daymade Claude Code Skills Claude skills

A marketplace of about 120 skills from one author: skill-creator fork, audio and transcription tools, Claude Code and Codex ops, research, QA and more.

Our verdict Recommended with caveats

Genuinely deep in places, but it is a sprawling one-person marketplace with some credential-adjacent tools, so install single plugins after reading them.

The author changed 11 of 121 skill folders and the plugin manifest or hooks after our review (noticed Oct 29, 2026). The review describes the earlier version; we recheck changed skills weekly, the most significant changes first.

What daymade Claude Code Skills does

This is a Claude Code plugin marketplace maintained by an individual developer, grouped into plugins that you install one at a time. The headline item is skill-creator, a fork of Anthropic's skill-creator that adds a search-before-build protocol, a security scan with gitleaks as a gate before packaging, guidance on inline versus forked skills and a validator. Other groups include audio (ASR transcription to text, transcript-fixer, meeting minutes, StepFun speech and TTS), Claude Code operations (hooks, status line, model switching, history readers, usage analysis, web-search setup), Codex helpers, competitor analysis, QA planning, CLI demo generation, Cloudflare troubleshooting, repo setup and a data-visualization discipline skill.

The repo is very large: about 1,600 files and an average SKILL.md of 17 KB, with some skills far bigger, such as an 88 KB visualization skill and a 55 KB transcription skill. The depth is uneven but real in places: transcript-fixer has 36 references, 103 scripts and 38 tests, and several others carry scripts and tests. The skills are largely written for the author's own workflows, with bilingual English and Chinese material, macOS and Windows-specific tools, and optional external services such as StepFun APIs. Because it is a marketplace, install only the plugins you need.

Good for

  • Building and packaging your own skills with a stricter skill-creator
  • Transcribing and cleaning audio and meeting recordings
  • Power users managing Claude Code and Codex setups

Not for

  • Installing everything at once
  • Locked-down environments where credential-adjacent tools are not acceptable

What's inside depth 4/5

Around 120 skills averaging 17 KB, with large reference sets and test suites in several (transcript-fixer has 36 references, 103 scripts, 38 tests), but depth varies a lot between plugins.

Skills
121
Reference docs
463
Scripts
647
Tests / evals
459
Templates
58
Avg SKILL.md
16.8 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Python 3.10+ and uv for many scripts
  • Node.js 22+ for some tools
  • yt-dlp and FFmpeg for media skills
  • Optional StepFun or other API keys for speech services
  • macOS or Chrome for the browser, cookie and history tools

Security review

Broad access

This skill asks for more access than most, or sends data to another service. That is usually a design choice rather than bad intent, but you should know before you install it.

  • Uses your browser cookies or logged-in profileThe cookie-copy skill copies the encrypted Google or ChatGPT/OpenAI cookie rows from the user's real macOS Chrome profile (Default/Cookies) into another Chrome profile so the login session is reused; it writes a backup first and asks for confirmation unless --yes is passed. bilibili-source/scripts/bili-subs.sh also runs yt-dlp with --cookies-from-browser.cookie-copy/scripts/copy-cookies.py:1

A very large personal skill collection (audio/ASR, Claude Code tooling, Cloudflare, Bilibili and more). Notable capabilities: cookie-copy duplicates your Chrome login cookies for Google/ChatGPT into another profile, the profile and plugin tools edit ~/.claude settings and can install a macOS LaunchAgent, and the audio/transcript skills send audio URLs or transcript text with your API key to StepFun or GLM. We hold about 70% of the files and read only a minority of scripts line by line, so this is a partial review.

Worth knowing

  • Installs with curl | shREADME install route is curl -fsSL https://raw.githubusercontent.com/daymade/claude-code-skills/main/scripts/install.sh | bash (vendor repo, main branch, script not in our snapshot); transcript-fixer's ensure_deps.py also prints curl -LsSf https://astral.sh/uv/install.sh | sh.README.md:123
  • Changes files outside your projectclaude-switch-models-setup symlinks helper scripts into ~/.config/claude-switch-models-setup, manages ~/.claude/settings profiles and can install a macOS LaunchAgent sync daemon (sync-local-skill-sources-daemon.sh); claude-skills-troubleshooting/enable_all_plugins.py rewrites ~/.claude/settings.json enabledPlugins; auto-repo-setup/init_session_start_hook.py writes a SessionStart hook into the project's .claude/settings.json (dry-run and --remove supported).daymade-claude-code/claude-switch-models-setup/scripts/setup.sh:8
  • Needs an API key for its own serviceStepFun ASR/TTS scripts read STEPFUN_API_KEY (or ${CLAUDE_PLUGIN_DATA}/config.json) and send it only to api.stepfun.com together with the audio URL/text; transcript-fixer sends the transcript chunks and a GLM/Anthropic key to the configured model API (default GLM at open.bigmodel.cn); cloudflare scripts use a Cloudflare token against api.cloudflare.com (fix_ssl_mode.py is dry-run by default).daymade-audio/stepfun-asr/scripts/asr_file.py:25
  • Makes network requestsScripts call api.bilibili.com (optionally with a user-supplied Netscape cookie file), StepFun, GLM/Anthropic-compatible endpoints, the Cloudflare API, Jina/fxtwitter in README examples and a user-configured remote ASR endpoint.bilibili-source/scripts/bili-access.py:324
  • installs_hooksREADME says the marketplace-dev plugin ships two documented PostToolUse hooks (validate on marketplace.json edit; warn on un-bumped SKILL.md version) that 'auto-activate with the plugin'; other hook skills (prior-work-retrieval, auto-repo-setup) install hooks on explicit request.README.md:2303
  • Installs packages or toolsSeveral skills install or require uv/pip packages, yt-dlp, FFmpeg, whisper.cpp builds (build_whispercpp_gpu.py) and other tools on the user's machine.daymade-audio/transcript-fixer/scripts/ensure_deps.py:36
  • Relies on a CLI or package we could not reviewSkills rely on external CLIs not in the repo: lark-cli, yt-dlp, ffmpeg, asciinema, uv, claude, codex and Chrome.daymade-claude-code/lark-cli-router/scripts/find_recording_candidates.py:37

What we checked

The repository (1624 files) on Oct 29, 2026. Not a full review: 1112 of 1624 files were not downloaded (large repository; we reviewed the skill folders); we read 1 of 279 code files; it relies on code outside the repository: 1,112 of 1,624 repo files are not in our snapshot, including scripts/install.sh, .claude-plugin/marketplace.json, .githooks and CI; Only cookie-copy/scripts/copy-cookies.py was read in full. The other 199 listed code files were pattern-searched for network, subprocess, environment, home-directory, cookie and delete operations; stepfun-asr/asr_file.py, auto-repo-setup/init_session_start_hook.py, prior_work_hook.py, claude-switch-models-setup/setup.sh and several others were read in part, but none of those are listed as fully read; External services: StepFun, Zhipu GLM (bigmodel.cn), Cloudflare API, Bilibili, Lark/Feishu via lark-cli, Jina.

NVIDIA SkillSpector static scan: 669 pattern hits (Dangerous Code Execution 178, Data Exfiltration 134, Excessive Agency 126, Agent Snooping 99, Privilege Escalation 30, Data Flow 24). SkillSpector's CRITICAL/HIGH hits are mostly test fixtures (exec(compile(...)) in an ASR test), env-key-to-vendor flows in StepFun/GLM scripts (the key goes to its own vendor), curl|python parsing of Bilibili API responses, README mentions of Keychain/cookies, and documentation of Cloudflare DELETE endpoints. The 'info stealer' YARA hits correspond to the cookie-copy skill and the Bilibili cookies-from-browser option, both user-directed and documented.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed.

Can it run unattended?

Not really. It is a toolbox of independent skills; a few support long jobs such as transcription batches, but there is no shared loop or verification layer.

Alternatives to daymade Claude Code Skills

Claude Skills (alirezarezvani)

alirezarezvani/claude-skills

A 400+ skill library of agents, personas and commands for engineering, marketing, product, compliance and C-level work, mirrored for 13 coding agents.

With caveats Check first Depth 3/5

borghei Claude-Skills

borghei/Claude-Skills

A large library of 385 business, product, compliance and engineering skills with 906 standard-library Python tools, under a Commons Clause license.

With caveats Check first Depth 4/5

Claude Code Templates

davila7/claude-code-templates

A large catalog and npx installer (aitmpl.com) of agents, commands, hooks, MCP configs and skills for Claude Code, much of it collected from other authors.

With caveats Broad access Depth 3/5

wshobson/agents

wshobson/agents

A multi-harness plugin marketplace with 94 plugins, 202 agents, 185 skills and 105 commands for Claude Code, Codex, Cursor, OpenCode, Copilot, Antigravity and Pi.

With caveats Check first Depth 2/5

FAQ

What is daymade's claude-code-skills?

It is a Claude Code plugin marketplace by one developer with roughly 120 skills, including a hardened fork of skill-creator, audio transcription tools, Claude Code operations helpers and research and QA skills.

How do I install it?

In Claude Code run /plugin marketplace add daymade/claude-code-skills, then install a plugin such as daymade-skill@daymade-skills. The README also shows a curl-to-bash install script, which you should read before running.

Is daymade/claude-code-skills safe?

We found no obfuscated payloads in the sample we read, but the marketplace includes tools that touch credentials and history, such as cookie-copy and history readers. Install individual plugins you understand rather than the whole set.

daymade skills vs alirezarezvani/claude-skills?

Both are very large collections from individuals. Daymade's leans toward Claude Code operations, audio and skill authoring, while alirezarezvani's targets broad role-based coverage across engineering, product and marketing. Pick the individual skills that fit your work.

Sources: GitHub repository (stars, license, file tree, last push Oct 29, 2026). Review based on the README and SKILL.md files as published.