Colophon
About
securityskills.sh is a directory of agent skills for security and compliance work — penetration testing, bug bounty, application security, cloud and container audits, forensics, malware analysis, and audit readiness.
The phase model
Most skill directories sort by topic. Security work does not happen by topic — it happens in sequence. Every skill here carries a second tag: where in an engagement you reach for it. Categories tell you the domain; phases tell you the moment.
- Recon01
Map the surface before touching it — assets, exposure, and intent.
browse → - Exploit02
Prove reachability and impact against an in-scope target.
browse → - Harden03
Close what the previous phase opened — config, code, and policy.
browse → - Respond04
Contain, collect, and reconstruct once something has already happened.
browse → - Attest05
Turn the work into evidence an auditor or a program will accept.
browse →
Coverage map
14 of 65 cells mapped — claim a gap →
Where the registry is deep and where it is open. Hollow cells are the roadmap, not padding.
Details
What a skill is
A directory containing a SKILL.md — YAML frontmatter (name, description, optionally phase, author, company, contact) followed by markdown instructions. Coding agents such as Claude Code, Codex, Cursor, and OpenCode load a skill automatically when a task matches its description.
Install commands
Every skill page exposes a direct-download URL (/api/skills/<slug>/raw) that the skills CLI accepts as a source, so npx skills add <url> installs one skill without cloning anything. npx skills use <url> runs it once without installing.
Relationship to vercel-labs/skills
The backend logic of this site — SKILL.md frontmatter parsing, catalog-layout discovery, and metadata sanitization — is adapted from the MIT-licensed vercel-labs/skills CLI. The frontend, the phase model, and the coverage matrix are built independently for a security-first directory.
Responsible use
These skills describe methodologies for authorized security testing. Running them against systems you do not own or lack written permission to test is illegal in most jurisdictions. Scope, rules of engagement, and cleanup are part of every skill for a reason — and submissions without that framing are not merged.