Search skills/

Claude Code Guide (zebbern) Claude skills

A long community README guide to Claude Code plus 79 mixed skills: general developer helpers, document tools and a large group of security-testing playbooks.

zebbern/claude-code-guide 79 skills SecuritySkill & agent tooling
Our verdict Recommended with caveats

A useful, current-looking guide, but the skill folder is an uneven grab-bag with dual-use security content, so install only the individual skills you have reviewed.

2/5 Depth expertise shipped Note Security Review before installing 1d Maintenance Updated today 4.7K Adoption stars OK License MIT, commercial OK

What Claude Code Guide (zebbern) does

This repository has two parts. The first is a long README that works as a Claude Code manual: installation on macOS, Linux and Windows, environment variables, configuration files, slash commands, keyboard shortcuts, plan and auto modes, MCP, sub-agents, hooks, sandboxing and troubleshooting. It links to the official documentation as the authority because commands change quickly.

The second part is a skills folder with 79 entries averaging about 9 KB. They are unrelated to each other and range widely: an academic paper reviewer, a caching guide, authentication patterns, a code documenter, a code-to-diagram tool, a PDF skill with several form-handling scripts, an audit-flow skill, a log digest, an HTTP load profiler and an i18n audit. A substantial share are security-testing guides aimed at authorized penetration testing and bug bounty work, covering web, API, cloud and Windows-domain topics. A handful of skills include Python helper scripts; most are single instruction files with at most one reference. The README links to the author's other repositories, such as a 954-skill collection and a skill-authoring helper. Treat it as a reading list and a grab-bag to pick individual skills from, not as one coherent pack.

Good for

  • Newcomers who want a single readable Claude Code setup reference
  • Picking a few individual skills such as the PDF or log tools
  • Authorized security testers looking for starting checklists

Not for

  • Anyone who wants a curated, consistent skill set
  • Using the security skills against systems you do not have written permission to test

What's inside depth 2/5

79 skills averaging 9 KB, mostly single instruction files with few references; only a minority have helper scripts, and there are no tests or evals.

Skills
79
Reference docs
226
Scripts
31
Tests / evals
0
Templates
4
Avg SKILL.md
9 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • Python for the skills that ship scripts
  • Third-party security tools named inside the security-testing skills

Security review

Review before installing

A large Claude Code usage guide plus about 40 skills, including many dual-use penetration-testing skills that tell the agent to install and run offensive tools and pipe downloaded scripts into a shell; they say to use them only with written authorization. The bundled Python and Node scripts are local analysis helpers (audit database with git merge drivers, read-only database explorer, vulnerability pattern scanner, PDF form tools). Much of the repo was not available for review.

Worth knowing

  • Installs with curl | shPentest skills tell the agent to run curl https://sdk.cloud.google.com | bash and, in linux-privilege-escalation/SKILL.md:144, curl -L .../PEASS-ng/releases/latest/download/linpeas.sh | sh (a third-party tool on a moving 'latest' release); the README (line 143) also documents the official curl -fsSL https://claude.ai/install.sh | bash.skills/cloud-penetration-testing/SKILL.md:29
  • Runs remote code at an unpinned versionSetup steps use unpinned pip install scoutsuite pacu, Install-Module -Force for Az/AzureAD, and latest-release downloads; chart-image/scripts/package.json uses caret ranges (vega, vega-lite, sharp).skills/cloud-penetration-testing/SKILL.md:33
  • Installs packages or toolsSeveral skills install Node and Python packages (vega, vega-lite, sharp, psycopg2, pypdf, pdf2image, pdfplumber) and security tooling named in the pentest skills.skills/chart-image/scripts/package.json:4
  • Makes network requestshttp_benchmark.py runs wrk or ab load tests against a URL you give it; the offensive-security skills (metasploit, AD attacks, cloud pentesting, privilege escalation) instruct the agent to run scanners, exploit frameworks and reverse-shell examples against targets; they state written authorization is required.skills/http-load-profiler/scripts/http_benchmark.py:180
  • Relies on a CLI or package we could not reviewScripts shell out to npm audit, pip-audit, git, wrk/ab and mmdc (mermaid-cli), and the pentest skills rely on Metasploit, BloodHound, hashcat, Mimikatz and similar tools whose code is not in the repo.skills/code-vuln-audit/scripts/security_scan.py:488

What we checked

The repository (402 files) on Oct 29, 2026. Not a full review: 280 of 402 files were not downloaded (large repository; we reviewed the skill folders); we read 7 of 20 code files; it relies on code outside the repository: Large scripts only searched by keyword and partly read, not opened in full: skills/audit-flow/scripts/audit.py (60 KB), skills/chart-image/scripts/chart.mjs (54 KB), code-vuln-audit/security_scan.py, data-viz-renderer/build_infographic.py, dataset-quality-audit/data_quality_checker.py, http-load-profiler/http_benchmark.py, database-scout/db_explorer.py, log-error-digest/analyze_logs.py, code-to-diagram/analyze_codebase.py, localization-toolkit/i18n_audit.py and three pdf extract/check scripts; Third-party security tools, cloud CLIs and Claude Code installer the guide and pentest skills tell the agent to download and run; About 280 readable files not in the local copy, including agents/ definitions, CHANGELOG and GitHub workflows.

NVIDIA SkillSpector static scan: 365 pattern hits (Privilege Escalation 154, Data Exfiltration 39, Prompt Injection 36, YARA Match 26, Tool Misuse 22, Server-Side Request Forgery 22). The CRITICAL and most HIGH hits are YARA matches inside offensive-security teaching documents: Meterpreter/msfvenom, a bash /dev/tcp reverse shell, a PHP system($_GET[...]) sample, Mimikatz and BloodHound references. They are command examples and payload samples in Markdown, not code the skills run on their own. The curl | bash hits are the README's Claude Code installer and the pentest setup lines noted above; the rest are the guide's discussion of --dangerously-skip-permissions and settings.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed.

Can it run unattended?

Not really. The skills are reference playbooks and helpers with no loops, stop conditions or resumable state.

Alternatives to Claude Code Guide (zebbern)

Claude Code Best Practice

shanraisshan/claude-code-best-practice

A large reference repo of Claude Code tips, concept guides and sample agents, commands and skills; a guide to read, not a skill pack to install.

With caveats Check first Depth 1/5

Trail of Bits Skills

trailofbits/skills

Trail of Bits' marketplace of 97 security skills: smart-contract scanners, C/C++ and Rust review, Semgrep and CodeQL workflows, variant analysis and audit helpers.

Recommended Broad access Depth 4/5

Claude Skills (alirezarezvani)

alirezarezvani/claude-skills

A 400+ skill library of agents, personas and commands for engineering, marketing, product, compliance and C-level work, mirrored for 13 coding agents.

With caveats Check first Depth 3/5

awesome-agentic-ai-zh

WenyuChiou/awesome-agentic-ai-zh

A trilingual (CN/EN) learning roadmap for agentic AI with 240+ curated links, hands-on exercises and one example skill, tool-calling-tutor.

With caveats Check first Depth 3/5

FAQ

What is zebbern's Claude Code Guide?

It is a community-written guide to Claude Code covering setup, configuration, commands, MCP, agents and troubleshooting, together with a folder of 79 assorted skills. The README itself points to the official docs as the final authority.

How do I install the skills?

Copy the folders you want from the skills directory into your agent's skills folder. There is no plugin manifest, and installing all 79 at once is not advisable because they are unrelated.

Is it safe to install?

Most skills are plain instructions, but a number cover security testing and tell the agent to use privileged tools. Read each skill before enabling it and only use security skills on systems you are authorized to test.

Is this an official Anthropic resource?

No. It is an independent community repository under the MIT license; the official documentation lives on code.claude.com.

Sources: GitHub repository (stars, license, file tree, last push Oct 28, 2026). Review based on the README and SKILL.md files as published.