复制安装命令
用 Codex 或 Claude 安装复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它先审查 Skill 页面再帮你安装。
复制前请先查看来源、License 和安全提示。
A model-agnostic agent-skills platform.
用 Codex 或 Claude 安装复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它先审查 Skill 页面再帮你安装。
复制前请先查看来源、License 和安全提示。
来源文件:README.md
A model-agnostic agent-skills platform. The canonical layer is harness-free by construction; Claude Code is currently the verified-native harness. Other harnesses remain engineering candidates until their native-path integration is verified; source research alone is never presented as public support.
Version semantics: the release badge is this marketplace's display version. npm packages, including the
ccpiCLI and publishable plugins, retain their own package versions; they are intentionally not expected to equal the display version. The version-surface checker governs the display surfaces without rewriting package semver.
Inside Claude Code, one command installs the whole marketplace:
/plugin marketplace add jeremylongshore/claude-code-plugins
Or use the CLI:
pnpm add -g @intentsolutionsio/ccpi
ccpi install devops-automation-pack
Browse the marketplace · Explore plugins · Download bundles
Killer Skill of the Week — no-ai-slop by Peter Yang
Strip AI slop from any draft — named-pattern edits that keep the writer's real voice
no-ai-slop does two jobs and refuses to fake a third. In Edit mode it makes the minimum effective edit — cutting throat-clearing, weak verbs, and abstract nouns while deliberately preserving the writer's cadence, bluntness, humor, and honest admissions, so a rough draft still sounds like the same person afterward. In Detect mode it names each AI-slop pattern it finds, quotes the offending line, and gives the fix in a few words — and pointedly does NOT score the draft or guess whether an AI wrote it. That restraint is the whole point: AI detectors guess; named patterns are evidence the reader can check. MIT-licensed, single focused skill, actively maintained by Peter Yang.
"AI detectors guess. Named patterns are evidence the user can check." — Peter Yang
Grade: A | Week of July 22, 2026 (W30) | View on GitHub
Previous picks: tonone, mnemos, databricks-pack, kobiton-automate, skyvern, code-cleanup, web-analytics, token-optimizer, executive-assistant-skills, skill-creator, cursor-pack, crypto-portfolio-tracker. See all at tonsofskills.com.
Every number below names the cohort it counts and the command that reproduces it — an unlabeled count is how a corpus ends up with five contradictory answers to "how many skills."
| Count | Cohort | Reproduce with |
|---|---|---|
| 442 | catalog plugins (catalog-entry cohort) | node scripts/generate-readme-toc.mjs over marketplace.extended.json |
| 3,067 | marketplace-visible skills (distinct) | node -e "import('./scripts/corpus-resolver.mjs').then(m=>console.log(m.resolveCorpus('marketplace-visible').length))" |
| 347 | agent definitions in plugins | git ls-files 'plugins/**' | grep '/agents/.*\.md' |
| 19 | plugin categories | ls -d plugins/*/ |
Across 396 published packages in the claude-code-plugins namespace. Updated daily by GitHub Actions.
| Window | All packages | Established (>30d) |
|---|---|---|
| Last 24 hours | 962 | 962 |
| Last 7 days | 2,920 | 2,916 |
| Last 30 days | 12,868 | 12,779 |
"Established" excludes packages first published within the last 30 days, so a bulk-publish event doesn't dominate the headline.
Top 10 by last 30 days:
Last refreshed 2026-08-19T03:03:05.709Z.
Five real questions, five doors — each resolves to a live, generated surface, never a hand-maintained list:
The 19 categories below link into the live marketplace. Plugin counts are the catalog-entry cohort — regenerated from marketplace.extended.json by this generator; the catalog itself lives on tonsofskills.com, never in this file (§ 6A of the platform blueprint).
| Category | Plugins | |
|---|---|---|
| 🤖 | AI & Machine Learning | 36 |
| 🎭 | AI Agents & Agency | 10 |
| 🔌 | API Development | 26 |
| 💼 | Business Tools | 6 |
| 👥 | Community | 21 |
| ₿ | Crypto & Web3 | 27 |
| 💾 | Database | 26 |
| 🎨 | Design | 2 |
| 🔧 | DevOps & Infrastructure | 36 |
| 📚 | Examples & Templates | 5 |
| 🧩 | MCP Servers | 16 |
| 📦 | Packages | 5 |
| ⚡ | Performance | 25 |
| ✅ | Productivity | 30 |
| 🎁 | SaaS Skill Packs | 106 |
| 🔐 | Security | 27 |
| ✨ | Skill Enhancers | 9 |
| 🧪 | Testing | 28 |
| 📁 | Analytics | 1 |
Four artifact classes live in this repository, distinguished on sight and never blurred — provenance is a truth requirement here, not a UX nicety:
| Class | What it is | How the reader can tell |
|---|---|---|
| Canonical skill | First-party, harness-free, the source of truth | No .source.json in its plugin directory |
| Generated adapter | A thin, machine-produced harness projection | Lives under a generated path with a "generated — do not edit" header |
| First-party package | An Intent Solutions distribution (npm, cowork zip) | @intentsolutionsio scope, IS-authored license |
| Upstream mirror | Somebody else's work, hosted mirror-by-default | .source.json present — upstream author, license, and pinned commit recorded |
Not yet certified. The certification program (tiers T0–T4 with retained, hash-matched evidence) is a later epic of the platform blueprint; until its report exists, no artifact on this surface claims a tier. This line is rendered from the absence of certification-report.json — honestly, not cosmetically.
Start with the contribution guide, then the intake and review standards every submission passes through:
External plugins are hosted mirror-by-default: the contributor's repository stays the source of truth, every mirrored source is pinned in a content lockfile, and upstream credit — author, license, resolved commit — is recorded in the mirror itself. Improvements flow by upstreaming to the author's repository, never by silently editing the mirror. The full decision record is the external-sync model.
MIT for the repository scaffolding and first-party tooling; each plugin carries its own license in its manifest, and mirrored plugins keep their upstream license verbatim.
name: auditing-access-control
description: Audit access control implementations for security vulnerabilities and
misconfigurations. Use when reviewing authentication and authorization. Trigger
with 'audit access control', 'check permissions', or 'validate authorization'.
version: 1.24.0
allowed-tools: Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)
license: MIT
author: Jeremy Longshore <jeremy@intentsolutions.io>
tags:
- security
- authentication
- audit
compatibility: Designed for Claude CodeAudit access control implementations across codebases, cloud configurations, and application layers for security vulnerabilities and policy violations. This skill targets IAM policies, ACLs, RBAC configurations, file permissions, and API authorization logic to identify privilege escalation paths, overly permissive grants, and violations of the principle of least privilege.
${CLAUDE_SKILL_DIR}/grep, find, and standard shell utilities available via Bashaws iam, gcloud, or az role installed and authenticated${CLAUDE_SKILL_DIR}/references/README.md for IAM best practices, ACL vulnerability patterns, and NIST/GDPR access control standards.htaccess or equivalent files using Glob and Grep.*), overly broad resource scopes, or administrative access granted to non-admin roles.| Error | Cause | Solution |
|---|---|---|
| Permission denied reading config files | Insufficient filesystem access | Run with elevated permissions or request read access to the target directory |
| IAM CLI command not found | Cloud CLI tools not installed | Install aws-cli, gcloud, or az and authenticate before running cloud audits |
| Empty role/permission scan results | Incorrect glob patterns for the framework | Adjust search patterns to match the target framework (e.g., @Roles() for NestJS, [Authorize] for .NET) |
| Timeout scanning large codebases | Too many files in scope | Narrow the scan scope with --exclude patterns for node_modules, vendor, or dist directories |
| Inconsistent policy format | Mixed IAM policy versions or formats | Normalize policies to a single format before analysis; flag format inconsistencies in the report |
Scan route definitions in ${CLAUDE_SKILL_DIR}/src/routes/ for missing authorization
middleware. Grep for router.post, router.put, router.delete and verify
each has a corresponding authMiddleware or requireRole() call. Flag any
state-changing endpoint lacking authorization as CWE-862 (Missing Authorization),
severity high.
Parse all JSON policy files in ${CLAUDE_SKILL_DIR}/infra/iam/. Flag policies containing
"Effect": "Allow" with "Resource": "*" or "Action": "*" as CWE-269
(Improper Privilege Management), severity critical. Recommend scoping to specific
ARNs and actions per the principle of least privilege.
Analyze role definitions in ${CLAUDE_SKILL_DIR}/config/roles.yaml. Build a permission
matrix, identify roles with overlapping admin-level privileges, and flag any role
that can both create and approve its own resources as a separation-of-duties
violation (NIST AC-5), severity medium.
评论 (0)
暂无评论,成为第一个评论者吧!