Find the best CLAUDE.md, AGENTS.md and Claude skills

OpenAISkill

cloudflare

openai/plugins/plugins/cloudflare/skills/cloudflare/SKILL.md

Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.

Often used withnextjs-on-cloudflare·basin·cloudflare-email-service

OpenAISkill

durable-objects

openai/plugins/plugins/cloudflare/skills/durable-objects/SKILL.md

Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.

Often used withnextjs-on-cloudflare·basin·sandbox-stable

OpenAISkill

web-perf

openai/plugins/plugins/cloudflare/skills/web-perf/SKILL.md

Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (FCP, LCP, TBT, CLS, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed. Biases towards retrieval from current documentation over pre-trained knowledge.

Often used withnextjs-on-cloudflare·basin·sandbox-stable

OpenAIPipes a download into a shellSkill

code-review

openai/plugins/plugins/coderabbit/skills/coderabbit-review/SKILL.md

Reviews code changes using CodeRabbit AI. Use when user asks for code review, PR feedback, code quality checks, security issues, or requests fix-review cycles.

Often used withclose-spec·add-new-model·compare-screenshots

OpenAISkill

assess-patch-risk

openai/plugins/plugins/codex-security/skills/assess-patch-risk/SKILL.md

Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.

OpenAISkill

attack-path-analysis

openai/plugins/plugins/codex-security/skills/attack-path-analysis/SKILL.md

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

deep-security-scan

openai/plugins/plugins/codex-security/skills/deep-security-scan/SKILL.md

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

OpenAISkill

define-security-policy

openai/plugins/plugins/codex-security/skills/define-security-policy/SKILL.md

Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

OpenAISkill

finding-discovery

openai/plugins/plugins/codex-security/skills/finding-discovery/SKILL.md

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

fix-finding

openai/plugins/plugins/codex-security/skills/fix-finding/SKILL.md

Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.

OpenAISkill

propose-security-hardening

openai/plugins/plugins/codex-security/skills/propose-security-hardening/SKILL.md

Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

OpenAISkill

security-diff-scan

openai/plugins/plugins/codex-security/skills/security-diff-scan/SKILL.md

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

OpenAISkill

security-scan

openai/plugins/plugins/codex-security/skills/security-scan/SKILL.md

Use for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR, commit, branch, or working-tree diffs, or for deep, multi-pass scans.

Often used withdjango-security·deployment-patterns·postgres-patterns

OpenAISkill

threat-model

openai/plugins/plugins/codex-security/skills/threat-model/SKILL.md

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Often used withvuln-scan·adr·prd

OpenAISkill

track-findings

openai/plugins/plugins/codex-security/skills/track-findings/SKILL.md

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.

OpenAISkill

triage-finding

openai/plugins/plugins/codex-security/skills/triage-finding/SKILL.md

Triage supplied or imported security findings against a repository using its security policy and static code evidence. Accepts scanner reports, advisories, GitHub findings, and Jira or Linear tickets. Do not use for discovery, duplicate triage, runtime validation, or fixes.

OpenAISkill

validation

openai/plugins/plugins/codex-security/skills/validation/SKILL.md

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

OpenAISkill

verify-fix

openai/plugins/plugins/codex-security/skills/verify-fix/SKILL.md

Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.

OpenAISkill

vulnerability-writeup

openai/plugins/plugins/codex-security/skills/vulnerability-writeup/SKILL.md

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

OpenAISkill

intake

openai/plugins/plugins/creative-production/skills/intake/SKILL.md

Use when Creative Production is explicitly invoked or mentioned without a concrete request, when the user asks what Creative Production can do, or when the user wants help getting started without enough context to choose a workflow.