Skills.
Give your AI a better way to work.
A skill is a set of written instructions that teaches an AI how to do one job the way it should be done: review a pull request, plan a migration, write the release notes.
Install one here and it travels with your account into Claude, Claude Code, Cursor and every other client you sign in with.
Category: Security
1,833 results · page 54 of 62
- View details
deps-upgradeSkillSecurity
Use when dependency upgrades need tiered batches for CVEs, a major release, forced compatibility, scheduled hygiene, a pre-release lockfile audit, or a cadence-driven or vulnerability-triggered sweep. Classifies each update on a risk ladder, verifies it, or defers it with a reason. Not for PR queue
Ready to connect
- View details
f-star-effectful-verificationSkillSecurity
Use when effectful, security-sensitive code needs refinement-typed, SMT-backed verification in F*, in the HACL* or Project Everest style.
Ready to connect
- View details
gutenberg-block-editor-securitySkillSecurity
Use when building dynamic blocks or block-editor features - a render_callback, server-side rendered blocks via ServerSideRender, REST-backed block data, or register_rest_field for the editor. Sanitizes block attributes per type, escapes server render output, sets a real permission_callback on editor
Ready to connect
- View details
http-api-ssrf-preventionSkillSecurity
Use when a plugin or theme makes outbound HTTP requests with the WordPress HTTP API - wp_remote_get, wp_remote_post, wp_remote_request - especially when any part of the URL comes from user input, options, or webhooks. Uses wp_safe_remote_* with wp_http_validate_url, allowlists hosts, blocks internal
Ready to connect
- View details
mcp-best-practicesSkillSecurity
Build, harden, and debug production MCP servers with the TypeScript SDK. Use when writing or reviewing an MCP server or its tools - picking a transport, designing tool schemas and results, handling errors, adding OAuth, cutting token bloat, or migrating SDK versions. Also covers MCP Apps, extensions
Ready to connect
- View details
mobile-security-coderSkillSecurity
Gives your agent expert guidance on writing secure mobile code, covering input validation and WebView safety.
Ready to connect
- View details
multisite-securitySkillSecurity
Use when writing code that runs on a WordPress multisite network - switch_to_blog, network admin pages, get_sites, or capabilities that differ between site and network scope. Uses manage_network / manage_network_options and is_super_admin correctly, restores context with restore_current_blog, isolat
Ready to connect
- View details
nonces-csrf-protectionSkillSecurity
Use when handling any form submission, AJAX request, admin-post action, settings page, link that triggers an action, or any other user-initiated request in a WordPress plugin or theme. Generates nonces with wp_nonce_field / wp_create_nonce and verifies them with check_admin_referer, check_ajax_refer
Ready to connect
- View details
oauth-providersSkillSecurity
Debug OAuth sign-in failures and add new OAuth providers to Keating (web + CLI). Use when a provider's "Sign in with …" flow fails, when adding a new OAuth provider, or when changing redirect URIs, token exchange, or refresh behavior.
Ready to connect
- View details
object-injection-deserializationSkillSecurity
Use when code calls unserialize, maybe_unserialize, or stores serialized PHP in options, meta, or transients from untrusted input. Avoids unserialize on attacker-controlled data, prefers json_encode / json_decode, and when unserialize is unavoidable passes ['allowed_classes' => false]. Prevents PHP
Ready to connect
- View details
odylith-security-hardeningSkillSecurity
Apply Odylith security-hardening guidance to bounded product changes.
Ready to connect
- View details
output-escapingSkillSecurity
Use when echoing or printing any dynamic value in WordPress PHP or templates — into HTML, attributes, URLs, inline JavaScript, or textareas. Escapes at the point of output with esc_html, esc_attr, esc_url, esc_js, esc_textarea, or wp_kses_post, including the i18n variants (esc_html__, esc_attr_e). P
Ready to connect
- View details
pr-prepSkillSecurity
Use when creating a pull request for this project - triggers on "open a PR", "create a PR", "gh pr create", or any request to open/create a PR. Commits pending work, runs parallel CGU + security checks, writes a French PR description, then creates the PR with confirmation.
Ready to connect
- View details
privy-integrationSkillSecurity
Integrates Privy authentication, embedded wallets, and agent payment protocols into web and agentic apps. Covers React SDK (PrivyProvider, hooks, wagmi), Node.js SDK, smart wallets (ERC-4337), x402 and MPP machine payments, Tempo chain, and agentic wallets with policies. Use when setting up Privy au
Ready to connect
- View details
rest-api-securitySkillSecurity
Use when registering WordPress REST API routes with register_rest_route or building custom endpoints. Sets a real permission_callback (never __return_true for writes), defines args with sanitize_callback and validate_callback, enforces capabilities and per-object checks, and escapes any HTML in resp
Ready to connect
- View details
security-auditing-code-reviewSkillSecurity
Use when auditing or code-reviewing an existing WordPress plugin or theme for security issues, triaging a vulnerability report, or hardening inherited code. Provides a systematic methodology — locate trust boundaries, inventory sensitive sinks, trace their controls and data flows, then triage confir
Ready to connect
- View details
security-headers-cspSkillSecurity
Use when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors), Referrer-Policy, Permissions-Policy, HSTS, Secure/HttpOnly/SameSite cookie flags, or CORS on REST responses. C
Ready to connect
- View details
settings-options-securitySkillSecurity
Use when building an options or settings page with the WordPress Settings API - register_setting, add_settings_field, settings_fields, an options.php form, or update_option / get_option on plugin data. Attaches a sanitize_callback to every setting, gates the page with manage_options, relies on Setti
Ready to connect
- View details
shortcode-block-securitySkillSecurity
Use when registering a shortcode with add_shortcode or a dynamic block with a render_callback, or processing shortcode / block attributes. Normalizes attributes with shortcode_atts, validates against allowlists, and escapes all rendered output for its context with esc_html, esc_attr, esc_url, or wp_
Ready to connect
- View details
skill-doctorSkillSecurity
Use when a user wants agent setup graded from conversation history. Produces an HTML report with 0-10 scores, evidence-cited findings, and ranked suggestions. Not for skill fixing — use skill-improver; not for security scanning — use skill-scanner.
Ready to connect
- View details
woocommerce-securitySkillSecurity
Use when a plugin extends WooCommerce - reading or writing orders, customer data, or hooking checkout, REST, or the Store API. Sanitizes input with wc_clean, gates shop actions with WooCommerce capabilities like edit_shop_orders, minimizes stored payment data, and escapes customer PII on output. Pre
Ready to connect
- View details
wp-cli-securitySkillSecurity
Use when registering a WP-CLI command with WP_CLI::add_command or writing command logic. Validates and sanitizes positional and associative arguments, does not assume a logged-in user or capability context, avoids printing secrets, and confirms destructive operations. Prevents injection and unsafe a
Ready to connect
- View details
bugbountyrulesSkillSecurity
Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, v
Ready to connect
- View details
dependency-rebase-rulesSkillSecurity
Guidelines for working with rebase rules related to package.json dependencies, versions, and overrides. Covers CVE pins, version conflict detection, and package-lock.json handling. Referenced by rebase, fix-rebase-rules, validate-rebase-rules, and add-rebase-rules skills.
Ready to connect
- View details
github-issuesSkillSecurity
Read, summarize, and triage GitHub issues and pull requests for a repository using the authenticated GitHub MCP server. Invoke whenever the user asks about open issues, wants a repo's issues summarized or triaged, asks to find issues by label or author, or asks to draft an issue.
Ready to connect
- View details
ai-generated-business-code-reviewSkillSecurity
Use when reviewing or scoring AI-generated business/application code quality in any language, especially when a numeric score, risk level, or must-fix checklist is requested, or when C++ code must comply with OpenHarmony C++ and security standards
Ready to connect
- View details
api-integrationSkillSecurity
Integrate with external APIs using REST clients, webhook consumers, SDK wrappers, and polling patterns with proper authentication, error handling, and retry logic.
Ready to connect
- View details
arkweb-committer-reviewSkillSecurity
ArkWeb Committer code review. Reviews code quality, architecture compliance, security, and performance risks from a Committer's perspective. Runs as an independent subagent. Trigger words: 代码检视, Committer review, 代码审查.
Ready to connect
- View details
arkweb-security-patch-conflictSkillSecurity
Resolve ArkWeb patch merge conflicts while preserving upstream security fix intent.
Ready to connect
- View details
arkweb-security-patch-fetchSkillSecurity
Fetch and normalize the exact upstream Chromium security patch for ArkWeb integration.
Ready to connect
What is a skill?
A skill is plain text, usually a SKILL.md file and the scripts it refers to, written for an AI rather than for a person. It carries the steps, the house rules and the examples a good answer needs, so you stop pasting the same briefing into every new chat.
55,111 of the 55,543 skills listed here can be served through ahel today, and they come from public repositories. Each one has its own page with the instructions themselves on it, so you can read what a skill will tell your AI to do before you install it.
Install one and every AI you use gets it
Installing a skill adds it to your gateway and turns it on in the same step. Claude Code surfaces it as a slash command; any client can read the full instructions with the skill_read tool.
Nothing is copied into a project folder. The instructions are served from your account, so the same skill is there in every AI you connect, and turning it off removes it from all of them at once.