Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,840 results · page 36 of 62
- View details
magpie-security-cve-allocateSkillSecurity
Walk a security team member through allocating a CVE for an `<tracker>` tracking issue (governance-gated per `governance.cve_allocation_gate`). Prints the configured `<cve-tool>` allocation URL, waits for the allocated CVE ID, then updates the tracker in place. Tracker updates: CVE tool link field,
Ready to connect★ 91
- View details
magpie-security-issue-deduplicateSkillSecurity
Merge two <tracker> tracking issues that describe the same root-cause vulnerability, preserving every reporter's credit, every mailing-list thread reference, and every independent attack-vector description. Updates the kept issue's body in place, closes the duplicate with the `duplicate` label, and
Ready to connect★ 91
- View details
magpie-security-issue-fixSkillSecurity
Attempt to fix a security issue tracked in `<tracker>` by implementing the change in a public `<upstream>` PR. Runs `security-issue-sync` first to reconcile the issue's state, proposes an implementation plan, and on explicit user confirmation writes the change, opens a PR from the user's fork, and u
Ready to connect★ 91
- View details
magpie-security-issue-importSkillSecurity
Scan <security-list> for reports that have not yet been copied into <tracker> as tracking issues, present the proposed imports to the user, and — defaulting to *import unless the user rejects upfront* — create the tracking issues with the `Needs triage` project-board status and draft a receipt-of- c
Ready to connect★ 91
- View details
magpie-security-issue-import-from-prSkillSecurity
Open a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. The tracker lands in the `Assessed` board column with the scope label applied, `pr created` / `pr merg
Ready to connect★ 91
- View details
magpie-security-issue-import-from-scanSkillSecurity
Triage a security scanner's multi-finding output (read via a pluggable scan-format adapter) and turn findings into security work only after a complete operator-reviewed triage. Reads the scan's finding index plus its per-finding evidence; buckets each finding by disposition; applies only the operato
Ready to connect★ 91
- View details
magpie-security-issue-import-via-forwarderSkillSecurity
Optional sub-skill of `security-issue-import`, `security-issue-invalidate`, and `security-issue-sync` that handles the *relay/forwarder* case: a report that did not arrive directly from the reporter but was relayed onto `<security-list>` by an upstream broker (the ASF security team, a third-party di
Ready to connect★ 91
- View details
magpie-security-issue-triageSkillSecurity
For each open `<tracker>` issue carrying the `needs triage` label, read body + comments and classify the candidate disposition into one of six classes: VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID / PROBABLE-DUP / FIX-ALREADY-PUBLIC. On user confirmation, posts a triage-proposal comment that invit
Ready to connect★ 91
- View details
magpie-security-model-prepareSkillSecurity
Front door for a project that has no published security model yet. Opens the conversation with `<governance-body>` on the private list, drives production of a first draft — delegating the model-writing itself to the Alpha-Omega threat-model skill set — in **draft-first** mode so maintainers react to
Ready to connect★ 91
- View details
magpie-security-model-updateSkillSecurity
Refresh an existing security model from what has actually happened since it was written. Mines the decision history — `<tracker>` dispositions with their stated reasons, reporter correspondence on `<security-list>`, published advisories and the project's canned responses — then maps each outcome ont
Ready to connect★ 91
- View details
magpie-security-model-verifySkillSecurity
Pre-flight check on a project's published security model, run per repository in scope. Verifies two things — (1) **discoverability**: an agent can mechanically reach the model by following `AGENTS.md` → `SECURITY.md` → model at a named commit, and (2) **completeness**: the model covers the minimum-b
Ready to connect★ 91
- View details
magpie-security-tracker-stats-dashboardSkillSecurity
Generate a self-contained HTML dashboard of `<tracker>` repository statistics for security-team review.
Ready to connect★ 91
- View details
magpie-workflow-security-auditSkillSecurity
Read-only GitHub Actions workflow security audit for one repository, an explicit repository set, or a whole GitHub org. Runs `zizmor` to surface injection vulnerabilities, excessive permissions, unpinned external actions, and self-hosted-runner fork-secret leaks. Produces a grouped, prioritised find
Ready to connect★ 91
- View details
arch-designSkillSecurity
System-design thinking before any doc or code: goals/non-goals, back-of-envelope numbers, components and contracts, failure modes, operability, security, trade-offs. Use for "design this system", "architecture for X", "trade-offs for X", "how should we architect", "API design", "data model for", "se
Ready to connect★ 91
- View details
evo-druid-cve-patchSkillSecurity
Patches Apache Druid 0.20.0 for CVE-2021-25646 - a JavaScript injection vulnerability where empty-string keys in JSON payloads can override server-side JavaScriptConfig to enable arbitrary code exe...
Ready to connect★ 91
- View details
evo-spring-boot-jakarta-migrationSkillSecurity
Migrate a Java 8/Spring Boot 2.7 project to Java 21/Spring Boot 3.2 with comprehensive handling of namespace changes, security config, Hibernate 6, JJWT 0.12.x, and RestClient migration.
Ready to connect★ 91
- View details
aif-ciSkillSecurity
Generate CI/CD pipeline (GitHub Actions / GitLab CI) with linting, static analysis, tests, security. Use when user says "ci", "setup ci", "github actions", "gitlab ci", "pipeline".
Ready to connect★ 90
- View details
aif-reviewSkillSecurity
Perform code review on staged changes or a pull request. Checks for bugs, security issues, performance problems, and best practices. Use when user says "review code", "check my code", "review PR", or "is this code okay". Optional +check flag validates findings via a fresh-context subagent.
Ready to connect★ 90
- View details
swedish-payrollSkillSecurity
Swedish payroll (lön & arbetsgivaravgifter) compliance reference. Covers AGI filing, social security contributions (sociala avgifter, 31.42%), tax withholding/tax tables (skatteavdrag/skattetabeller), fringe benefit taxation (förmånsbeskattning: car/meals/wellness), accrued vacation pay liability (s
Ready to connect★ 90
- View details
ai-assist-security-auditSkillSecurity
16-dimension security posture assessment with adaptive activation, health scoring, and remediation plan. Covers application security, infrastructure, auth, crypto, privacy, supply chain, and more. Use when assessing security posture, auditing code for vulnerabilities, reviewing compliance, or prepar
Ready to connect★ 89
- View details
f-securitySkillSecurity
Apply Security First with a security lens who inspects this repo as a data analyst. Use when the user types /f-security or /f security.
Ready to connect★ 89
- View details
ck:gitSkillSecurity
Git operations with conventional commits. Use for staging, committing, pushing, PRs, merges. Auto-splits commits by type/scope. Security scans for secrets.
Ready to connect★ 88
- View details
ck:researchSkillSecurity
Research technical solutions, analyze architectures, gather requirements thoroughly. Use for technology evaluation, best practices research, solution design, scalability/security/maintainability analysis.
Ready to connect★ 88
- View details
cve-auditSkillSecurity
Audit exact npm dependency versions against OSV through Runx native HTTP and emit replay-verified evidence with no unverified findings.
Ready to connect★ 87
- View details
dev-dependency-managementSkillSecurity
Guides dependency management across languages and ecosystems. Use when choosing package managers, lockfiles, update policy, security scanning, SBOMs, or monorepo patterns.
Ready to connect★ 87
- View details
flutter-dart-code-reviewSkillSecurity
Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.
Ready to connect★ 87
- View details
github-syncSkillSecurity
Read or synchronize bounded GitHub issues, threads, and pull requests through the local authenticated gh CLI or any compatible hosted connector, with scoped authority and readback.
Ready to connect★ 87
- View details
native-mcpSkillSecurity
Use OpenAEON's MCP-oriented workflow safely: prefer the bundled mcporter skill for ad-hoc MCP discovery, schema inspection, authentication, daemon management, and direct tool calls.
Ready to connect★ 87
- View details
perl-securitySkillSecurity
Comprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies.
Ready to connect★ 87
- View details
qa-security-testingSkillSecurity
Builds automated security testing pipelines for SAST, DAST, SCA, secret scanning, and containers. Use when integrating scanners into CI or managing security regression gates.
Ready to connect★ 87
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
54,764 of the 55,196 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.