Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,840 results · page 56 of 62
- View details
object-injection-deserializationSkillSecurity
Use when code calls unserialize, maybe_unserialize, or stores serialized PHP in options, meta, or transients from untrusted input. Avoids unserialize on attacker-controlled data, prefers json_encode / json_decode, and when unserialize is unavoidable passes ['allowed_classes' => false]. Prevents PHP
Ready to connect
- View details
output-escapingSkillSecurity
Use when echoing or printing any dynamic value in WordPress PHP or templates — into HTML, attributes, URLs, inline JavaScript, or textareas. Escapes at the point of output with esc_html, esc_attr, esc_url, esc_js, esc_textarea, or wp_kses_post, including the i18n variants (esc_html__, esc_attr_e). P
Ready to connect
- View details
rest-api-securitySkillSecurity
Use when registering WordPress REST API routes with register_rest_route or building custom endpoints. Sets a real permission_callback (never __return_true for writes), defines args with sanitize_callback and validate_callback, enforces capabilities and per-object checks, and escapes any HTML in resp
Ready to connect
- View details
security-auditing-code-reviewSkillSecurity
Use when auditing or code-reviewing an existing WordPress plugin or theme for security issues, triaging a vulnerability report, or hardening inherited code. Provides a systematic methodology — locate trust boundaries, inventory sensitive sinks, trace their controls and data flows, then triage confir
Ready to connect
- View details
security-headers-cspSkillSecurity
Use when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors), Referrer-Policy, Permissions-Policy, HSTS, Secure/HttpOnly/SameSite cookie flags, or CORS on REST responses. C
Ready to connect
- View details
settings-options-securitySkillSecurity
Use when building an options or settings page with the WordPress Settings API - register_setting, add_settings_field, settings_fields, an options.php form, or update_option / get_option on plugin data. Attaches a sanitize_callback to every setting, gates the page with manage_options, relies on Setti
Ready to connect
- View details
shortcode-block-securitySkillSecurity
Use when registering a shortcode with add_shortcode or a dynamic block with a render_callback, or processing shortcode / block attributes. Normalizes attributes with shortcode_atts, validates against allowlists, and escapes all rendered output for its context with esc_html, esc_attr, esc_url, or wp_
Ready to connect
- View details
spring-authorization-serverSkillSecurity
Spring Authorization Server for building OAuth 2.1 and OpenID Connect providers.
Ready to connect
- View details
spring-bootSkillSecurity
Spring Boot 3 Java framework with enterprise patterns. Covers REST controllers, services, repositories, JPA entities, MapStruct mappers, Lombok, JWT security, Flyway migrations, and global exception handling.
Ready to connect
- View details
spring-graphqlSkillSecurity
Spring for GraphQL - building GraphQL APIs with Spring Boot. Covers queries, mutations, subscriptions, @BatchMapping, DataLoader, and security.
Ready to connect
- View details
spring-ldapSkillSecurity
Spring LDAP for LDAP/Active Directory integration and authentication. Covers LdapTemplate, @Entry mapping, LdapRepository, and Spring Security integration.
Ready to connect
- View details
spring-profilesSkillSecurity
Configuration and profiles management in Spring Boot 3.x. Covers @Profile, @ConfigurationProperties, property sources, YAML/properties, external configuration, secrets management, and environment-specific beans.
Ready to connect
- View details
spring-securitySkillSecurity
Spring Security JWT authentication for Spring Boot 3. Covers SecurityFilterChain, JWT filter, authentication, authorization, CORS, rate limiting, and security headers.
Ready to connect
- View details
webauthnSkillSecurity
WebAuthn/FIDO2 passwordless authentication. Passkeys, registration and authentication ceremonies, SimpleWebAuthn library, resident credentials, and platform/cross-platform authenticators.
Ready to connect
- View details
woocommerce-securitySkillSecurity
Use when a plugin extends WooCommerce - reading or writing orders, customer data, or hooking checkout, REST, or the Store API. Sanitizes input with wc_clean, gates shop actions with WooCommerce capabilities like edit_shop_orders, minimizes stored payment data, and escapes customer PII on output. Pre
Ready to connect
- View details
wp-cli-securitySkillSecurity
Use when registering a WP-CLI command with WP_CLI::add_command or writing command logic. Validates and sanitizes positional and associative arguments, does not assume a logged-in user or capability context, avoids printing secrets, and confirms destructive operations. Prevents injection and unsafe a
Ready to connect
- View details
ethics-review-checklistSkillSecurity
Generate a story-specific editorial ethics checklist: consent verification, harm assessment, source protection, vulnerable-subject protocols, conflict-of-interest flags, and public interest justification — tailored to the story's specific risks.
Ready to connect
- View details
agri-food-securitySkillSecurity
Author-guideline skill for Agriculture & Food Security (BMC / Springer Nature, open access). Use to format or check a manuscript for this BMC journal — structure, mandatory BMC declarations, numbered references, and figure specs. Triggers: submit to Agriculture & Food Security, BMC food journal guid
Ready to connect
- View details
api-debugSkillSecurity
Debug REST, GraphQL, webhook, and OAuth/API-key integrations with layered request, auth, schema, and response checks.
Ready to connect
- View details
authorized-web-pentestSkillSecurity
Run an authorized, scoped web application security test with evidence-based findings and strict active-testing guardrails.
Ready to connect
- View details
bitrix-restSkillSecurity
Covers REST module — registering methods from a custom module, scopes, webhook and OAuth overview, rest / restIntegration settings, link to Engine controllers and ActionFilter\Scope::REST. Applied when exposing module APIs to apps, webhooks, or marketplace integrations. Key terms — rest, OnRestServi
Ready to connect
- View details
bitrix-securitySkillSecurity
CSRF, XSS, SQLi, SSRF, JWT/JWK, access rights, encryption. Use when handling input or auditing security.
Ready to connect
- View details
convex-setup-authSkillSecurity
Set up Convex authentication and authorization. Use for Convex Auth, Better Auth, Clerk, Auth0, JWT providers, auth.config.ts, protected functions, and user mapping.
Ready to connect
- View details
ns-security-auditSkillSecurity
Audit and remediate NowStack Mobile security flaws. Use for auth/session abuse, Apple or Stripe payment bypass, Convex authorization, cross-user data leaks, unsafe deep links, R2 uploads, client secrets, SSRF, XSS, or pentest follow-up.
Ready to connect
- View details
ns-setup-google-authSkillSecurity
Set up and verify Google OAuth for NowStack Mobile web and Expo clients against the shared Better Auth and Convex backend. Use for Google sign-in buttons, Google Cloud OAuth clients, callback URLs, missing GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET, or production Google auth rotation.
Ready to connect
- View details
- View details
security-lensSkillSecurity
Security review lens for evaluating threats, vulnerabilities, and
Ready to connect
- View details
springer-foodSkillSecurity
Shared author-guideline skill for Springer / Springer Nature food journals: Food Engineering Reviews, Food and Bioprocess Technology, Food Security, and the SpringerOpen journal Food Production Processing and Nutrition. Use to format or check a manuscript for a Springer food journal — structure, abs
Ready to connect
- View details
tinycrypt-integrationSkillSecurity
Use when integrating, porting, configuring, or debugging TinyCrypt cryptographic primitives, AES, SHA, HMAC, ECC, CTR/CCM, RNG, or embedded security code
Ready to connect
- View details
wiley-foodSkillSecurity
Shared author-guideline skill for Wiley food & nutrition journals: Comprehensive Reviews in Food Science and Food Safety, Food Frontiers, eFood, Legume Science, Food and Energy Security, Molecular Nutrition & Food Research, Journal of Food Biochemistry, Food Science & Nutrition. Use to format or che
Ready to connect
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
54,764 of the 55,196 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.