skill-of-skillsBLOCK
The quality-ranked discovery engine for AI coding skills, plugins and MCP servers across Claude Code, Codex, Cursor, Windsurf, Cline and more.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The quality-ranked directory for AI coding skills — scored across Claude Code, Cursor, Codex, Windsurf, Cline & more. Ranked by structural quality, reputation, and proven adoption — not raw popularity.
[](https://skills.911fund.io) [](https://skills.911fund.io/tools?sort=quality) [](https://skills.911fund.io/analytics)
1,400+ skills across 10 skill types · 420+ at the Curated tier (⭐ quality ≥120) · indexed repos total 19,000,000+ ⭐. Intake items awaiting classification are included in the skills total but excluded from the skill-type breakdown.
(counts as of 2026-10-14 03:25 UTC; the badges above are live)
🌐 [Browse the Directory](https://skills.911fund.io) · 📖 [Guides](https://skills.911fund.io/guides) · 🧭 [Collections](https://skills.911fund.io/collections) · 📊 [Analytics](https://skills.911fund.io/analytics)
🤖 Agent-native: connect via MCP — claude mcp add --transport http skill-of-skills https://skills.911fund.io/api/mcp (quality-ranked search, profiles, risk assessments, demand pulse; scores are evidence, not endorsements). Docs: llms.txt
Contents
- 🏆 Best of the Best
- 🔥 Trending Now
- Latest
- Library & API Reference
- Product Verification
- Data Fetching & Analysis
- [Business Process & Team Automation](#-business-
b293d8aba753OBSERVED · 2026-10-14Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| claude-desktop | mentioned | |
| codex | mentioned | |
| copilot | mentioned | |
| cursor | mentioned | |
| gemini-cli | mentioned | |
| openclaw | mentioned | |
| windsurf | mentioned |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (5 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (16)
- 🧠 ⭐ **[AI-Infra-Guard](https://github.com/Tencent/AI-Infra-Guard)** 🤖🧠 R:🔴 M:🟢 — A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and
- 📄 🔷 **[mcp-server-12306](https://github.com/drfccv/mcp-server-12306)** 🔧 R:🟢 M:🟢 — 12306 MCP Server 是一个基于 Model Context Protocol (MCP) 的高性能火车票查询后端系统。它通过标准化接口提供官方 12306 的实时数据服务,包括余票查询、车站信息、列车经停站、中转换乘
callback_url:
CALLBACK_URL: ${{ inputs.callback_url }}CALLBACK_URL: ${{ inputs.callback_url }}Now: schedule (every 3h at :25) → POST `readme/regenerate` with secret → Discord.
- Workflow 05 nodes (AI Categorize, Quality Score) send `x-webhook-secret` header
- 🔌 ⭐ **[cli-printing-press](https://github.com/mvanhorn/cli-printing-press)** 🤖🧠 R:🟡 M:🟢 — Every API has a secret identity. This finds it, absorbs every feature from every competing tool, then builds
- 📚 🔷 **[ghostwright/phantom](https://github.com/ghostwright/phantom)** 🤖 R:⚫ M:🟠 — An AI co-worker with its own computer. Self-evolving, persistent memory, MCP server, secure credential collection, e
- 📚 🔷 **[use-novamira/novamira](https://github.com/use-novamira/novamira)** 🤖🧠 R:⚫ M:🟢 — MCP server that gives AI agents full access to WordPress through PHP execution and filesystem operations by use
- **AI Risk Assessment**: New tools are analyzed by Claude Haiku for risk signals (shell access, subagents, credential handling)
- 📚 🔷 **[onecli/onecli](https://github.com/onecli/onecli)** 🔧 R:🟡 M:🟢 — Open-source credential gateway with a built-in vault. give your AI agents access to services without exposing keys. by onecli *(
- 🔄 🔷 **[sigcli](https://github.com/sigcli/sigcli)** 🤖 R:🔴 M:🟢 — The authentication CLI & Proxy for AI agents. Give agents access, not your credentials. by sigcli *(292 ⭐)*
- 🔄 🔷 **[Claude-OSINT](https://github.com/elementalsouls/Claude-OSINT)** 🤖 R:🟡 M:🟢 — 8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validator
| **High** | Broad system access, credential handling, or dynamic code evaluation |
Gates applied: instruction_override, no_behavioural_pass.
b293d8aba753full audit observations/trust-audit/skill/the911fund__skill-of-skills.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | b293d8aba753 | BLOCK | D | 69 | first audit |
Questions
What does the skill-of-skills skill do?
The quality-ranked discovery engine for AI coding skills, plugins and MCP servers across Claude Code, Codex, Cursor, Windsurf, Cline and more.
Is skill-of-skills safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can skill-of-skills access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does skill-of-skills work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot, cursor, gemini-cli, openclaw and windsurf. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (b293d8aba753), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.