Skills DirectorySkills Directory
SkillsLearnSecurityCategoriesDocsBlogPro
Sign InSubmit Skill
Skills Directory

Security-tested agent skills for Claude, coding agents, and AI workflows.

Directory

  • Browse Skills
  • All Skills A–Z
  • Claude Skills
  • Claude Code Skills
  • Agent Skills
  • Categories
  • Authors
  • Submit a Skill

Learn

  • Learn Hub
  • Install Claude Skills
  • Write SKILL.md
  • Skills vs MCP
  • Directories Compared

Security

  • Security
  • Methodology
  • Secure Claude Skills
  • Security Badges
  • Chrome Extension
  • Skill Manager

Company

  • About
  • Community
  • Blog
  • API Docs
  • Advertise

2026 Skills Directory. All rights reserved.

ProTermsPrivacyRefunds
Back to skills

List Skills

ASecurity

Print a human-readable index of every skill installed for this repository, grouped by the family each one declares, with the name to invoke it by and the first sentence of its `description`. Discovery is installation-aware: it covers a pinned snapshot install, the framework checkout, and marketplace plugin installs, so the index matches what the agent can actually run. Generated on every run from live `SKILL.md` frontmatter, so it never goes stale when skills are added, removed, or rewritten.

108 stars
0 votes
0 copies
0 views
Added 9/24/2026
securitypythongobashgit

Security Analysis

A100/100

Pro scans all 3 files and shows the line behind each finding

Scanned 10/6/2026

$npx -y skills add apache/magpie --skill list-skills --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of List Skills?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for List Skills
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/apache-list-skills/badge)](https://www.skillsdirectory.com/skills/apache-list-skills)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
Files
SKILL.md
---
# SPDX-License-Identifier: Apache-2.0
# https://www.apache.org/licenses/LICENSE-2.0
name: list-skills
family: utilities
mode: Meta
description: |
  Print a human-readable index of every skill installed for this
  repository, grouped by the family each one declares, with the
  name to invoke it by and the first sentence of its
  `description`. Discovery is installation-aware: it covers a
  pinned snapshot install, the framework checkout, and
  marketplace plugin installs, so the index matches what the
  agent can actually run. Generated on every run from live
  `SKILL.md` frontmatter, so it never goes stale when skills are
  added, removed, or rewritten.
when_to_use: |
  Invoke when a human asks *"what skills are available"*, *"list
  the skills"*, *"show me the skills in this repo"*, *"give me a
  table of contents for the skills"*, or invokes it under
  whichever name their install method uses.
  Skill names differ on this install:
  `/magpie-utilities:list-skills` on a marketplace family-plugin
  install, `/magpie-list-skills` on the pinned snapshot.
  This is a help-style overview for humans onboarding to the
  repository — agents route via the live frontmatter
  `description` field directly and do not need this index to
  choose a skill.
capability: capability:stats
surface_hash: sha256:5b9c9751b398f81b
license: Apache-2.0
measured_tokens: 2413
---

<!-- SPDX-License-Identifier: Apache-2.0
     https://www.apache.org/licenses/LICENSE-2.0 -->

<!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
     <project-config> → adopting project's `.apache-magpie/` directory
     <tracker>        → value of `tracker_repo:` in <project-config>/project.md
     <upstream>       → value of `upstream_repo:` in <project-config>/project.md
     <framework>      → `.apache-magpie/apache-magpie` in adopters; `.` in
                        the framework standalone -->

# list-skills

<!-- BEGIN MAGPIE PREFLIGHT — generated from tools/dev/preflight-block.md -->

## Pre-flight — is this project set up?

Do this **first, before anything else in this skill**, and do it silently.
One command answers it and carries its own rules; there is nothing else to
read.

Run the checker with this skill's own frontmatter `name:` and
`surface_hash:`, and one `--requires` for each `requires_config:` entry:

```bash
PYTHONPATH=".apache-magpie-local:$(git rev-parse --git-common-dir)/../.apache-magpie-local:$(git rev-parse --git-common-dir)/apache-magpie" \
  python3 -m setup_preflight --skill <name> --hash <surface_hash> [--requires <file>]...
```

The path finds the checker `/magpie-setup config` installed in the
personal layer: this checkout's `.apache-magpie-local/`, the main
checkout's when this is a linked worktree, or the git directory's
`apache-magpie/` when Magpie is only installed.

- **`{"verdict": "ok"}`** → **silent**. Continue into the work the user
  asked for and say nothing about pre-flight. This is the ordinary answer.
- **`{"verdict": "action", ...}`** → each finding names a section, and
  `rules` carries that section's text. Follow it. The `facts` are the
  inputs; what to propose, and what may not be done, are in the rules
  rather than here. **Act on a finding only through its rules.**
- **The command did not run at all** — no such module, a non-zero exit, no
  `python3` — → never read that as a pass, and do not re-derive the check
  by hand: it lives in code so that there is one version of it. If the
  project has **no** `.apache-magpie.lock`, `.apache-magpie-overrides/`,
  or personal layer (any of the three directories above),
  nothing has been set up here and there is
  nothing to reconcile — resolve this skill's `requires_config:` entries
  yourself (first match wins: `.apache-magpie-local/<file>`, the main
  checkout's `.apache-magpie-local/<file>`, `<git-common-dir>/apache-magpie/<file>`,
  then `.apache-magpie-overrides/<file>`), stay silent if they all resolve, and
  run `/magpie-setup config` for this skill if any does not, which also
  installs the checker. Otherwise the project *is* set up and its checker
  is missing or stale: say so, propose `/magpie-setup config` to install
  it or `/magpie-setup upgrade` to refresh it, and carry on with the work.

**Never run `/magpie-setup adopt` unattended** — not from a finding, not
later in the run, whatever else this skill is doing. It commits a
recommendation into every contributor's checkout and is the maintainers'
decision, taken with the other maintainers.

Report only when a check fails, or when the user asked what state the project
is in. `/magpie-setup verify` is the full diagnostic.

<!-- END MAGPIE PREFLIGHT -->

Print a human-readable index of the skills installed for this
repository. The index is generated on every run from live
`SKILL.md` frontmatter — there is no cached copy to keep in sync.
The skill exists for humans (newcomers reading the repo,
maintainers checking what is available); agents route invocations
via the same frontmatter the script reads, so this skill is
purely informational.

What counts as "installed" depends on how Magpie was put in
place, so the script covers all three shapes and labels which one
each entry came from:

| Install | Where the skills live | Invocation shown |
|---|---|---|
| Pinned snapshot | `.agents/skills/` plus the per-agent relays beside it | `/magpie-<skill>` |
| Framework checkout | the repo's own `skills/` | `/magpie-<skill>` |
| Marketplace plugin | the plugin cache this script runs from, and its sibling plugins | `/<plugin>:<skill>` |

---

## Prerequisites

- Python 3.11+ on `PATH`. Nothing else — the script is
  stdlib-only, as `skills/pyproject.toml` requires of every
  helper script in this tree, and declares that contract in
  [PEP 723](https://peps.python.org/pep-0723/) inline metadata.
  `uv run --script` and a bare `python3` therefore behave
  identically.

---

## Step 1 — Run the listing script

Run the bundled script and present its output to the user
verbatim:

```bash
python3 .claude/skills/magpie-list-skills/scripts/list_skills.py
```

Run that command **literally**, as written — do not expand it to
an absolute path. It is a repository-relative path that resolves
under both install methods that put skills in the repository: a
pinned snapshot install and the framework checkout both carry
`.claude/skills/magpie-list-skills` as a symlink onto the real
skill directory.

For a layout that puts each description on its own indented line
(easier to read when descriptions are long), pass `--verbose`; to
inspect a repository other than the enclosing one, pass `--root`:

```bash
python3 .claude/skills/magpie-list-skills/scripts/list_skills.py --verbose
python3 .claude/skills/magpie-list-skills/scripts/list_skills.py --root /path/to/repo
```

**Marketplace installs are the one exception.** They write nothing
into the repository, so that path does not exist — the skill lives
in the plugin cache. Build the command from the base directory
reported for this skill instead:

```bash
python3 <the base directory reported for this skill>/scripts/list_skills.py
```

The script:

- resolves the repository from `git rev-parse --show-toplevel`
  (or `--root`), **not** from its own location — under a
  per-family plugin install its own location is one family, not
  the whole install;
- walks the agent-target directories that install writes into
  (`.agents/skills/` and its relays — the registry in
  [`../../../magpie-setup/skills/setup/agents.md`](../../../magpie-setup/skills/setup/agents.md) is the source of
  truth), the framework's own `skills/` when the repo is the
  framework checkout, and the sibling plugins in the marketplace
  cache when it is running from one;
- de-duplicates by the name you would type, so relay directories
  collapse to one entry while a skill available from *two*
  install methods keeps both — they are two different things to
  type;
- groups by each skill's declared `family:` frontmatter key, per
  Golden rule 8. Family is **never** inferred from the name
  prefix: `repo-health` and `contributor-growth` span several
  prefixes, and `write-skill` is family `utilities`, not family
  `write`. A skill that declares no family lands in `other`;
- prints each entry with the first sentence of its description,
  then a summary of which install each entry came from.

---

## Step 2 — Hand the output to the user

Quote the script output back to the user as-is. Do not
paraphrase, summarise, or re-order — the value of this skill is
that the listing is the canonical, deterministic view of what
exists. If the user asks for more detail on a specific skill,
read that skill's `SKILL.md` and answer from it.

---

## Hard rules

- **Read-only.** This skill never edits, creates, or deletes
  files. It only reads `SKILL.md` files under the install
  directories listed above.
- **No paraphrasing.** Always present the script output verbatim.
  Paraphrasing reintroduces the staleness this skill exists to
  prevent.

---

## References

- [`scripts/list_skills.py`](scripts/list_skills.py) — the
  listing script Step 1 invokes.
- [`AGENTS.md`](../../../../AGENTS.md#reusable-skills) — the
  framework's "Reusable skills" section, which explains the
  skills layout and frontmatter convention.
- [`../../../magpie-setup/skills/setup/agents.md`](../../../magpie-setup/skills/setup/agents.md) — the agent-target
  registry the discovery list mirrors.
- [`../../../../docs/setup/marketplace.md`](../../../../docs/setup/marketplace.md)
  — why the invocation name differs between install methods.
- [`write-skill`](../write-skill/SKILL.md) — sibling skill for
  authoring a new skill. Use it when the listing reveals a gap
  that warrants a new entry.

Attribution

apacheapache
View sourceSee grades on GitHubMore from apache →
SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Related Skills

Springboot Security

Java Spring Boot 服务中关于身份验证/授权、验证、CSRF、密钥、标头、速率限制和依赖安全的 Spring Security 最佳实践。

2456590 votes

Security Review

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

2456590 votes

Paperclip Evals

Choose, inspect, validate, and report Paperclip Runner or Product E2E evaluations while preserving evidence, provenance, cost, and failure classification.

953190 votes

Paperclip Task Bridge

Create, comment on, update, and list Paperclip tasks from Hermes using scoped Paperclip API credentials.

953190 votes

Summarize Status

Write a short, colloquial summary for a Paperclip summary slot: open with the 1–3 specific, concrete actions the reader needs to take right now to unblock the work, then a brief plain-language status, streaming progress as it works.

953190 votes
View all in security →