Claude skills directory
Short answer
A Claude skills directory is a browsable catalog of reusable instructions for Claude and other agents, with links to their sources. AgentSkillsDir is an independent, source-linked directory for discovering Claude and Codex skills, plus separate MCP server and agent collections. It is not Anthropic’s official documentation or a hosted runtime.
How to use itBrowse by task, open a skill card, then review its source and follow the upstream installation instructions for your client.
- 327 entries
- 33 publishers
- 323 with an open license
- Checked 17 Oct 2026 – 1 Nov 2026
All Claude skills
327 entries, metadata checked 17 Oct 2026 – 1 Nov 2026
Use case
Productivity113Development72Security analysis69Scientific research65Threat detection18Incident response & forensics17Creative tools15Cloud & infrastructure security12Application & supply-chain security10Identity & email security3Integrations3OT & ICS security3Publisher
mukul975180xS4N4TG0addyosmani0AirsupHQ0alchaincyf0alirezarezvani0anthropics0artouc0assafkip0cloudflare0cursor0debpalash0DietrichGebert0EL4CTEO0FeedHive0Fission-AI0Garinmckayl0garrytan0GhostPawJS0Graphify-Labs0heydamir0Jakeschincariol0juliobsz0K-Dense-AI0kepano0lemomo-ai0Leonxlnx0mattpocock0phuryn0tt-a1i0vercel-labs0wheresryan220Yuan1z08250Community first · Anthropic official entries follow. Sort applies within each group.
- building-cloud-siem-with-sentinelPlans Microsoft Sentinel connectors, detection queries and response automation, connecting cloud telemetry sources to a monitored security workflow.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- building-ioc-enrichment-pipeline-with-openctiOrganizes threat-indicator enrichment in OpenCTI, joining connector-supplied context to structured intelligence records for analyst review.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- configuring-snort-ids-for-intrusion-detectionConfigures Snort intrusion detection from traffic-monitoring requirements, arranging rules, tuning and alert outputs for an operational sensor.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- deploying-ransomware-canary-filesPlans monitored decoy files for ransomware detection, relating file placement and change events to an early-warning response workflow.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-credential-dumping-techniquesCorrelates Windows and endpoint events to identify credential-dumping indicators, producing defensive detection logic and investigation leads.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-entra-offensive-tools-in-graph-logsQueries Microsoft Graph activity logs for recognizable offensive-tool patterns, supporting defensive investigation of Entra tenant activity.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-insider-threat-with-uebaBuilds behavior baselines from user and entity events, turning anomalies and peer comparisons into alerts for insider-risk review.Third-party community repo, not affiliated with Anthropic
- detecting-pass-the-ticket-attacksAnalyzes Kerberos authentication events for suspicious ticket-use patterns, translating observations into SIEM detections and investigation questions.Third-party community repo, not affiliated with Anthropic
- detecting-s3-data-exfiltration-attemptsCorrelates S3 access and cloud telemetry to investigate possible data exfiltration, preserving the difference between unusual access and confirmed loss.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- detecting-suspicious-oauth-application-consentReviews Entra application-consent grants and audit activity for excessive permissions or suspicious authorization, producing an actionable investigation list.Third-party community repo, not affiliated with Anthropic
- generating-threat-intelligence-reportsTurns threat-intelligence evidence into audience-specific reports, separating strategic context from technical observations for security decision-makers.Third-party community repo, not affiliated with Anthropic
- hunting-for-beaconing-with-frequency-analysisExamines network timing patterns for possible command-channel beaconing, using statistical observations to guide defensive investigation rather than establish attribution.Third-party community repo, not affiliated with Anthropic
- hunting-for-lateral-movement-via-wmiCorrelates Windows process events for suspicious WMI-related movement, producing hunting questions and detection logic for endpoint investigators.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- hunting-for-scheduled-task-persistenceInvestigates scheduled-task creation and execution evidence to identify possible persistence, linking hunt hypotheses to host and SIEM observations.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- hunting-saas-sso-token-abuseCorrelates Entra and Okta session evidence for possible stolen-token use, organizing identity-hunting leads from observed authentication activity.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- performing-cloud-native-threat-hunting-with-aws-detectiveUses Amazon Detective behavior graphs to examine cloud incident entities and timelines, linking observations from supported AWS telemetry sources.Third-party community repo, not affiliated with Anthropic
- performing-lateral-movement-detectionCorrelates endpoint and network events for lateral-movement indicators, producing defensive investigation leads across several common movement patterns.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
- performing-user-behavior-analyticsBuilds user-behavior anomaly reviews from authentication and activity events, connecting unusual patterns to analyst investigation rather than automatic intent judgments.Third-party community repo, not affiliated with AnthropicHigh static risk — review source first
Guides that use this category
Best Blender MCP Servers & Skills (2026)Blender MCP connects an AI client to a running Blender session through the Model Context Protocol, so the model can read your scene and run Python through Blender’s API.Blender Agent Skills
Install Claude Code Skills: Folder, Plugin & CLIChoose one of three ways to install Claude Code skills: copy a complete skill folder, install a plugin from its marketplace, or use npx skills add with Claude Code selected.frontend-designpdfvercel-react-best-practices
Claude Code Security: Audit & Hardening SkillsA Claude Code security review starts with an authorized scope and a question to investigate.Cloudflare Security Auditsecurity-and-hardening
Best Codex Skills (2026)Codex can use agent skills: folders with a SKILL.Skills for Real EngineersgstackTaste SkillawwwardsAI Slop DetectorGhostPaw Codexhuashu-motionLemo-OpuscarMachine SkillanatomyBlender Agent Skills
Best Claude Skills for Video EditingPick a Claude skill by the video you need to ship.huashu-motionpapercut-explainerLemo-OpuscarMachine Skill
Skills directory and structure FAQ
6 questions · what the directory is, how skill folders are laid out, how to submit
What is a Claude skills directory?
A Claude skills directory is a browsable catalog of reusable instructions for Claude and other agents, with links to their sources. AgentSkillsDir is an independent, source-linked directory for discovering Claude and Codex skills, plus separate MCP server and agent collections. It is not Anthropic’s official documentation or a hosted runtime.
What is the typical Claude / agent skills directory structure?
Under the common Agent Skills convention, each skill has its own folder with a SKILL.md file. Optional scripts/, references/ and assets/ folders hold supporting code, documents and templates. This is a common layout, not a requirement for every listed project: follow each repository’s layout and your client’s documentation.
How is AgentSkillsDir different from claude.com docs / skillmd?
AgentSkillsDir provides source links and independent editorial summaries to help you discover resources. It is separate from Anthropic’s official Claude documentation and from other directories such as skillmd. Use official documentation for Claude product behavior and each publisher’s repository for setup, compatibility and license terms. A listing does not certify safety or successful installation.
How do I find the best Claude skills or MCP servers from here?
Start with the task and client you need, then compare the source-linked entries. For focused shortlists, use the video skills, Codex skills or Cursor MCP guides below. Check each candidate’s prerequisites and source terms; inclusion is not a promise that it will work in your setup.
How do I submit a skill or MCP server?
Open the submission page and share the public repository or project URL for manual review. Nothing is published automatically, and listing is not guaranteed. If online intake is unavailable, email the public link to submit@agentskillsdir.com.
What is a SKILL.md file?
SKILL.md is the instruction file in an Agent Skills folder. In the standard format, YAML front matter records a name and description, followed by Markdown instructions explaining the task. Read it and any supporting scripts before enabling a skill; the file is instructions, not proof of an audited or tested workflow.
