mirror of
https://github.com/trailofbits/skills-curated
synced 2026-06-21 14:12:04 +00:00
Dan Guido
022fa09488
Sync with blader/humanizer v2.2.0. Adds anti-AI self-audit pass, enhanced personality/soul guidance, 9-step process, output format spec, and a comprehensive full example showing draft-to-final workflow. Fixes author attribution from Trail of Bits to blader. Fixes curly quote example to use actual Unicode characters. Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
295 lines
14 KiB
JSON
295 lines
14 KiB
JSON
{
|
|
"name": "skills-curated",
|
|
"owner": {
|
|
"name": "Trail of Bits",
|
|
"email": "opensource@trailofbits.com"
|
|
},
|
|
"metadata": {
|
|
"version": "1.0.0",
|
|
"description": "Curated, community-vetted Claude Code plugins reviewed for quality and safety"
|
|
},
|
|
"plugins": [
|
|
{
|
|
"name": "humanizer",
|
|
"version": "2.2.0",
|
|
"description": "Remove signs of AI-generated writing from text. Detects and fixes inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases.",
|
|
"author": {
|
|
"name": "blader",
|
|
"url": "https://github.com/blader/humanizer"
|
|
},
|
|
"source": "./plugins/humanizer"
|
|
},
|
|
{
|
|
"name": "skill-extractor",
|
|
"version": "1.0.0",
|
|
"description": "Extract reusable skills from work sessions. Manual invocation only - no hooks, no noise.",
|
|
"author": {
|
|
"name": "Trail of Bits",
|
|
"email": "opensource@trailofbits.com",
|
|
"url": "https://github.com/trailofbits"
|
|
},
|
|
"source": "./plugins/skill-extractor"
|
|
},
|
|
{
|
|
"name": "planning-with-files",
|
|
"version": "1.0.0",
|
|
"description": "File-based planning with persistent markdown files for complex multi-step tasks",
|
|
"author": {
|
|
"name": "OthmanAdi",
|
|
"url": "https://github.com/OthmanAdi"
|
|
},
|
|
"source": "./plugins/planning-with-files"
|
|
},
|
|
{
|
|
"name": "ffuf-web-fuzzing",
|
|
"version": "1.0.0",
|
|
"description": "Expert guidance for ffuf web fuzzing during authorized penetration testing, including authenticated fuzzing, auto-calibration, and result analysis",
|
|
"author": {
|
|
"name": "jthack",
|
|
"url": "https://github.com/jthack"
|
|
},
|
|
"source": "./plugins/ffuf-web-fuzzing"
|
|
},
|
|
{
|
|
"name": "wooyun-legacy",
|
|
"version": "1.0.0",
|
|
"description": "Web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016)",
|
|
"author": {
|
|
"name": "tanweai / wooyun-legacy contributors",
|
|
"url": "https://github.com/tanweai/wooyun-legacy"
|
|
},
|
|
"source": "./plugins/wooyun-legacy"
|
|
},
|
|
{
|
|
"name": "openai-cloudflare-deploy",
|
|
"version": "1.0.0",
|
|
"description": "Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-cloudflare-deploy"
|
|
},
|
|
{
|
|
"name": "openai-develop-web-game",
|
|
"version": "1.0.0",
|
|
"description": "Use when the agent is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with render_game_to_text. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-develop-web-game"
|
|
},
|
|
{
|
|
"name": "openai-doc",
|
|
"version": "1.0.0",
|
|
"description": "Use when the task involves reading, creating, or editing `.docx` documents, especially when formatting or layout fidelity matters; prefer `python-docx` plus the bundled `scripts/render_docx.py` for visual checks. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-doc"
|
|
},
|
|
{
|
|
"name": "openai-gh-address-comments",
|
|
"version": "1.0.0",
|
|
"description": "Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-gh-address-comments"
|
|
},
|
|
{
|
|
"name": "openai-gh-fix-ci",
|
|
"version": "1.0.0",
|
|
"description": "Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions; use `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example Buildkite) as out of scope and report only the details URL. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-gh-fix-ci"
|
|
},
|
|
{
|
|
"name": "openai-jupyter-notebook",
|
|
"version": "1.0.0",
|
|
"description": "Use when the user asks to create, scaffold, or edit Jupyter notebooks (`.ipynb`) for experiments, explorations, or tutorials; prefer the bundled templates and run the helper script `new_notebook.py` to generate a clean starting notebook. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-jupyter-notebook"
|
|
},
|
|
{
|
|
"name": "openai-netlify-deploy",
|
|
"version": "1.0.0",
|
|
"description": "Deploy web projects to Netlify using the Netlify CLI (`npx netlify`). Use when the user asks to deploy, host, publish, or link a site/repo on Netlify, including preview and production deploys. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-netlify-deploy"
|
|
},
|
|
{
|
|
"name": "openai-pdf",
|
|
"version": "1.0.0",
|
|
"description": "Use when tasks involve reading, creating, or reviewing PDF files where rendering and layout matter; prefer visual checks by rendering pages (Poppler) and use Python tools such as `reportlab`, `pdfplumber`, and `pypdf` for generation and extraction. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-pdf"
|
|
},
|
|
{
|
|
"name": "openai-playwright",
|
|
"version": "1.0.0",
|
|
"description": "Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-playwright"
|
|
},
|
|
{
|
|
"name": "openai-screenshot",
|
|
"version": "1.0.0",
|
|
"description": "Use when the user explicitly asks for a desktop or system screenshot (full screen, specific app or window, or a pixel region), or when tool-specific capture capabilities are unavailable and an OS-level capture is needed. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-screenshot"
|
|
},
|
|
{
|
|
"name": "openai-security-best-practices",
|
|
"version": "1.0.0",
|
|
"description": "Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-security-best-practices"
|
|
},
|
|
{
|
|
"name": "openai-security-ownership-map",
|
|
"version": "1.0.0",
|
|
"description": "Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-security-ownership-map"
|
|
},
|
|
{
|
|
"name": "openai-security-threat-model",
|
|
"version": "1.0.0",
|
|
"description": "Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-security-threat-model"
|
|
},
|
|
{
|
|
"name": "openai-sentry",
|
|
"version": "1.0.0",
|
|
"description": "Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-sentry"
|
|
},
|
|
{
|
|
"name": "openai-spreadsheet",
|
|
"version": "1.0.0",
|
|
"description": "Use when tasks involve creating, editing, analyzing, or formatting spreadsheets (`.xlsx`, `.csv`, `.tsv`) using Python (`openpyxl`, `pandas`), especially when formulas, references, and formatting need to be preserved and verified. Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-spreadsheet"
|
|
},
|
|
{
|
|
"name": "openai-yeet",
|
|
"version": "1.0.0",
|
|
"description": "Use only when the user explicitly asks to stage, commit, push, and open a GitHub pull request in one flow using the GitHub CLI (`gh`). Originally from OpenAI's curated skills catalog.",
|
|
"author": {
|
|
"name": "OpenAI",
|
|
"url": "https://github.com/openai/skills"
|
|
},
|
|
"source": "./plugins/openai-yeet"
|
|
},
|
|
{
|
|
"name": "ghidra-headless",
|
|
"version": "1.0.0",
|
|
"description": "Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.",
|
|
"author": {
|
|
"name": "Armin Ronacher",
|
|
"url": "https://github.com/mitsuhiko/agent-stuff"
|
|
},
|
|
"source": "./plugins/ghidra-headless"
|
|
},
|
|
{
|
|
"name": "last30days",
|
|
"version": "1.0.0",
|
|
"description": "Researches any topic from the last 30 days across Reddit, X, and the web, surfacing real community discussions with engagement metrics",
|
|
"author": {
|
|
"name": "mvanhorn",
|
|
"url": "https://github.com/mvanhorn/last30days-skill"
|
|
},
|
|
"source": "./plugins/last30days"
|
|
},
|
|
{
|
|
"name": "x-research",
|
|
"version": "1.0.0",
|
|
"description": "Searches X/Twitter for real-time perspectives, dev discussions, product feedback, breaking news, and expert opinions using the X API v2",
|
|
"author": {
|
|
"name": "rohunvora",
|
|
"url": "https://github.com/rohunvora/x-research-skill"
|
|
},
|
|
"source": "./plugins/x-research"
|
|
},
|
|
{
|
|
"name": "scv-scan",
|
|
"version": "1.0.0",
|
|
"description": "Audits Solidity codebases for smart contract vulnerabilities using a four-phase workflow covering 36 vulnerability classes.",
|
|
"author": {
|
|
"name": "kadenzipfel",
|
|
"url": "https://github.com/kadenzipfel/scv-scan"
|
|
},
|
|
"source": "./plugins/scv-scan"
|
|
},
|
|
{
|
|
"name": "react-pdf",
|
|
"version": "1.0.0",
|
|
"description": "Generates PDF documents using React-PDF library (@react-pdf/renderer) with flexbox layout, SVG graphics, custom fonts, and professional typesetting.",
|
|
"author": {
|
|
"name": "molefrog",
|
|
"url": "https://github.com/molefrog/skills"
|
|
},
|
|
"source": "./plugins/react-pdf"
|
|
},
|
|
{
|
|
"name": "python-code-simplifier",
|
|
"version": "1.0.0",
|
|
"description": "Simplifies and refines Python code for clarity, consistency, and maintainability while preserving all functionality.",
|
|
"author": {
|
|
"name": "Anthropic",
|
|
"url": "https://github.com/anthropics/claude-plugins-official"
|
|
},
|
|
"source": "./plugins/python-code-simplifier"
|
|
},
|
|
{
|
|
"name": "security-awareness",
|
|
"version": "1.0.0",
|
|
"description": "Teaches agents to recognize and avoid security threats during normal activity. Covers phishing detection, credential protection, domain verification, and social engineering defense.",
|
|
"author": {
|
|
"name": "1Password",
|
|
"url": "https://github.com/1Password/SCAM"
|
|
},
|
|
"source": "./plugins/security-awareness"
|
|
}
|
|
]
|
|
}
|