A collection of security skills
Overview
Security skills for AI coding agents — distilled from real security work on codebases that serve 100M+ users a week. Each skill ships in the open Agent Skills format and loads automatically when the agent hits a relevant task. They turn the model itself into the auditor: encoded rules and offline scanners, not another service to wire up. superagent : configure MCP, context hooks, and signed webhooks safely Use it when you want to connect Cursor, Claude Code, Codex CLI, or another MCP client to Superagent, enforce Context Guardrails through coding-agent hooks, set up signed webhook notifications, troubleshoot the connection, inspect findings and reports, scan context, check Contributor Trust, or manage Runtime Guardrails. This is an explicit, opt-in remote integration.
README
Security Skills
Security skills for AI coding agents — distilled from real security work on codebases that serve 100M+ users a week.
Each skill ships in the open Agent Skills format and loads automatically when the agent hits a relevant task. They turn the model itself into the auditor: encoded rules and offline scanners, not another service to wire up.
Skills
Install
# everything
npx skills add superagent-ai/skills
# or pick one
npx skills add superagent-ai/skills --skill superagent -a cursor -y
npx skills add superagent-ai/skills --skill hacker -a cursor -y
npx skills add superagent-ai/skills --skill redteam-autoresearch -a cursor -y
npx skills add superagent-ai/skills --skill ci-cd-security -a cursor -y
npx skills add superagent-ai/skills --skill repo-security-posture -a cursor -y
npx skills add superagent-ai/skills --skill skill-security -a cursor -y
npx skills add superagent-ai/skills --skill authz-security -a cursor -y
npx skills add superagent-ai/skills --skill recon-security -a cursor -y
npx skills add superagent-ai/skills --skill supply-chain-security -a cursor -y
npx skills add superagent-ai/skills --skill security-disclosure-triage -a cursor -y
npx skills add superagent-ai/skills --skill vulnerability-triage -a cursor -y
npx skills add superagent-ai/skills --skill crypto-secrets -a cursor -y
npx skills add superagent-ai/skills --skill infra-security -a cursor -y
Once installed, skills load on their own when a task matches — nothing to remember or invoke by hand.
Migration: Use --skill hacker for the offensive engagement framework.
Repo layout
skills/
superagent/ SKILL.md (opt-in Superagent MCP integration)
hacker/ SKILL.md + references/ (instruction-only engagement framework)
redteam-autoresearch/ SKILL.md + references/ + scripts/ (red-team autoresearch harness)
ci-cd-security/ SKILL.md + references/
repo-security-posture/ SKILL.md + references/ + scripts/ (GitHub repo posture collector)
skill-security/ SKILL.md + scripts/ (scanner) + rules/ (YARA) + references/
authz-security/ SKILL.md + references/
recon-security/ SKILL.md + references/
supply-chain-security/ SKILL.md + references/
security-disclosure-triage/ SKILL.md
vulnerability-triage/ SKILL.md + references/
crypto-secrets/ SKILL.md + scripts/ (scanner) + references/
infra-security/ SKILL.md + scripts/ (scanner) + references/
A skill is a SKILL.md (the agent’s instructions) plus optional references/, scripts/, and rules/.
Contributing
New skills and rule improvements are welcome — see CONTRIBUTING.md. The bar is a real security problem the model gets wrong by default, encoded as durable rules that run offline.
License
Released under the MIT License.
Recommended Tools
Try a different keyword or remove a filter.
Install
npx skillfish add superagent-ai/skills