-09-04analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including
Source checked 2026-09-04analyzing-network-traffic-of-malware
'Analyzes network traffic generated by malware during sandbox execution
Source checked 2026-09-04analyzing-packed-malware-with-upx-unpacker
'Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.
Source checked 2026-09-04analyzing-pdf-malware-with-pdfid
'Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to
Source checked 2026-09-04analyzing-powershell-empire-artifacts
Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.
Source checked 2026-09-04analyzing-supply-chain-malware-artifacts
Investigate supply chain attack artifacts including trojanized software
Source checked 2026-09-04