Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,738 results · page 34 of 58
- View details
codebase-cleanup-deps-auditSkillSecurity
Lets your agent scan project dependencies for known vulnerabilities, license issues, and outdated packages with fix suggestions.
Ready to connect★ 96
- View details
pr-code-reviewerSkillSecurity
Reviews a GitHub pull request or focused branch diff for correctness, regressions, security, compatibility, test gaps, and maintainability. Use when an implementation needs an independent source-aware review before merge. Produces prioritized findings with evidence and actionable fixes. Not for arch
Ready to connect★ 94
- View details
prose-styleSkillSecurity
Reusable writing-style contract for agent outputs (reports, ARCH docs, verdicts, threat models). Forces direct prose with concrete evidence, no marketing voice, no hedge words. The single most-referenced skill across the pipeline — used by 28 agents.
Ready to connect★ 92
- View details
afrexai-compliance-auditSkillSecurity
Run internal compliance audits against major governance and security
Ready to connect★ 92
- View details
api-design-patternsSkillSecurity
Comprehensive API design patterns covering REST, GraphQL, gRPC, versioning, authentication, and modern API best practices
Ready to connect★ 92
- View details
api-gatewaySkillSecurity
Passthrough proxy for direct access to third-party APIs using managed OAuth connections, provided by [Maton](https://maton.ai). The API gateway lets y
Ready to connect★ 92
- View details
architecture-reviewSkillSecurity
Before committing to an implementation plan, run this skill to stress-test the proposed architecture. Catches over-engineering, circular dependencies, missing failure modes, security gaps, and scalability cliffs — before any code is written. Acts as a "second eye" on the plan.
Ready to connect★ 92
- View details
audit-codeSkillSecurity
Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized report with concrete fixes. Use when the user asks to audit code, perform a deep review, stress-test a codebase, or produce a risk-ranked remed
Ready to connect★ 92
- View details
auth-systemSkillSecurity
Implement secure authentication and authorization systems with JWT, OAuth2, Session-based auth, and RBAC. Use when: (1) implementing user login/signup, (2) setting up JWT tokens, (3) OAuth2 integration (Google, GitHub, etc.), (4) role-based access control (RBAC), (5) password hashing and validation,
Ready to connect★ 92
- View details
automate-macos-cua-driverSkillSecurity
Build and validate macOS GUI automation with cua-driver and AX trees. Use for permissions, sessions, Chrome interaction, authenticated downloads, or unverified UI actions.
Ready to connect★ 92
- View details
openclaw-shieldSkillSecurity
Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.
Ready to connect★ 92
- View details
arch-designSkillSecurity
System-design thinking before any doc or code: goals/non-goals, back-of-envelope numbers, components and contracts, failure modes, operability, security, trade-offs. Use for "design this system", "architecture for X", "trade-offs for X", "how should we architect", "API design", "data model for", "se
Ready to connect★ 91
- View details
magpie-audit-finding-fixSkillSecurity
For a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer / equivalent; full list in the body) against `<upstream>`, draft the smallest fix for each finding. Re-runs the tool after each batch to confirm the findings a
Ready to connect★ 91
- View details
magpie-optimize-skillSkillSecurity
Optimize an existing framework skill (or sweep a set of them) by applying the restructuring patterns proven on the security-skill suite: split an oversized `SKILL.md` into linked sibling docs, lift concrete/project-specific values out of the body into `<project-config>` placeholders, replace in-agen
Ready to connect★ 91
- View details
magpie-pairing-multi-agent-reviewSkillSecurity
Fan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report. Each pass is isolated so findings from one axis cannot suppress or bias the others. The merged report uses the same format as pairing-
Ready to connect★ 91
- View details
magpie-pairing-self-reviewSkillSecurity
Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default branch), checks correctness, security, and project conventions, and returns a structured report to the developer. No stat
Ready to connect★ 91
- View details
magpie-security-cve-allocateSkillSecurity
Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field,
Ready to connect★ 91
- View details
magpie-security-issue-deduplicateSkillSecurity
Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and
Ready to connect★ 91
- View details
magpie-security-issue-fixSkillSecurity
Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and u
Ready to connect★ 91
- View details
magpie-security-issue-importSkillSecurity
Scan <security-list> for reports that have not yet been copied into <tracker> as tracking issues, present the proposed imports to the user, and — defaulting to *import unless the user rejects upfront* — create the tracking issues with the `Needs triage` project-board status and draft a receipt-of- c
Ready to connect★ 91
- View details
magpie-security-issue-import-from-prSkillSecurity
Open a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. The tracker lands in the `Assessed` board column with the scope label applied, `pr created` / `pr merg
Ready to connect★ 91
- View details
magpie-security-issue-import-from-scanSkillSecurity
Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; applies only the operato
Ready to connect★ 91
- View details
magpie-security-issue-import-via-forwarderSkillSecurity
Optional sub-skill of `security-issue-import`, `security-issue-invalidate`, and `security-issue-sync` that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter but was relayed onto `<security-list>` by an upstream broker (the ASF security team, a third-party di
Ready to connect★ 91
- View details
magpie-security-issue-triageSkillSecurity
For each open `<tracker>` issue carrying the `needs triage` label, read body + comments and classify the candidate disposition into one of six classes: VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID / PROBABLE-DUP / FIX-ALREADY-PUBLIC. On user confirmation, posts a triage-proposal comment that invit
Ready to connect★ 91
- View details
magpie-security-model-prepareSkillSecurity
Front door for a project that has no published security model yet. Opens the conversation with `<governance-body>` on the private list, drives production of a first draft — delegating the model-writing itself to the Alpha-Omega threat-model skill set — in **draft-first** mode so maintainers react to
Ready to connect★ 91
- View details
magpie-security-model-updateSkillSecurity
Refresh an existing security model from what has actually happened since it was written. Mines the decision history — `<tracker>` dispositions with their stated reasons, reporter correspondence on `<security-list>`, published advisories and the project's canned responses — then maps each outcome ont
Ready to connect★ 91
- View details
magpie-security-model-verifySkillSecurity
Pre-flight check on a project's published security model, run per repository in scope. Verifies two things — (1) **discoverability**: an agent can mechanically reach the model by following `AGENTS.md` → `SECURITY.md` → model at a named commit, and (2) **completeness**: the model covers the minimum-b
Ready to connect★ 91
- View details
magpie-security-tracker-stats-dashboardSkillSecurity
Generate a self-contained HTML dashboard of `<tracker>` repository statistics for security-team review.
Ready to connect★ 91
- View details
magpie-workflow-security-auditSkillSecurity
Read-only GitHub Actions workflow security audit for one repository, an explicit repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. Produces a grouped, prioritised find
Ready to connect★ 91
- View details
evo-druid-cve-patchSkillSecurity
Patches Apache Druid 0.20.0 for CVE-2021-25646 - a JavaScript injection vulnerability where empty-string keys in JSON payloads can override server-side JavaScriptConfig to enable arbitrary code exe...
Ready to connect★ 89
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
52,524 of the 52,958 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.