Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,738 results · page 49 of 58
- View details
shipSkillSecurity
Safely bring main up to date, commit intended pending changes, and push to origin/main. Use when the user explicitly asks to ship the current main branch or invokes the repository's ship workflow.
Ready to connect
- View details
test-case-writerSkillSecurity
Test case generator — converts a PRD's acceptance criteria and rules into test cases that QA can execute directly: happy paths, boundary values, error paths, concurrency/idempotency, permissions and security. Use this skill whenever the user says things like "幫我寫測試案例", "這份 PRD 的 test case", "QA 測試計畫
Ready to connect
- View details
track-findingsSkillSecurity
Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and re
Ready to connect
- View details
triage-findingSkillSecurity
Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug tr
Ready to connect
- View details
validationSkillSecurity
Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.
Ready to connect
- View details
verify-fixSkillSecurity
Use when the user asks whether an existing security fix, patch, finding, or completed issue actually remediates the original vulnerability without modifying the repository. Do not use to validate candidate findings, implement patches, or run full repository scans.
Ready to connect
- View details
Code ReviewerSkillSecurity
Professional code review expert providing constructive, actionable feedback focused on correctness, maintainability, security, and performance rather than code style preferences.
Ready to connect
- View details
roblox-cloudSkillSecurity
Use for Roblox Open Cloud APIs, API keys, OAuth 2.0, webhooks, scopes, token lifecycle, or in-experience HttpService calls.
Ready to connect
- View details
roblox-code-reviewSkillSecurity
Use when reviewing Roblox or Luau code for security, performance, monetization, data persistence, or architecture risks.
Ready to connect
- View details
roblox-securitySkillSecurity
Use when auditing Roblox code for exploit vectors, authority models, remotes, economy, and DataStore flows.
Ready to connect
- View details
verificationSkillSecurity
Full agent verification suite. Runs security, patterns, quality, and language-specific checks. Use when asked to "verify agent", "verify my agent", "audit agent", or "full verification".
Ready to connect
- View details
verify-securitySkillSecurity
Verify code for security issues including hardcoded secrets, input validation, error exposure, and dependency vulnerabilities. Use when asked to "verify security", "check for secrets", or "scan for vulnerabilities".
Ready to connect
- View details
ci-cd-reliability-architectureSkillSecurity
Establishes idempotency, self-containment, immutable artifacts, self-healing, zero-downtime, and zero-knowledge security for CI/CD pipelines, including delivery-strategy choice, evidence-gated release, and production promotion. Use this skill when designing, auditing, or debugging any workflow, rele
Ready to connect
- View details
review-advancedSkillSecurity
Rigorous sequential-audit code review with a dedicated security block and cited pedagogical lessons. Customize for your project.
Ready to connect
- View details
review-fullstackSkillSecurity
Complete code review of a fullstack MR/PR with 8 sequential audits (Clean Architecture, DDD, React Best Practices, SOLID, Testing, Code Quality, Security, Performance). The audit set is the deduplicated union of review-front and review-back — no audit runs twice. An orchestrator runs each audit one
Ready to connect
- View details
spark-recipe-unsubscribe-auditSkillSecurity
Full unsubscribe audit: scan inbox, archive, and GateKeeper for newsletter senders, classify by volume and engagement, detect phishing and duplicate subscriptions, then unsubscribe via the action tool or extracted footer links.
Ready to connect
- View details
wordpress-mcp-devSkillSecurity
Build and maintain modern WordPress plugins and MCP servers, including hybrid WordPress+MCP products. Use when implementing plugin architecture (PHP, REST API, Gutenberg/admin/page-builder integrations), MCP tooling (TypeScript/Python, stdio/HTTP transport), security hardening, licensing/updates, an
Ready to connect
- View details
wordpress-site-dnaSkillSecurity
Use when the user says 'analyze my wordpress site', 'what is running on my site', 'site dna', or 'what plugins are on my site'. Detects every page builder, audits active versus dead-weight plugins, maps content structure, finds orphaned shortcodes, and checks performance and security posture.
Ready to connect
- View details
ad-attackSkillSecurity
Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, ma
Ready to connect
- View details
shellSkillSecurity
Shell and session operations after an attack module already established command execution, a raw shell, webshell channel, container/runner shell, or remote session. This module does not own exploitation and should not pull SSH/WinRM/RDP authentication or vulnerability-to-shell chains out of Web/AD/C
Ready to connect
- View details
analyzing-activist-investor-vulnerabilitiesSkillSecurity
Evaluates corporate vulnerability to shareholder activism with governance assessment, valuation gaps, and operational improvement opportunities. Use when assessing activist risk, identifying vulnerabilities, or preparing defensive analyses.
Ready to connect
- View details
analyzing-competitive-landscapesSkillSecurity
Maps competitive dynamics with market positioning, feature comparison, funding histories, and differentiation assessment. Use when analyzing startup competition, mapping market landscapes, or identifying competitive threats.
Ready to connect
- View details
analyzing-sovereign-credit-riskSkillSecurity
Evaluates sovereign creditworthiness with fiscal analysis, external vulnerability, political risk, and institutional quality assessment. Use when analyzing sovereign risk, assessing country credit, or evaluating government bond exposure.
Ready to connect
- View details
ios-signing-doctorSkillSecurity
Diagnose and fix iOS code-signing, provisioning, and entitlement failures — the "no signing certificate / no profiles / doesn't match / get-task-allow" family, using codesign/security to inspect what's actually signed. Use when an archive, upload, or CI build fails on signing.
Ready to connect
- View details
mcp-server-managerSkillSecurity
Configure and manage MCP (Model Context Protocol) servers in Claude Code CLI. Use this skill when adding, removing, listing, or troubleshooting MCP servers, or when questions arise about MCP configuration, transport types, scopes, or authentication. Essential for connecting Claude Code to external t
Ready to connect
- View details
particle-swarm-simSkillSecurity
Generate 20,000+ particle swarm simulators in two modes: sandbox (complete Three.js host runtime with gesture controls, security validation, code injection pipeline) and sim (behavior function bodies that position/color particles via a sandboxed API). The AI writes ONLY a function body — the host ha
Ready to connect
- View details
tdmcp-quality-auditSkillSecurity
Run or maintain the full tdmcp repo quality-audit team: command sweeps, all package/Makefile/CI gates, security review, usability/flow review, refactor/test-gap analysis, coverage hardening, QA, and follow-up fix waves. Use whenever the user asks for a complete audit, improve repo/code quality, test
Ready to connect
- View details
bump-transitiveSkillSecurity
Surgically bump a vulnerable transitive dependency to its latest patch per major using pnpm.overrides, then clean up without leaving override traces in package.json.
Ready to connect
- View details
claude-pentest-skillsSkillSecurity
Structured web application penetration testing with OWASP methodology, curated payload references, 6-gate validation, and professional report generation
Ready to connect
- View details
plugin-architectureSkillSecurity
Build pluggable authentication features using the plugin system with initialization, migrations, routes, and service registration.
Ready to connect
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
52,524 of the 52,958 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.