trl-training: An Agent Skill for LLM Post-Training and Alignment with TRL
trl-training is a workflow Skill in the Hugging Face Skills repository that guides an Agent to write or debug SFT, DPO, GRPO, KTO, and reward model training code using TRL (Transformers Reinforcement Learning), covering dataset formats, key points of SFTConfig/GRPOConfig, and the trl CLI. The article explains its division of responsibilities with huggingface-llm-trainer, how to install it using hf skills add, and how to use it reproducibly based on official examples, along with notes on GRPO, vLLM, and other related considerations.
Read Morehuggingface-local-models: Run Hugging Face GGUF Models Locally with Skill
huggingface-local-models is an Agent Skill in the Hugging Face skills repository that guides local model selection and inference on CPU, Metal, CUDA, or ROCm using llama.cpp and GGUF. The default workflow includes searching the Hub with apps=llama.cpp, reviewing quantization recommendations on the local-app page, confirming filenames via the tree API, and launching llama-cli or llama-server with the -hf option, using --hf-repo/--hf-file when needed or converting from Transformers. The article covers installation and enabling, key considerations for quantization selection, a smoke test for an OpenAI-compatible local service, and usage notes.
Read MoreHuggingFace ZeroGPU: Having Agents Write Gradio GPU Demos in Compliance with ZeroGPU Rules
huggingface-zerogpu is an Agent Skill in the Hugging Face skills repository, dedicated to building AI demos and GPU compute workloads with the Gradio SDK on Spaces ZeroGPU. It summarizes constraints such as @spaces.GPU, duration and quota pre-checks, large/xlarge specifications, CUDA monkey-patching and module-level loading, process isolation and concurrency, and disabling torch.compile, while pointing to references on concurrency, quota, and CUDA dependencies. The article explains the skill’s positioning, core capabilities, and installation methods (such as hf skills add and use in Codex, Cursor, or Claude Code), and provides official documentation and representative coding patterns for reference, helping developers reduce quota- and build-related pitfalls when using the free GPU tier.
Read MoreDeepSeek Harness Message Center Plugin: Managing DSH Inbound and Outbound Message Channels
`dsh-message-hub` is a transport-agnostic communication hub plugin for DeepSeek Harness (DSH). It uses a “channel registry” to decouple the specific protocol implementations of host plugins from message routing, and supports managing inbound and outbound messages through a Web API or built-in tools. The plugin provides `steer` and `followup` wake-up modes and includes a `file-spool` adapter to support file-system-based communication. It requires Node.js 22+, is installed via `dsh plugin`, and enables developers to manage multi-channel message interactions centrally using fixed tools or a Web interface.
Read Morehuggingface-best: Selecting Open-Source Models Based on Official Benchmarks and Hardware Constraints
huggingface-best is an Agent Skill in the Hugging Face skills repository, triggered when users ask which model to use for a task or need a benchmark-based comparison. It retrieves the `benchmark:official` dataset and leaderboard via the Hub API, enriches entries with parameter counts and licenses, filters device constraints based on an fp16/Q4 budget, outputs a Markdown comparison table with an “On device” column, and supports follow-up guidance for HF Jobs or local deployment. It is suitable for environments such as Cursor, Claude Code, Codex, and Gemini CLI, and requires the `hf` CLI and `~/.cache/huggingface/token`.
Read Moregke-golden-path: Default Configuration and Standard Path for GKE Production Clusters
gke-golden-path is an Agent Skill in Google's official google/skills repository (v1.1.0, Containers) that provides Autopilot golden path defaults, Day-0/Day-1 rules, and guardrails for designing GKE clusters, production readiness checks, and configuration audits. It covers Always-Apply items such as private nodes, Workload Identity, monitoring and logging, and PSS restricted, and outlines four recommendations for upgrade disruption: PDBs, replicas, probes, and Surge. Install it with npx skills add google/skills; for workload scaling, use gke-workload-scaling.
Read Moregemini-agents-api: Managing Stateful Gemini Enterprise Agents with REST
gemini-agents-api is an official Google Agent Skill targeting the control plane of the Managed Agents API in the Gemini Enterprise Agent Platform. It guides users in creating, configuring, querying, and managing stateful agent resources over REST. The article covers ADC authentication, v1beta1 endpoints, LRO creation and polling, GCS/Skill Registry mounting, built-in tool and MCP configuration, the `npx skills add` installation method, and the distinction between the control plane and the Interactions data plane.
Read Morevercel-react-native-skills: A Practical Guide to React Native and Expo for AI Programming
react-native-skills (vercel-react-native-skills) is an MIT-licensed open-source skill in vercel-labs/agent-skills that targets React Native and Expo. It organizes practices for list performance, Reanimated animations, native navigation, UI patterns, state management, and monorepos into rule files under the rules directory, with a summary in AGENTS.md. After installing it via npx skills add vercel-labs/agent-skills, agents can automatically reference it for mobile-related tasks, complementing the same repository's react-best-practices as the mobile counterpart to its Web guidance.
Read Morecloudflare-one-migrations: Assessing and Implementing Migration from Zscaler, Palo Alto, and Legacy VPN/SWG to Cloudflare One
cloudflare-one-migrations is an Agent Skill in Cloudflare's official skills repository, used to assess migration from Zscaler ZIA/ZPA, Palo Alto, and legacy VPN/SWG to Cloudflare One. It specifies first fetching documentation and API schemas, then building an inventory from structured exports, producing policy mappings and a rollout plan, and covering common ZIA/ZPA parity pitfalls. The article explains the seven-step workflow, installation methods (Cursor, Codex, Claude Code, etc.), and typical conversational usage.
Read Moreturnstile-spin: Building an End-to-End, Acceptance-Ready Agent Flow for Turnstile Integration
turnstile-spin is an Agent Skill maintained by Cloudflare in the cloudflare/skills repository for creating, repairing, or migrating Turnstile bot verification in existing front-end and back-end applications. Using authentication detection, widget creation scripts, and a multi-step wizard under the `scripts` directory, it scans the codebase, embeds the Turnstile widget according to Next.js, Astro, or SvelteKit references, integrates site verification into existing backends, and performs live validation before reporting success. It is suitable for scenarios such as registration and login forms or API abuse prevention; ensure the required API Token permission is `Account.Turnstile:Edit`, and be aware of Wrangler usage constraints and hostname validation for local and production environments.
Read MoreStatic Analysis: Chaining CodeQL, Semgrep, and SARIF into a Reusable SAST Workflow
The static-analysis plugin in the Trail of Bits skills marketplace combines deep CodeQL analysis, Semgrep rule-set scanning, and SARIF parsing into reusable Agent workflows. It includes three skills—codeql, semgrep, and sarif-parsing—along with the run-scans.sh and merge_sarif.py scripts and the /static-analysis:semgrep-scan and /static-analysis:codeql-build workflows. The article covers installation commands, typical invocation patterns, approval gates, differences from read-only scanning, and practical constraints such as ensuring database build quality and disabling metrics, to help systematically implement SAST in AI-assisted security audits.
Read MoreDeepSeek Harness Plugin: dsh-prompt-workbench
The DeepSeek Harness plugin `dsh-prompt-workbench` provides a prompt rewriting workbench designed to address the issue of agents deviating from intent due to ambiguous input. The tool runs locally in the browser, supports prompt analysis across six dimensions, including goals and context, and offers four rewriting modes, such as refining requirements and adding constraints. The plugin features streaming output, token-level diff comparison, structured suggestions, and dual-interface synchronization, enabling developers to transform ambiguous input into verifiable and executable structured prompts.
Read Moresupply-chain-risk-auditor: Measuring Dependency Supply Chain Risk with Scripts
supply-chain-risk-auditor is an Agent Skill in the Trail of Bits skills marketplace that generates supply-chain risk reports for npm, PyPI, and Go project manifests and lock files. Using collect.py and render.py, it gathers metrics such as version-matched advisories, transitive dependencies, upstream archives, npm publisher concentration, and install scripts, while the Agent handles prioritization and upgrade recommendations. The article explains installation, workflow, the effects of gh authentication, and applicable limitations, emphasizing how to interpret unassessable entries and coverage tables, and cautions against replacing script-based measurements with manual estimates.
Read MoreTesting Handbook Skills: Turning the Testing Handbook into an Executable AppSec Testing Workflow
testing-handbook-skills is a Code Auditing plugin in the Trail of Bits skills marketplace that structures the Testing Handbook on appsec.guide into a Skill usable by Claude Code or Codex. It includes the testing-handbook-generator meta-skill, 14 generated fuzzer, technology, and domain topics, and validation support via validate-skills.py. The article explains its positioning, generation workflow, installation commands for Claude Code and Codex, typical generation prompts, usage of uv-based validation, and considerations such as manual resolution of handbook paths, the absence of generated cross-references, and the need to provide the required tool environment yourself.
Read Moremutation-testing: Running a mewt/muton Mutation Testing Campaign with an Agent Skill
mutation-testing is a Verification-class skill in the Trail of Bits Skills marketplace, designed to help configure mewt or muton mutation-testing campaigns with AI assistance, analyze surviving mutants, and trace test gaps back to source-code issues. The skill routes workflows such as configuration acceleration, bug hunting, and result analysis/reporting based on the scenario, and defines the meanings of outcome statuses such as Uncaught and Timeout, along with common CLI usage. The article explains how to add the trailofbits/skills marketplace to Claude Code/Codex and covers typical commands such as init, run, results, and test, making it suitable for teams that already use or plan to use mutation testing.
Read Morerust-review: A Security Review Skill for Rust Codebases
rust-review is a Rust code security review Skill in the Trail of Bits skills marketplace. It uses an orchestrator with worker, dedup, and fp subagents to cover safe/unsafe boundaries, unsafe memory safety, concurrency, panic-DoS, FFI, and async runtime issues, producing REPORT.md and REPORT.sarif. It is suitable for auditing crates and services that include unsafe code, FFI, or concurrency; for scenarios such as pure C/C++, smart contracts, and key zeroing, use c-review, contract-specific Skills, or zeroize-audit instead. After adding the trailofbits/skills marketplace in Claude Code or Codex, start the review with /rust-review:rust-review.
Read MoreDeepSeek Harness (DSH) Plugin: fufu1437/dsh-model-commands
`fufu1437/dsh-model-commands` is a DeepSeek Harness (DSH) plugin that allows developers to declare shell commands from the settings page and convert them into model-recognizable skills. It does not execute commands; instead, it defines items such as a command's `--help` output as Markdown text for the model to read and invoke. The plugin is MIT licensed, requires DSH 0.2.1-rc.2+, and supports configuring the storage path and limiting the number of skills via YAML. After installation, skill content is read only when requested by the model. It features atomic writes, secure routing, and naming conflict warnings, aiming to simplify the skill definition process while ensuring safety and consistency.
Read Moreagentic-actions-auditor: Auditing Security Risks in AI Agent Integrations for GitHub Actions
agentic-actions-auditor is a Skill in the Trail of Bits skills marketplace for statically auditing GitHub Actions workflows that invoke Claude Code Action, OpenAI Codex, Gemini CLI, or GitHub AI Inference. It guides an Agent to discover workflows, identify AI steps, trace composite/reusable references, and detect vectors such as environment variable relay, expression injection, unsafe sandboxing, and wildcard user allowlists. It supports local Glob scanning and fetching remote repositories via the gh api. It is intended for security review before an Agent is integrated into CI, and does not perform runtime exploitation or automatic file modification.
Read Moreskill-improver: Polish SKILL.md to Publishable Quality with a Fix-Review Loop
skill-improver is a meta-skill in the Trail of Bits skills marketplace. It depends on skill-reviewer from plugin-dev and runs iterative review-and-repair cycles on a target SKILL.md, remediating issues by Critical, Major, or Minor severity and re-reviewing them until it emits skill-improvement-complete or reaches the default limit of 20 iterations. It is well suited to batch-aligning frontmatter, trigger descriptions, and When to Use structure; for a single review, use skill-reviewer directly. To install it, first add the trailofbits/skills marketplace and enable plugin-dev, then start the loop in Claude Code by running /skill-improver with the target path.
Read Moresecond-opinion: External Code Review of Git Changes with Codex or Antigravity
second-opinion is an Agent Skill in the Trail of Bits skills marketplace. It invokes Codex, Antigravity, or Gemini CLI to perform independent code reviews and consolidate findings for uncommitted changes, branch diffs, or specified commits, supporting side-by-side comparison of two providers on the same patch. It does not automatically modify code or post to a remote. The article explains the review scope and focus, diff and temporary-file conventions, CLI invocation methods, and marketplace installation commands and official slash-command examples for Claude Code and Codex.
Read Moretool-design: Designing Routable and Recoverable Tool Contracts for Agents
The **tool-design** skill from **Agent Skills for Context Engineering** focuses on the agent tool interface layer: it treats tools as contracts between deterministic systems and nondeterministic models, and guides tool descriptions and schemas, response formats, verb-noun naming and MCP fully qualified names, actionable error recovery, and pruning of overlapping tool sets based on consolidation principles. It is suitable for writing or debugging tool routing, consolidating tool catalogs, and designing MCP service boundaries; decisions such as project pipelines and sub-agent decomposition should be routed to other skills. The article is based on the official `SKILL.md` and covers enabling conditions, core principles, an audit checklist, and positive and negative examples, while explaining how it is loaded from a GitHub directory in `SKILL.md` format.
Read More@fufu1437/dsh-delete-chat: Thoroughly Clean Up DSH Sessions and Their Local Data
The DeepSeek Harness (DSH) plugin is used to permanently clean up sessions and their local data copies, including logs, caches, attachments, and more. It offers comprehensive data cleanup, runtime protection, secondary confirmation for idle sessions, attachment deduplication checks, and real-time UI synchronization. Before installation, ensure your DSH version is ≥ 0.2.1-rc.2 and install it via npm. To use the plugin, delete sessions through the sidebar menu; the system will apply safety interception based on session state.
Read MoreEvaluation Skill: Building a Reproducible Evaluation Framework for Agent Systems
evaluation, from Agent Skills for Context Engineering, guides designing a reproducible evaluation system for agent systems: outcome-oriented, weighted multi-dimensional rubrics, deterministic checks prioritized over LLM judgment, and coverage of test-set stratification, continuous evaluation, and production monitoring. The article explains when to enable it, how responsibilities are divided with skills such as advanced-evaluation, and directory-level installation methods in Cursor, Claude Code, and Codex, excerpting official pseudocode examples and common evaluation pitfalls.
Read Morecontext-fundamentals: Foundational Mental Models for Context Engineering
context-fundamentals is the foundational Skill in muratcankoylan's open-source collection, Agent Skills for Context Engineering. It uses SKILL.md to define the full composition of context during inference (system prompt, tool definitions, retrieved documents, message history, and tool outputs), and establishes mental models such as a finite attention budget and the U-shaped attention curve, emphasizing signal quality over token accumulation. The article explains when this Skill should be activated, its routing relationship with operational Skills such as context-degradation, and directory-level installation methods via the Claude Code plugin marketplace, Cursor, and Codex. It also provides an example of the official system prompt partitioning and a recommended reading order, making it suitable as introductory background reading for the context engineering series.
Read Moremulti-agent-patterns: Multi-Agent Collaboration Architectures and Context Isolation
multi-agent-patterns, from Agent-Skills-for-Context-Engineering, targets multi-agent system designs that require context isolation, supervisor or swarm coordination, explicit handoffs, and parallel execution. The skill emphasizes that sub-agents should primarily be used for context isolation rather than role-play, and summarizes three patterns—Supervisor/Orchestrator, Peer-to-Peer/Swarm, and Hierarchical—along with the tradeoffs involved in selecting among them. It covers the telephone-game problem and direct forwarding via forward_message, includes cautions about token consumption relative to single-agent designs, and clarifies boundaries with adjacent skills such as project-development and hosted-agents. It is suitable for developers making architecture decisions and running baseline evaluations in production-grade, multi-component agent systems.
Read More