Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,840 results · page 38 of 62
- View details
shopifySkillSecurity
Build Shopify applications, extensions, and themes using GraphQL/REST APIs, Shopify CLI, Polaris UI components, and Liquid templating. Capabilities include app development with OAuth authentication, checkout UI extensions for customizing checkout flow, admin UI extensions for dashboard integration,
Ready to connect★ 85
- View details
suspicious-login-triageSkillSecurity
Use when triaging anomalous or suspicious user authentication events,
Ready to connect★ 85
- View details
url-get-gti-reportSkillSecurity
Use when retrieving GTI threat classification and URL category intelligence.
Ready to connect★ 85
- View details
url-get-secops-threat-intelSkillSecurity
Use when querying SecOps threat intelligence indicators for a specific
Ready to connect★ 85
- View details
apache-druid-securitySkillSecurity
Security patching for Apache Druid - covers JavaScript execution vulnerabilities, sampler endpoint protection, and filter validation patterns.
Ready to connect★ 83
- View details
cvss-score-extractionSkillSecurity
Extract CVSS (Common Vulnerability Scoring System) scores from vulnerability data sources with proper fallback handling. This skill covers understanding CVSS v3, handling multiple score sources (NVD, GHSA, RedHat), implementing source priority logic, and dealing with missing scores in security repor
Ready to connect★ 83
- View details
druid-javascript-rceSkillSecurity
Apache Druid JavaScript RCE vulnerability (CVE-2021-25646) fix via @JacksonInject hardening and constructor validation.
Ready to connect★ 83
- View details
druid-javascript-securitySkillSecurity
Securing Apache Druid's JavaScript execution engine against code injection and security bypass attacks.
Ready to connect★ 83
- View details
gohighlevel-stingerSkillSecurity
GoHighLevel API authority - OAuth vs Private Integration Tokens, contacts/opportunities/calendars, inbound/outbound webhooks, rate limits, Marketplace apps. Use for GoHighLevel/HighLevel integration.
Ready to connect★ 83
- View details
jackson-inject-securitySkillSecurity
Preventing Jackson @JacksonInject override attacks where JSON input can replace server-side injected values.
Ready to connect★ 83
- View details
jackson-injection-securitySkillSecurity
Security considerations for Jackson @JacksonInject - preventing JSON input from overriding injected values, covering CVE patterns and defense strategies.
Ready to connect★ 83
- View details
java-patch-workflowSkillSecurity
Workflow for creating and applying patches to Java projects - diff format, patch application, and Maven rebuilds for security fixes.
Ready to connect★ 83
- View details
trivy-vulnerability-scanningSkillSecurity
Use Trivy vulnerability scanner in offline mode to detect CVEs in npm dependencies and generate structured JSON reports.
Ready to connect★ 83
- View details
laravelSkillSecurity
Use when building or extending a Laravel 11/12 app — Eloquent models, migrations and relationships, routing with controllers and Form Requests, queues and background jobs, framework-native security (validation, mass-assignment, policies, signed URLs, rate limiting), and Pest/PHPUnit feature tests. N
Ready to connect★ 82
- View details
b0SkillSecurity
Delegate tasks to AI agents via Box0. Use when the user asks to review code, check security, run tests, compare tools, get multiple perspectives, research a topic, analyze data, write docs, or any task that could benefit from specialized or parallel execution. Also use when the user mentions agent n
Ready to connect★ 81
- View details
elixir-security-reviewSkillSecurity
Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.
Ready to connect★ 81
- View details
liveview-code-reviewSkillSecurity
Reviews Phoenix LiveView code for lifecycle patterns, assigns/streams usage, components, and security. Use when reviewing LiveView modules, .heex templates, or LiveComponents.
Ready to connect★ 81
- View details
remix-v2-meta-sessions-reviewSkillSecurity
Reviews Remix v2 code for v1-shape meta exports (BREAKING in v2), cookie security gaps (httpOnly, secure, secrets rotation), auth gates in wrong layer, and missing CSRF. Use when reviewing meta/SEO, session, auth, or form-mutation code in a Remix v2 codebase.
Ready to connect★ 81
- View details
review-planSkillSecurity
Review implementation plans for parallelization, TDD, types, libraries, and security before execution
Ready to connect★ 81
- View details
wish-ssh-code-reviewSkillSecurity
Reviews Wish SSH server code for proper middleware, session handling, and security patterns. Use when reviewing SSH server code using charmbracelet/wish.
Ready to connect★ 81
- View details
ctf-kitSkillSecurity
Use when the user is solving an authorized CTF / lab reverse-engineering challenge focused on Windows application authentication or license-check bypass. Guides triage → static analysis → dynamic experiment planning → bypass verification, with strong evidence discipline and VM safety boundaries. NOT
Ready to connect★ 79
- View details
iterative-converging-auditSkillSecurity
Run any "find all instances of X" sweep — a security audit, a safety audit, a code review, a research question, a compliance check — as an iterative loop that does NOT stop at one pass. Audit → fix → RE-audit → … until a clean pass returns zero NEW discoveries. Use whenever thoroughness matters and
Ready to connect★ 79
- View details
repo-scanSkillSecurity
Use when the user wants to evaluate a GitHub repository before installing, running, forking, or depending on it. Takes a GitHub repo URL, cleans tracking params, shallow-clones to /tmp, inspects dependency/supply-chain risk, static vulnerability patterns, issue-reported security problems, maintainer
Ready to connect★ 79
- View details
secret-setupSkillSecurity
Focused micro-skill for secret management setup. Explains options, guides through Bitwarden installation/login/unlock, configures backend. Exits when done.
Ready to connect★ 79
- View details
spec-convergeSkillSecurity
Iteratively review an instar-development spec with multi-angle internal reviewers (security, scalability, adversarial, integration, decision-completeness, lessons-aware) and real cross-model external reviewers routed through the agent's own installed CLIs (codex → GPT-tier, gemini → Gemini-tier; one
Ready to connect★ 79
- View details
specsfy-specialist-application-securitySkillSecurity
Model threats and review security of applications, APIs, authentication, authorization, data, dependencies, secrets, and infrastructure. Use for changes involving trust boundaries, identity, external input, sensitive data, or security review; also use for threat modeling before a feature with no
Ready to connect★ 79
- View details
specsfy-specialist-code-reviewSkillSecurity
Reviews diffs, branches, and PRs for contract compliance, correctness, security, architecture, tests, and operational risk, reporting findings by severity with location and evidence. Use when the user asks for a code review, a second opinion on a change, or a risk assessment of a diff; read-only exc
Ready to connect★ 79
- View details
access-control-policy-designSkillSecurity
USE THIS SKILL whenever any topic related to access control, authorization, permissions, or security policy arises in any form. Triggers include — but are not limited to: RBAC, ABAC, PBAC, ACL, DAC, ReBAC, Zanzibar, OPA, Cedar, Casbin, SpiceDB, OpenFGA, Permify, Oso, Cerbos, Permit.io; any mention o
Ready to connect★ 78
- View details
acl-securitySkillSecurity
Create and debug ServiceNow ACLs (record, field, REST, script-include). Covers role/condition/script patterns, which ACL names can apply to a table or field, field-level visibility, and impersonation testing for row- and field-level security.
Ready to connect★ 78
- View details
ai-governanceSkillSecurity
Design and operate an organization's AI governance system: define governance principles, operating models and decision rights, risk frameworks, lifecycle gates, and fairness, transparency, privacy, security, regulatory, and board-oversight controls. Use when standing up a governance program, tiering
Ready to connect★ 78
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
54,764 of the 55,196 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.