Thomashighbaugh/find-skills
skills/find-skills/SKILL.md
Discover, vet, and install agent skills by searching across every major skill registry (skills.sh, clawhub.ai, GitHub) simultaneously, presenting top results with security scanning. Use when setting up a project (/init-project), when the user asks "how do I do X", "find a skill for X", or when you need to extend agent capabilities. Searches all major registries at once instead of trusting a single site's rankings.
$ install --global
skillsauthnpx skillsauth add Thomashighbaugh/opencode find-skillsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 27, 2026, 3:09 AM271.5s1 file scanned
SKILL.md
- name:
- find-skills
- description:
- Discover, vet, and install agent skills by searching across every major skill registry (skills.sh, clawhub.ai, GitHub) simultaneously, presenting top results with security scanning. Use when setting up a project (/init-project), when the user asks "how do I do X", "find a skill for X", or when you need to extend agent capabilities. Searches all major registries at once instead of trusting a single site's rankings.
Find Skills
Find the right agent skill for a task by searching every major registry at once and presenting each board on its own native metric.
When to Use
- Setting up a project (
/init-project setupor/init-project refresh) - The user asks "how do I do X" and X is a common task that likely has a published skill
- "find a skill for X" / "is there a skill for X" / "what should I install for X"
- You need to extend agent capabilities (testing, design, deployment, domain workflow)
- You're about to build something from scratch that a battle-tested skill might already cover
Multi-Source Search Strategy
Each registry shows only its own slice, with different signals:
| Registry | Search Method | Signal | Blind Spot |
|----------|--------------|--------|------------|
| skills.sh | GET /api/search?q= | lifetime installs | no stars, install count lags ~2.5h |
| GitHub topics | gh search repos --topic claude-skills --topic agent-skills --topic claude-code-skills | repo stars, description | repo-level, not skill-level |
| skills.sh API | Fetch and rank by installs | cross-registry validation | smaller/newer registries |
Always run 2-3 adjacent-term searches before concluding. A single search misses great skills filed under sibling terms. For example, searching "ui ux design" tops at 19k, but "frontend design" surfaces a 443k install skill — completely invisible to the first query.
How to Choose the Right Skill
Step 1 — Read before you judge. Never recommend from metadata alone. Open the actual SKILL.md of the top 2-3 candidates.
Step 2 — Weigh signals in this order:
- Fit — Does the skill's documented behavior match the real need?
- Popularity as social proof — Higher installs/stars means more validation
- Depth & maintenance — Real examples, clear scope, recent updates
- Safety — Check for risky patterns (curl-pipe-install, eval-remote, broad tool grants)
Step 3 — Deliver a verdict, not a menu:
- One primary recommendation with why
- 1-2 alternatives framed by need
- Only say "nothing fits" when you've read the top candidates and they genuinely don't
Installation
npx skills add <owner>/<repo> --skill <slug> -g
Integration with /init-project
This skill is used by /init-project setup and /init-project refresh to:
- Search for skills relevant to the detected project stack (React, Next.js, Python, etc.)
- Present findings for user selection
- Install selected skills at the project scope
Security & Privacy
- Issues read-only HTTP GETs to public APIs
- Requires no API keys or tokens
- Never auto-installs anything — always user-confirmed
- Security scan is a heuristic — a clean badge is not a security audit
Related Skills
Thomashighbaugh/tool-creator
tools
VerifiedTrustedCommunity
Create valid, type-safe TypeScript tools for OpenCode — generates correct boilerplate, typed interfaces, and handler stubs. Use when building new tools for global config or per-project .opencode/tools/.
1SKILL.mdUpdated Jul 5, 2026
Thomashighbaugh/tree-of-thoughts
testing
VerifiedTrustedCommunity
Explore multiple solution branches in parallel, evaluate each, and recommend the best path. Use when the user explicitly invokes /ideation tree-of-thoughts or asks for "tree of thought" / "branching exploration".
1SKILL.mdUpdated Jul 1, 2026
Thomashighbaugh/self-consistency
testing
VerifiedTrustedCommunity
Run multiple independent reasoning passes and find consensus. Use when the decision is critically important, the stakes are high, or the user explicitly requests "run it multiple times" / "check consistency" / "self-consistency".
1SKILL.mdUpdated Jul 1, 2026
Thomashighbaugh/opro
testing
VerifiedTrustedCommunity
Optimization by PROmpting — generate candidate prompt variations, test each against a benchmark, and report the best performer. Use when the user invokes /ideation opro or asks for "prompt optimization" / "OPRO".
1SKILL.mdUpdated Jul 1, 2026