security-audit

Agent Skills is a curated skill registry and npm-based CLI for extending AI coding agents such as Claude Code, Cursor, Copilot, and Antigravity with packaged instructions, templates, and reference files. The CLI fetches a catalog, lets users search and select skills, caches downloads locally, and installs them to selected agents by copying or symlinking them at global or project scope; it also supports updating, removing, auditing, and managing cached skills. The repository describes the catalog as an open-source, human-curated library with CI static analysis, content hashing, lockfiles, path isolation, symlink guards, sanitization, audit logging, and Snyk Agent Scan checks. It also includes an MCP server that exposes progressive-disclosure tools for listing, searching, reading, and fetching skill files. The CLI source is MIT-licensed; maintainer-authored skills are generally CC BY 4.0, while third-party skills retain their own licenses.

SkillRadar is open-source discovery, security, ranking, and routing infrastructure for Agent Skills and Codex. It discovers public SKILL.md files, parses their contents, performs conservative static checks for capabilities such as shell commands, dynamic execution, secret access, networking, package installation, filesystem writes, and deployment tooling, then classifies and ranks candidates in a safety-gated registry. D and Blocked candidates are kept audit-only and excluded from automatic routing. Its Codex plugin provides task-to-Top-3 routing, skill search, provenance and safety inspection, and a read-only Skill Budget Doctor. Routing can use a bundled offline registry and returns relevance, SkillRadar score, security grade, provenance, reasons, and match details without executing candidate repositories or depending on live GitHub discovery. The repository includes radar data, a matching system, a router-quality benchmark, a local registry UI, and daily bot-refreshed generated data; it is released under the MIT license.

Agent Skills is an open-source collection of engineering workflows for AI coding agents, developed by Addy Osmani. It packages senior-engineering practices into skills covering the development lifecycle: defining specifications, planning, incremental implementation, testing and debugging, constraints, code review, web-performance auditing, code simplification, and shipping. Slash commands such as /spec, /plan, /build, /test, /review, and /ship activate the corresponding workflows, while skills can also activate automatically based on the work being performed. The /build workflow can generate a plan and implement its tasks in an approved pass, while retaining test-driven verification, individual commits, and pauses for failures or risky steps. It can be installed with the skills CLI or integrated into supported coding agents including Claude Code, Cursor, Codex, Copilot, and Cline.

claude-red is a curated library of offensive-security skills for Claude, maintained by SnailSploit. Each skill is a structured SKILL.md file covering a particular attack surface, including web vulnerabilities, identity systems, wireless, cloud, mobile, IoT, exploit development, fuzzing, reconnaissance, API security, containers, cryptography, privilege escalation, post-exploitation, and AI security. The files are intended to be installed into a Claude Skills environment, where matching skills load on demand from conversational triggers, or they can be supplied manually as system files or project prompts. The repository includes an installation script with category and target options, a skill index, a roadmap, contribution guidance, and a review-oriented skill template. It is distributed under the MIT license and lists authorized red-team engagements, bug-bounty triage, security research, CTF preparation, and operator training as use cases.

Codex Security is an OpenAI CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities in authorized code repositories. It scans directories and codebases, including repository changes, uses AI-assisted analysis to trace attack paths and apply custom threat models, validates findings, and can generate reviewable patches and exports in SARIF, JSON, and CSV formats. The CLI supports CI use with an API key and can stop builds at a selected severity threshold. The package also supports configurable deep scans, worker and subagent counts, time limits, containerized bulk scans, and a preview findings service. The service stores findings and embeddings in SQLite, provides paginated listings and a read-only dashboard, identifies potential duplicates through embedding similarity, and allows completed findings to be published and deduplicated through the CLI or SDK. It requires Node.js 22.13.0 or later and Python 3.10 or later, and can use OpenAI or other documented inference providers.