Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,738 results · page 48 of 58
- View details
secscanSkillSecurity
In-session, token-efficient LLM security scan of a repo (SAST triage). A lightweight, native Claude Code pipeline — survey → threat-model → deep-dive → adversarial-verify → report — using Read/Grep/Glob (and optional subagents), no external tooling. Use when asked to "security scan", "find vulnerabi
Ready to connect★ 51
- View details
springboot-securitySkillSecurity
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
Ready to connect★ 51
- View details
test-specSkillSecurity
Generate BDD test specifications for story in 6 categories (API, UI, Load, Infrastructure, Security, Integration). Use when user wants to create test cases or mentions /test-spec command.
Ready to connect★ 51
- View details
adversarial-securitySkillSecurity
Use when you need to audit a project's security with a Red Team / Blue Team pipeline.
Ready to connect★ 50
- View details
dependency-scannerSkillSecurity
Use when scanning project dependencies (Node, Python, C#, Java, Go, Rust, Ruby) for vulnerabilities with Trivy fs. Generates a CycloneDX SBOM.
Ready to connect★ 50
- View details
golang-cli-reviewSkillSecurity
Comprehensive code review for Golang CLI applications. Produces an actionable checklist covering error handling, CLI framework patterns (Cobra/urfave), testing, performance, security, and Go idioms.
Ready to connect★ 50
- View details
grill-meSkillSecurity
Adversarial review that hunts every weakness, assumption, edge case, and missing test. Opponent mode — finds what will break before it breaks in production. Use when merging, when reviewing security-critical code, or when the solution feels too simple.
Ready to connect★ 50
- View details
nuclei-scanningSkillSecurity
Usar cuando se escanean vulnerabilidades conocidas (CVEs, misconfigs) con Nuclei.
Ready to connect★ 50
- View details
pentestingSkillSecurity
Usar cuando se ejecuta un pentest contra una aplicación o infraestructura.
Ready to connect★ 50
- View details
security-precommit-checkSkillSecurity
Pre-commit security scanner for git repos — blocks API keys, proxy credentials, private keys, and project-specific secrets before they reach a remote. Provides a central rule definition + per-repo customization + one-line installer that wires up `.git/hooks/pre-commit`. Use when you want to prevent
Ready to connect★ 50
- View details
skulto-release-certSkillSecurity
Certify a skulto build for Homebrew prod release. Runs three passes — unit/lint/cross-compile, clean-slate CLI walkthrough, and security audit — then produces a certification summary.
Ready to connect★ 50
- View details
vendor-contractsSkillSecurity
Vendor contracts, MSAs, DPAs, and procurement for B2B SaaS — master service agreements, service level agreements, data processing agreements, order forms, vendor security assessments, and contract negotiation playbooks. Use when selling to enterprise (inbound contracts), buying from vendors (outboun
Ready to connect★ 50
- View details
better-your-harnessSkillSecurity
Run an AI Harness health check on a local project and produce a visual HTML report. Scans five layers: security and hygiene (.gitignore, plaintext secrets, Agent permissions), context quality (AI readability, cold-start cost, noise ratio, directory structure), tooling (Skill/MCP/sub-agents, includin
Ready to connect
- View details
pi-dev-rulesSkillSecurity
Authoritative reference for Pi (`@earendil-works/pi-coding-agent`): install, configure, run, and extend. Use when the user asks about Pi CLI/flags/commands, providers/models/auth, settings/compaction/sessions, security/trust, extensions, skills, prompt templates, themes, packages, custom providers,
Ready to connect
- View details
boring-google-signup-setupSkillSecurity
Teach a boring-ui child app how to enable Google signup with @hachej/boring-core. Use when the user asks for Google auth, Google OAuth, social signup, or how to turn on Google sign-in/sign-up in a child app.
Ready to connect
- View details
detection-engineerSkillSecurity
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.
Ready to connect
- View details
gha-security-reviewSkillSecurity
Use when reviewing GitHub Actions workflows for exploitable vulnerabilities — finds pwn-request patterns, expression injection, credential escalation, config poisoning, and supply chain risks, and reports only HIGH and MEDIUM confidence findings with concrete attack paths.
Ready to connect
- View details
malware-triageSkillSecurity
Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.
Ready to connect
- View details
mandu-securitySkillSecurity
Security best practices for Mandu applications. Use when implementing authentication, authorization, input validation, or protecting against common vulnerabilities. Triggers on guard, auth, CSRF, XSS, or security tasks.
Ready to connect
- View details
pr-security-reviewSkillSecurity
Use when reviewing a pull request for security issues — automatically analyzes the diff for vulnerabilities, hardcoded secrets, injection risks, and broken access control before merging
Ready to connect
- View details
threat-model-analystSkillSecurity
Use when a repository, system, or major change needs a structured STRIDE-A threat model — map architecture, data flows, trust boundaries, abuse cases, and prioritized findings, or update an existing model with a change-focused diff.
Ready to connect
- View details
attack-path-analysisSkillSecurity
Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Ready to connect
- View details
deep-security-scanSkillSecurity
Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts;
Ready to connect
- View details
define-security-policySkillSecurity
Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.
Ready to connect
- View details
finding-discoverySkillSecurity
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Ready to connect
- View details
fix-findingSkillSecurity
Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Ready to connect
- View details
harms-checkSkillSecurity
Use when building anything USER-FACING (or with persuasion/retention/cancellation/consent/pricing flows, or that touches vulnerable people) to surface design-level harm the security/privacy/compliance gates miss: dark/deceptive patterns and foreseeable misuse. Assumes the product works as designed a
Ready to connect
- View details
loop-workerSkillSecurity
Autonomously work a `.pm` workstream to completion — pick the next pending milestone, implement every task end to end, /ship it, then move to the next until none remain. Use when the user asks to "loop", drain, or work through a whole workstream's backlog (e.g. `/loop-worker w1`). Sequential, not in
Ready to connect
- View details
merge-upstream-mainSkillSecurity
Merge the public openai/codex-security main branch into this fork's main branch and push the result to the fork remote. Use when asked to sync or merge upstream main for this repository.
Ready to connect
- View details
security-diff-scanSkillSecurity
Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.
Ready to connect
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
52,524 of the 52,958 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.