20 repos in 6 groups: learning Claude Code, spec/plan/test workflows, token saving, design, writing/research, building and scanning skills. Pick 3–5 skills that fit, read the code before installing, scan with SkillSpector.
Search "claude skills" on GitHub and you'll get thousands of repos, many of them copies of each other or collections of hundreds of skills just for the count. Install them blindly and your agent gets slower, uses more context, and carries security risk. This post filters down to the 20 most-used repos by GitHub stars (as of 28 Oct 2026), grouped by purpose, each with one line on "what it does" and "when to use it".
Selection criteria
Directly about using Claude/Claude Code: tips, skills, workflows, token saving.
Widely used (lots of stars) and still updated in recent weeks.
Not already covered in their own post on binhAI (superpowers, caveman, RTK, Graphify… see the Repos page).
Skipping offensive-security and "leaked system prompt" repos.
A large catalogue of skills and plugins by use case; includes a plugin connecting Claude to many apps via Composio.
~78k
If you only try one repo, copy Karpathy's 4 principles into CLAUDE.md. A few dozen lines, and the effect usually shows immediately: Claude asks more questions and writes less unnecessary code.
A harness optimisation system: skills, memory, security, research; installed as a Claude Code plugin. The README warns to install only from official channels.
Spec-driven loop Discuss → Plan → Execute → Verify → Ship, each executor running with a clean context. Formerly get-shit-done (~64k stars), now moved to this repo.
The "lazy senior" skill: write only what the task needs, without cutting validation or error handling. The author's benchmark reports about 45% fewer tokens.
NVIDIA's tool that scans skills for vulnerabilities and malware before installing.
~23k
Risks and caveats
Skills are code running with your permissions. SkillSpector's README cites research: of about 31 thousand skills analysed, 26.1% had vulnerabilities and 5.2% showed signs of malicious intent. Read SKILL.md and scripts before installing.
Install from the original source. Popular repos are often re-uploaded with malware; ECC puts exactly this warning at the top of its README.
Don't install the whole store. Every skill's description sits in context. Choose 3–5 skills that match your work.
Benchmark numbers are the authors'. Measure on your own projects.
How to apply it
Dev: Start with Karpathy's 4 principles and one workflow set (addyosmani or GSD). For long multi-session work, add planning-with-files.
Tech Lead: Pick a standard skill set for the team, commit it to .claude/skills/, and run SkillSpector in CI for every new skill.
PM: Try last30days for quick market research, archify for plan diagrams, humanizer to edit text before sending.