What's an agent skill?
Agent Skills are portable instruction packs — a folder with a SKILL.md (YAML frontmatter + a step-by-step workflow), plus optional scripts, references and assets — that teach an AI agent WHEN to apply a technique, HOW to execute it, and HOW to verify success. Compatible agents (Claude Code, Copilot, Cursor, and NVIDIA agents) load them on demand, so you extend an agent’s real-world abilities without retraining or rebuilding it.
The standard. Open SKILL.md format (agentskills.io). Skills are model- and vendor-portable; the same skill can drop into Claude Code, Cursor, Copilot and 20+ platforms with zero config.
Why SMBs should care. For SMBs this is leverage: instead of hiring a specialist, you load a vetted skill pack and your existing coding/agent tool gains a senior practitioner’s playbook. Governance matters too — prefer signed/verified skills and review SKILL.md before trusting one (skills can carry prompt-injection or excessive-agency risk).
Skill collections worth knowing
ECC skill library
affaan-m · ecc.tools · MIT
281 skills · 67 agents · 94 commands
CoversTDD, research-first dev, security (AgentShield), docs, frontend, ML, operations — skills-first with language rule packs (TS, Python, Go, Swift, PHP).GovernanceHooks enforce quality gates at runtime; a Unified Memory Vault persists context across sessions in portable Markdown.Best forStandardizing plan → test → implement → review → verify → remember → improve across every coding agent.SMB fitMIT, one-command install (npx ecc-install) — the widest single skill library here.
NVIDIA-Verified Agent Skills
NVIDIA · Per-skill (signed)
Growing catalog
CoversCUDA-X libraries, AI Blueprints, NeMo training/inference, RAG + AI-Q + NemoClaw + agent-sandbox workflows, optimization (routing/scheduling/LP/QP), distributed training (Megatron-Core/DALI/Nemotron), vision/video, Omniverse & Physical AI (USD).GovernanceScanned before publication for software AND agent-native risks (hidden instructions, prompt injection, trigger abuse, excessive agency). Each skill is signed (detached skill.oms.sig) and ships a "skill card" recording purpose, owner, license, dependencies, limitations and risks.Best forTeams building on the NVIDIA stack who need governed, verifiable, signed skills — security-conscious enterprises.SMB fitBest fit if you already use NIM/NeMo; the verification + signing is enterprise-grade hygiene.
Anthropic Cybersecurity Skills
Community (mukul975) · Apache 2.0
817 skills · 29 domains
CoversThreat analysis (memory forensics, malware, threat hunting), incident response (DFIR, ransomware, containment), cloud security (AWS/Azure/GCP, CSPM), identity & access (Entra ID, zero trust, PAM), pen-testing (red team, lateral movement), DevSecOps (CI/CD, container scanning, code signing).GovernanceEach skill maps to six industry frameworks: MITRE ATT&CK v19.1 (286 techniques), NIST CSF 2.0, MITRE ATLAS (AI/ML threats), MITRE D3FEND, NIST AI RMF, MITRE F3 (financial fraud). Standard SKILL.md + references/scripts/assets layout.Best forSOC / security teams that want to give Claude Code, Copilot or Cursor a senior analyst’s playbooks — "the largest open-source cybersecurity skills library for AI agents."SMB fitHigh — zero-config load into Claude Code; huge value for small teams without a dedicated security analyst.
gstack
Garry Tan · MIT
23 skills
CoversA full sprint workflow (Think → Plan → Build → Review → Test → Ship → Reflect): planning (/office-hours, /plan-*-review), design (/design-shotgun, /design-html), dev (/review, /investigate, /autoplan), QA (/qa, /benchmark, real headless-Chromium browser testing), deploy (/ship, /canary), docs (/document-*).GovernanceIncludes safety guardrails (/careful, /freeze, /guard) and a security reviewer (/cso). Open MIT, review-before-use.Best forSolo founders & small teams shipping product fast — "turns Claude Code into a virtual engineering team." Cross-model review (Claude + Codex), persistent memory (GBrain), parallel sprints.SMB fitVery high — designed for technical founders and first-time Claude Code users; free, no waitlist.
Skills For Real Engineers (mattpocock/skills)
Matt Pocock (AI Hero / Total TypeScript) · MIT
21 skills · 3 groups
CoversSoftware-engineering fundamentals as drop-in skills: requirement 'grilling' / alignment (grill-me, grill-with-docs), domain modeling with a shared CONTEXT.md + ADR language, TDD (red-green-refactor), a disciplined bug-diagnosis loop, deep-module codebase architecture, PRD → vertical-slice issues, issue triage, and prototyping — plus git guardrails and pre-commit setup.GovernanceClean user-invoked vs model-invoked split: user-invoked skills orchestrate (you type them, e.g. /grill-me), model-invoked ones hold reusable discipline and the agent can reach for them automatically — a user-invoked skill may call model-invoked ones but never another user-invoked. Model-agnostic, open MIT, review-before-use. Ships a git-guardrails skill that blocks dangerous git commands (push, reset --hard, clean) via Claude Code hooks.Best forEngineers and technical founders on Claude Code / Codex / Cursor who want small, composable, fundamentals-based skills (TDD, domain modeling, architecture) instead of heavyweight, control-taking process frameworks (GSD, BMAD, Spec-Kit) — "real engineering, not vibe coding."SMB fitHigh — model-agnostic and free (MIT). Install with `npx skills@latest add mattpocock/skills`, pick the skills + your agent, and a small dev team gains a senior engineer's daily playbook.
DeerFlow skill modules
ByteDance · MIT
Extensible
CoversModular, progressively-loaded capabilities inside the DeerFlow SuperAgent — research, coding, content creation — composed with MCP tools and sub-agents. (See the Agent harnesses tab for the full runtime.)GovernanceSkills load progressively (on-demand) inside a sandboxed runtime; review modules as with any open skill.Best forTeams already running DeerFlow who want to extend it with bespoke, on-demand skills rather than a monolith.SMB fitTied to adopting DeerFlow itself; powerful but heavier than a drop-in skill pack.
ponytail
Dietrich Gebert · MIT
1 skill, ported to 20+ agent platforms
CoversRuns a decision ladder before any code gets written: does it need to exist? → already in this codebase? → stdlib does it? → native platform feature? → installed dependency? → one line? → only then, the minimum that works. Preserves validation, error handling, security and accessibility guardrails while cutting bloat.GovernanceShips as lifecycle hooks for Claude Code and Codex, and instruction injection for the rest (Copilot CLI, OpenCode, Gemini, Cursor, Windsurf, Cline and 15+ others). Self-reported benchmark: ~54% less code, ~20% cheaper, ~27% faster than baseline, no drop in safety compliance — treat as vendor-reported until independently reproduced.Best forTeams whose coding agent over-engineers by default — reviewers tired of unrequested abstractions, premature helper functions, and needless dependencies.SMB fitOne skill, not a suite — the fastest thing to try in this catalog. Free MIT install (`/plugin install ponytail@ponytail` on Claude Code); requires Node.js on PATH for the hook system. ~122k★ in about 3 months from a June-2026 repo — the fastest-growing entry in this catalog by a wide margin; the usual star-count caution applies (see the harnesses catalog's notes on ECC and Hermes Agent).
REA (Reverse Engineer Anything)
morluto · MIT (third-party components keep their own licenses)
1 skill + 1 MCP server/CLI
CoversPoints your agent at the shipped artifact instead of the source. Native binaries: pseudocode, assembly, strings, symbols, calls and references via Hopper, Ghidra or IDA. JavaScript/Electron apps: modules, imports, source maps, IPC, with no native engine. Also .NET assemblies, Android APKs and devices, firmware, WASM, EVM bytecode, SQLite, HAR/pcap captures, websites through a Chrome-family browser, and process runs. Many targets need tools you supply yourself (JADX + JDK, adb, WABT, tshark, Binwalk/Unblob), and several are Linux-only. The README says results come with their evidence and limitations. The DISCLAIMER warns that decompilation and reconstruction may be incomplete or wrong.GovernanceThe README says analysis runs locally, but tool results still go to your agent's model provider. Static JavaScript and .NET inspection do not run the target. Runtime capture (process, LLDB, Electron, browser and native-UI scenarios) runs or drives the target with your user permissions. Those tools carry MCP destructiveHint annotations, but REA has no per-call approval of its own, so your client's confirmation settings are the gate. `npx rea-agents setup` shows a plan and needs approval before it writes anything. It registers the MCP server for the whole client (for Claude Code, mcpServers.rea in ~/.claude.json plus the skill in ~/.claude/skills), pins the version and keeps backups. Installing Hopper is a separate approval; on Linux it can install system packages via apt/dnf/pacman as root or pkexec. Ghidra and IDA must already be installed, and Hopper, IDA and JEB need your own licenses. SECURITY.md says the analysis bridges are not a sandbox. Target text in results is marked untrusted but is still a prompt-injection surface. Dual-use: only analyse software you own or are authorised to examine. The DISCLAIMER says the project will not help with DRM, license-check or anti-cheat circumvention.Best forSecurity researchers, interoperability and migration engineers, and agent builders who need to answer 'how does this shipped app do X?' for a binary, Electron app or website without source, and who want the underlying evidence so they can check the answer.SMB fitOne MCP server plus one skill, not a suite; setup can configure 24 agent clients (7 of them need rea-agents 6.5.0+). Free MIT install (`npx rea-agents setup`; Node.js 22.19+, 24.11+ or 26+). Static JavaScript/Electron and .NET need no native engine. Native binaries need Hopper (free demo with vendor limits), Ghidra or IDA. It changes fast, with 32 npm releases since 2026-07-12 from a single maintainer, so pin versions and re-run setup after updating. ~266k★ on 2026-10-15 from an April-2026 repo: ~215k of them came in the past week per GitHub trending, and the count was under ~1k until early October per star-history.com (approximate). The fork-to-star ratio is 25%, against 5.5-14.9% for the other repos on that day's trending page. On 2026-10-09 the owner account created 79 forks of third-party curated lists, renamed rea-*. npm downloads rose over the same days (231,579 in 6-12 Oct). The stargazer list could not be sampled, so treat the star count as unverified; the usual star-count caution applies with extra force (see the harnesses catalog's notes on ECC and Hermes Agent).
Skills vs harnesses. A harness (LangGraph, DeerFlow, the SDKs — see Agent harnesses) is the runtime that runs an agent loop. Skills are the portable know-how you drop into that runtime. You pick a harness once; you add skills continuously.