Claude skills directory
Short answer
A Claude skills directory is a browsable catalog of reusable instructions for Claude and other agents, with links to their sources. AgentSkillsDir is an independent, source-linked directory for discovering Claude and Codex skills, plus separate MCP server and agent collections. It is not Anthropic’s official documentation or a hosted runtime.
How to use itBrowse by task, open a skill card, then review its source and follow the upstream installation instructions for your client.
- 327 entries
- 33 publishers
- 323 with an open license
- Checked 17 Oct 2026 – 1 Nov 2026
All Claude skills
327 entries, metadata checked 17 Oct 2026 – 1 Nov 2026
Use case
Security analysis63Scientific research22Threat detection18Incident response & forensics17Cloud & infrastructure security12Application & supply-chain security10Productivity9Development3Identity & email security3OT & ICS security3Creative tools1Integrations1Publisher
mukul97563Yuan1z082520anthropics9K-Dense-AI3Graphify-Labs1tt-a1i1vercel-labs10xS4N4TG0addyosmani0AirsupHQ0alchaincyf0alirezarezvani0artouc0assafkip0cloudflare0cursor0debpalash0DietrichGebert0EL4CTEO0FeedHive0Fission-AI0Garinmckayl0garrytan0GhostPawJS0heydamir0Jakeschincariol0juliobsz0kepano0lemomo-ai0Leonxlnx0mattpocock0phuryn0wheresryan220Community first · Anthropic official entries follow. Sort applies within each group.
Showing 98 of 327
agent-browserVercel Labs’ browser automation CLI for AI agents (Chrome via CDP, accessibility-tree snapshots) and its discovery skill. Install the CLI, add the skill, then load workflows with agent-browser skills get core.
archifytt-a1i’s Archify agent skill: turns an idea, plan or codebase into a standalone interactive HTML architecture diagram for people to explore and share.
graphifyGraphify Labs’ /graphify skill and CLI: turns a folder of code, docs and PDFs into a queryable knowledge graph for coding agents. PyPI package graphifyy (double y).- nature-academic-searchBuilds scientific literature searches and verifies citation evidence, connecting topics, indexing terms and source records to a traceable research result.High static risk — review source first
- nature-citationFinds literature supporting manuscript claims within the requested journal scope, producing claim-to-source mappings and reference-manager exports.
- nature-dataDrafts and checks manuscript data-availability statements and repository plans, connecting actual access routes to metadata and citation requirements.
- nature-downloaderRetrieves academic full text through lawful institutional or public routes, recording access provenance and supplementary-material availability.High static risk — review source first
- nature-figureCreates and audits manuscript figures in Python or R, delivering source-linked plots and exports suitable for the requested submission context.
- nature-image2pptReconstructs screenshot or image-only slides as editable PowerPoint objects, separating layout elements and text rather than merely embedding a full-page image.High static risk — review source first
- nature-paper-cardBuilds a structured reading card for one paper, linking methods and experiments to claims, limitations and possible follow-up research.High static risk — review source first
- nature-paper-to-patentTurns research evidence and inventor materials into a Chinese patent-draft package, preserving the distinction between supplied facts and proposed claim language.High static risk — review source first
- nature-paper-transTranslates selected pages or a complete English paper into a Chinese reading PDF, aiming to preserve the original page layout and figures.High static risk — review source first
- nature-paper-xrayReconstructs a paper's reasoning from methods and evidence, explaining how the authors reached a result instead of restating the abstract.
- nature-paper2pptBuilds an academic presentation from a paper and reading notes, organizing source figures, Chinese slide text and speaker notes.
- nature-polishingEdits existing academic prose for clarity and terminology while preserving factual claims, supporting translation and manuscript-layout adjustments within scope.
- nature-readerCreates aligned Chinese-English paper readers with source-linked text and visual material, supporting close reading at the requested excerpt scope.
- nature-ref-verifierChecks reference-list metadata against multiple sources, reporting author, title, date and DOI conflicts in a structured verification record.High static risk — review source first
- nature-responseDrafts and audits responses to peer review from supplied reviewer comments and revisions, connecting each response to manuscript evidence.
- nature-reviewerProvides evidence-based mock peer review of a manuscript, separating major validity concerns from smaller clarity and presentation issues.
- nature-sharedProvides shared references for the Nature skill collection, supporting other installed workflows rather than acting as a standalone research task.
- nature-social-scienceDevelops social-science and philosophy research questions into defensible proposals, organizing argument, evidence routes and boundaries for scholarly review.
- nature-statisticsChecks statistical reporting in a manuscript, reviewing experimental units, replication and uncertainty so claims can be compared with the documented analysis.
- nature-writingStructures a scientific manuscript from author-supplied evidence, connecting sections and claims into an argument for initial submission.
- markdown-mermaid-writingWrites scientific documentation and Mermaid diagrams from workflow or relationship information, providing editable text sources for technical communication.
- polars-bioPerforms genomic interval operations in Polars and manages common sequence file formats, supporting reproducible overlap, coverage and nearest-feature analyses.High static risk — review source first
- qiskitDevelops quantum circuits with Qiskit and prepares simulation or runtime execution, checking target constraints, transpilation and supported primitives.High static risk — review source first
- analyzing-browser-forensics-with-hindsightExamines Chromium browser artifacts for forensic investigation; its access to sensitive browser records requires specialized evidence-handling controls.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.
- analyzing-docker-container-forensicsOrganizes evidence from Docker images, volumes and logs to investigate a compromised container and reconstruct suspicious activity.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- analyzing-linux-kernel-rootkitsExamines Linux memory and system observations for kernel-rootkit indicators, connecting discrepancies to a controlled forensic investigation.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.
- analyzing-memory-dumps-with-volatilityAnalyzes captured memory with Volatility to locate suspicious processes and related artifacts, requiring careful handling of potentially sensitive evidence.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- analyzing-packed-malware-with-upx-unpackerExamines packed malware samples to recover analyzable program structure, supporting specialist static analysis inside an isolated research environment.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.
- analyzing-sbom-for-supply-chain-vulnerabilitiesCorrelates software-bill-of-materials components with vulnerability records, producing dependency findings from CycloneDX or SPDX inputs.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- analyzing-uefi-bootkit-persistenceInvestigates firmware and boot artifacts for UEFI persistence indicators, organizing integrity observations for a specialist forensic review.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- auditing-terraform-infrastructure-for-securityChecks Terraform definitions for risky infrastructure configuration, organizing policy findings about access, exposure and resource safeguards.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- building-cloud-siem-with-sentinelPlans Microsoft Sentinel connectors, detection queries and response automation, connecting cloud telemetry sources to a monitored security workflow.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- building-ioc-enrichment-pipeline-with-openctiOrganizes threat-indicator enrichment in OpenCTI, joining connector-supplied context to structured intelligence records for analyst review.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- building-super-timelines-with-plasoCombines host artifacts into Plaso investigation timelines, supporting evidence correlation while preserving the distinction between observed timestamps and inferred events.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.
- building-vulnerability-scanning-workflowOrganizes vulnerability scanning from asset discovery through remediation tracking, helping security teams prioritize findings rather than treating every alert equally.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.
- configuring-certificate-authority-with-opensslPlans a certificate-authority hierarchy with OpenSSL, organizing certificate extensions, revocation materials and issuance responsibilities for a controlled PKI.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- configuring-snort-ids-for-intrusion-detectionConfigures Snort intrusion detection from traffic-monitoring requirements, arranging rules, tuning and alert outputs for an operational sensor.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- deobfuscating-javascript-malwareExamines obfuscated malicious JavaScript to support analyst understanding of its behavior, using a controlled malware-analysis context.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- deploying-ransomware-canary-filesPlans monitored decoy files for ransomware detection, relating file placement and change events to an early-warning response workflow.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-attacks-on-scada-systemsOrganizes detection of suspicious industrial-control activity, relating SCADA protocol and network observations to defensive monitoring requirements.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-broken-object-property-level-authorizationReviews API property exposure and update permissions for authorization failures, collecting evidence that distinguishes excess data from unintended write access.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-credential-dumping-techniquesCorrelates Windows and endpoint events to identify credential-dumping indicators, producing defensive detection logic and investigation leads.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-entra-offensive-tools-in-graph-logsQueries Microsoft Graph activity logs for recognizable offensive-tool patterns, supporting defensive investigation of Entra tenant activity.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-insider-threat-with-uebaBuilds behavior baselines from user and entity events, turning anomalies and peer comparisons into alerts for insider-risk review.Third-party community repo, not affiliated with Anthropic
- detecting-misconfigured-azure-storageAudits Azure Storage configuration for unintended exposure and weak controls, organizing findings about access tokens, encryption, logging and networking.Third-party community repo, not affiliated with Anthropic
- detecting-pass-the-ticket-attacksAnalyzes Kerberos authentication events for suspicious ticket-use patterns, translating observations into SIEM detections and investigation questions.Third-party community repo, not affiliated with Anthropic
- detecting-s3-data-exfiltration-attemptsCorrelates S3 access and cloud telemetry to investigate possible data exfiltration, preserving the difference between unusual access and confirmed loss.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-suspicious-oauth-application-consentReviews Entra application-consent grants and audit activity for excessive permissions or suspicious authorization, producing an actionable investigation list.Third-party community repo, not affiliated with Anthropic
- eradicating-malware-from-infected-systemsStructures malware eradication around observed persistence and affected systems, organizing removal and verification work within an incident-response process.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- generating-threat-intelligence-reportsTurns threat-intelligence evidence into audience-specific reports, separating strategic context from technical observations for security decision-makers.Third-party community repo, not affiliated with Anthropic
- hunting-for-beaconing-with-frequency-analysisExamines network timing patterns for possible command-channel beaconing, using statistical observations to guide defensive investigation rather than establish attribution.Third-party community repo, not affiliated with Anthropic
- hunting-for-lateral-movement-via-wmiCorrelates Windows process events for suspicious WMI-related movement, producing hunting questions and detection logic for endpoint investigators.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- hunting-for-scheduled-task-persistenceInvestigates scheduled-task creation and execution evidence to identify possible persistence, linking hunt hypotheses to host and SIEM observations.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- hunting-saas-sso-token-abuseCorrelates Entra and Okta session evidence for possible stolen-token use, organizing identity-hunting leads from observed authentication activity.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-api-security-posture-managementOrganizes API discovery and risk classification for security-posture management, combining inventory and findings into a reviewable service view.Third-party community repo, not affiliated with Anthropic
- implementing-aws-security-hub-compliancePlans multi-account AWS Security Hub aggregation and standards checks, linking cloud-service findings to a coordinated compliance review.Third-party community repo, not affiliated with Anthropic
- implementing-cloud-security-posture-managementReviews cloud configuration across providers with posture-management tools, organizing exposure and compliance findings for ongoing remediation.Third-party community repo, not affiliated with Anthropic
- implementing-continuous-security-validation-with-basPlans controlled breach-and-attack simulation to evaluate defensive coverage, requiring scoped test approval before any active validation exercise.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-dmarc-dkim-spf-email-securityReviews and configures mail-authentication DNS records, connecting SPF, DKIM and DMARC alignment to sender validation and reporting needs.Third-party community repo, not affiliated with Anthropic
- implementing-fuzz-testing-in-cicd-with-aflplusplusIntegrates AFL++ fuzzing into CI around a defined target, preparing instrumentation and repeatable runs that expose memory-safety failures.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-hashicorp-vault-dynamic-secretsPlans Vault-issued short-lived credentials and certificates, organizing lease management and rotation to reduce dependence on static secrets.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-infrastructure-as-code-security-scanningAdds infrastructure-as-code checks to delivery workflows, translating scanner findings in templates and manifests into focused configuration fixes.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-microsegmentation-with-guardicoreMaps application dependencies for network microsegmentation, using observed east-west communication to design narrower access policies.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-network-policies-for-kubernetesDrafts portable Kubernetes NetworkPolicy definitions from access requirements, covering selectors, default-deny behavior and essential DNS communication.Third-party community repo, not affiliated with Anthropic
- implementing-passwordless-authentication-with-fido2Plans WebAuthn and FIDO2 account flows, connecting authenticator enrollment and server verification to a passwordless authentication design.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-purdue-model-network-segmentationMaps industrial networks into Purdue-model security zones, organizing segmentation requirements and communication boundaries for operational-control environments.Third-party community repo, not affiliated with Anthropic
- implementing-secret-scanning-with-gitleaksIntegrates Gitleaks into local and CI checks, defining repository scanning rules and response steps for accidental credential exposure.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-sigstore-for-software-signingPlans Sigstore signing and verification for software artifacts, connecting identity-based signatures and transparency evidence to supply-chain checks.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-ticketing-system-for-incidentsLinks security alerts to incident tickets, organizing ownership, escalation and service-level tracking across supported case-management tools.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- implementing-zero-trust-in-cloudPlans cloud access around identity and continuous verification, combining segmentation and device considerations into a scoped zero-trust architecture.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- investigating-ransomware-attack-artifactsOrganizes preservation and analysis of ransomware artifacts, retaining evidence provenance before investigators assess variant identity and incident scope.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- performing-api-security-testing-with-postmanBuilds Postman collections for scoped API security assessments, organizing roles, requests and assertions into repeatable authorization and exposure checks.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- performing-cloud-native-threat-hunting-with-aws-detectiveUses Amazon Detective behavior graphs to examine cloud incident entities and timelines, linking observations from supported AWS telemetry sources.Third-party community repo, not affiliated with Anthropic
- performing-cve-prioritization-with-kev-catalogCombines CISA exploited-vulnerability records with prioritization signals, producing a ranked patch-review list with explicit scoring assumptions.Third-party community repo, not affiliated with Anthropic
- performing-dynamic-analysis-with-any-runObserves malware behavior in an interactive cloud sandbox, organizing execution findings for specialist analysis with isolation and disclosure considerations.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- performing-gcp-security-assessment-with-forsetiExamines GCP access and resource configuration through posture-assessment tooling, organizing cloud-security findings against the available project evidence.Third-party community repo, not affiliated with Anthropic
- performing-insider-threat-investigationStructures an insider-threat investigation around access records and observed actions, separating evidence collection from conclusions about intent.Third-party community repo, not affiliated with Anthropic
- performing-lateral-movement-detectionCorrelates endpoint and network events for lateral-movement indicators, producing defensive investigation leads across several common movement patterns.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- performing-memory-forensics-with-volatility3Examines captured RAM with Volatility 3, correlating processes and network artifacts for a controlled investigation of potentially sensitive memory evidence.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- performing-power-grid-cybersecurity-assessmentStructures security review of power-grid systems around network zones and operational requirements, connecting findings to infrastructure-specific assessment evidence.Third-party community repo, not affiliated with Anthropic
- performing-steganography-detectionExamines media for concealed data using steganalysis tools, organizing extraction findings for a controlled forensic investigation.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- performing-user-behavior-analyticsBuilds user-behavior anomaly reviews from authentication and activity events, connecting unusual patterns to analyst investigation rather than automatic intent judgments.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- performing-windows-artifact-analysis-with-eric-zimmerman-toolsParses Windows forensic artifacts with specialist utilities, organizing host timelines and evidence for an authorized incident investigation.Third-party community repo, not affiliated with AnthropicFor authorized defensive security testing, incident forensics, and research only. Unauthorized access is prohibited.High static risk — review source first
- scanning-containers-with-trivy-in-cicdAdds Trivy scans to container delivery workflows, collecting package and configuration findings so remediation can be checked before release.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- securing-container-registry-imagesOrganizes image scanning, signing and registry access controls, connecting container artifact provenance to release checks.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- testing-ransomware-recovery-proceduresChecks ransomware recovery plans through restore tests and recovery-time evidence, documenting whether backups support the intended clean-recovery sequence.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
academy-guideFinds relevant Claude Academy learning materials for questions about using Claude and its products.
algorithmic-artGuides original generative artwork in p5.js, including seeded randomness and interactive controls.
brand-guidelinesApplies Anthropic brand colors and typography to visual artifacts.
canvas-designGuides original static visual work, such as posters, in PNG or PDF format.
claude-apiProvides reference material for Claude API and SDK work, covering model configuration, streaming, tools and related features.
discernment-nudgeSuggests brief follow-up questions that help users check facts, assumptions and missing context in substantive answers or drafts.
frontend-designOffers guidance on deliberate visual design, typography and aesthetic decisions for new or revised interfaces.
internal-commsProvides formats and resources for internal communications, including status updates, newsletters and incident reports.
mcp-builderGuides development of MCP servers that expose external services through tools in Python or TypeScript.
Guides that use this category
Best Blender MCP Servers & Skills (2026)Blender MCP connects an AI client to a running Blender session through the Model Context Protocol, so the model can read your scene and run Python through Blender’s API.Blender Agent Skills
Install Claude Code Skills: Folder, Plugin & CLIChoose one of three ways to install Claude Code skills: copy a complete skill folder, install a plugin from its marketplace, or use npx skills add with Claude Code selected.frontend-designpdfvercel-react-best-practices
Claude Code Security: Audit & Hardening SkillsA Claude Code security review starts with an authorized scope and a question to investigate.Cloudflare Security Auditsecurity-and-hardening
Best Codex Skills (2026)Codex can use agent skills: folders with a SKILL.Skills for Real EngineersgstackTaste SkillawwwardsAI Slop DetectorGhostPaw Codexhuashu-motionLemo-OpuscarMachine SkillanatomyBlender Agent Skills
Best Claude Skills for Video EditingPick a Claude skill by the video you need to ship.huashu-motionpapercut-explainerLemo-OpuscarMachine Skill
Skills directory and structure FAQ
6 questions · what the directory is, how skill folders are laid out, how to submit
What is a Claude skills directory?
A Claude skills directory is a browsable catalog of reusable instructions for Claude and other agents, with links to their sources. AgentSkillsDir is an independent, source-linked directory for discovering Claude and Codex skills, plus separate MCP server and agent collections. It is not Anthropic’s official documentation or a hosted runtime.
What is the typical Claude / agent skills directory structure?
Under the common Agent Skills convention, each skill has its own folder with a SKILL.md file. Optional scripts/, references/ and assets/ folders hold supporting code, documents and templates. This is a common layout, not a requirement for every listed project: follow each repository’s layout and your client’s documentation.
How is AgentSkillsDir different from claude.com docs / skillmd?
AgentSkillsDir provides source links and independent editorial summaries to help you discover resources. It is separate from Anthropic’s official Claude documentation and from other directories such as skillmd. Use official documentation for Claude product behavior and each publisher’s repository for setup, compatibility and license terms. A listing does not certify safety or successful installation.
How do I find the best Claude skills or MCP servers from here?
Start with the task and client you need, then compare the source-linked entries. For focused shortlists, use the video skills, Codex skills or Cursor MCP guides below. Check each candidate’s prerequisites and source terms; inclusion is not a promise that it will work in your setup.
How do I submit a skill or MCP server?
Open the submission page and share the public repository or project URL for manual review. Nothing is published automatically, and listing is not guaranteed. If online intake is unavailable, email the public link to submit@agentskillsdir.com.
What is a SKILL.md file?
SKILL.md is the instruction file in an Agent Skills folder. In the standard format, YAML front matter records a name and description, followed by Markdown instructions explaining the task. Read it and any supporting scripts before enabling a skill; the file is instructions, not proof of an audited or tested workflow.
