Find the open-source solution that fits.

pentest-report normalizes existing penetration-test findings or scanner output into German or English reports and checks them against a selected BSI, OWASP, PCI-DSS, DiGA, or OSCP profile. It can detect missing fields, enrich findings with CVSS, CWE, OWASP, and MITRE references, deduplicate hosts, and render Markdown, PDF, or SysReptor JSON. It does not scan or exploit systems and does not certify compliance.

pull-context helps a Claude Code session import context from another session on demand. It searches candidates by topic, age, and message count, lets you choose a source other than the current session, and distills the long transcript into goals, decisions, pointers, and open questions. A verbatim tail can be pulled when exact wording matters. It relies on Claude’s local transcript layout, which is undocumented and may change.

strong-ads-google-skill is for Google Search/RSA and Performance Max, not Meta or Instagram. It studies the business, competitor ads, and real buyer frustrations before producing angle-based headlines, long headlines, and descriptions that fit Google’s character limits. Pain points are tied to sources, and the output is organized for Google Ads Editor rather than padded with generic marketing language.

open-campsite-watcher polls recreation.gov for the campground and nights you choose, compares each response with saved state, and sends a Telegram alert when a new cancellation appears. The alert includes a one-tap Add to Cart link, while expiry dates, repeat limits, and trips crossing months are handled for you. It runs as a zero-dependency Python watcher on macOS or Linux; booking remains a manual step.

report-writing is a reusable method library for formal DOCX reports, especially Traditional Chinese government and tender deliverables in Taiwan. It covers requirements, content strategy, layout, equations, clickable cross-references, page-numbered tables of contents, figures, and delivery checks, with linters for wording and English AI tells. The skill works with Claude Code and Codex and focuses on verified document output.

hom turns Andrew Grove’s High Output Management into a working advisor for real management problems. It diagnoses the underlying lever or bottleneck, then applies the relevant mechanics for delegation, one-on-ones, OKRs, decisions, organization design, motivation, or training. Responses are bilingual and grounded in the book’s terminology, with the emphasis on a concrete situation rather than a generic summary.

gtd operates Getting Things Done on your actual work instead of explaining the method. Give it a brain-dump, inbox, or vague task and it returns concrete next actions, projects with outcomes, waiting-for and calendar items, plus a short list of tasks that take under two minutes. It can also run weekly reviews and system audits, with every next action expressed as one visible physical step.

bbyt applies Dan Martell’s Buy Back Your Time to a real workload. It calculates the Buyback Rate, sorts tasks through the DRIP audit, returns a prioritized offload list, and identifies the next hire on the Replacement Ladder. Other modes transfer a task into a Definition of Done and playbook, build an energy-matched Perfect Week, plan the year, or diagnose recurring time traps.

phinq-governance adds a procedural memory layer that an autonomous agent is expected to consult before taking a structurally significant action. It classifies reversible and irreversible work, checks the action against rule documents such as SOUL.md or AGENTS.md, pauses for confirmation when risk is high, and records events in an append-only tamper-evident log. It covers deletions, bulk operations, external communications, credential access, and payment changes, but it is an advisory protocol rather than a runtime interceptor or sandbox.

UI/UX Consultant Skill gives Claude a multi-framework design reference for interface requests. It covers 16 frameworks with opinionated code patterns, accessibility checklists, 23 visual styles, 35 color palettes, 31 font pairings, and layout guidance for 41 product types. It can be initialized for Claude Code or Cursor and is intended for design direction plus implementation patterns rather than a visual editor.

Experience Skill searches Xiaohongshu, Doubao, Baidu, Zhihu, and Douyin for travel tips, tutorials, product advice, and everyday experience, then deduplicates and compares the results into a structured report. Each point carries a source so you can see where advice converges or comes from a single platform. It relies on browser automation, with the Xiaohongshu connector optional.

Colorway C packages the Code Meet AI and Malik Chohra brand as an agent-ready design system. It defines a dark-first editorial surface, one muted-teal accent, hairline structure, cursor motion, three Google fonts, and matching voice and token rules. Use the accompanying skill or read the ordered briefs to produce on-brand interfaces without repeating the art direction each time.

client-secret-exposure audits web, mobile, and backend projects for secrets exposed in client bundles, insecure storage, broken access control, XSS, weak authentication, sensitive logs, dependency issues, headers, rate limits, business-logic flaws, and CI secrets. It is useful for Next.js and other app stacks, but the checks only identify findings; developers still need to remediate and retest the application.

webapp-last-90 detects a web app’s stack, scores an 11-dimension readiness baseline, and gates launch on ten binary blockers such as real auth, tenant isolation, rate limits, legal pages, production monitoring, CI/CD, health checks, and a rehearsed backup restore. It separates autonomous work from items needing account access or a decision, then returns SHIP-SAFE or NOT-YET with evidence.

SuperICP turns a vague “we sell to everyone” position into a focused Ideal Customer Profile through a short, structured interview. It forces facts, guesses, buying context, and disqualifiers into the open, then returns an operational profile, lead scorecard, and validation plan for sales, advertising, and copy. It runs in any prompt-capable agent with no install or API key, across B2B, B2C, creator, and nonprofit contexts.

short-form-video-script-writer generates a topic and angle, calibrates the presenter’s voice, selects one of six frameworks, and builds hooks, a 5–7 second re-hook, open-loop body copy, and a CTA. Its default is one 45–60 second script adapted across TikTok, Instagram Reels, and YouTube Shorts, followed by a ten-point revision checklist and an optional performance-feedback loop.

bg-janitor targets macOS leftovers after AI tools close: orphaned children, sandbox-protected processes, port-holding gateways, and KeepAlive LaunchAgents. Its playbook distinguishes unsandboxed signal delivery, safe multi-PID handling in zsh, and launchctl unload -w for agents that immediately return after kill. Because the commands can terminate processes or disable startup services, confirm the target before applying them.

meta-skills is a collection of 17 standalone process skills for Claude, including rubber-duck questioning, steelmanning, pre-mortems, first-principles analysis, red-teaming, scope cutting, context budgeting, distillation, handoffs, and teach-back. Each skill is designed to challenge assumptions or verify work before trust. Install the collection globally, per project, or copy a single folder when you need only one method.