Frequently Asked Questions

Skills are reusable capabilities for AI agents. They provide procedural knowledge that helps agents accomplish specific tasks more effectively — here, security and compliance methodologies: how to run a pentest phase, scope PCI DSS, triage malware, review a Dockerfile, and so on. Each skill is a SKILL.md file with YAML frontmatter plus markdown instructions.

Two ways. For the whole catalog: npx skills add securityskills/skills installs all of them at once. For a single skill, copy the command from its page — each one is a direct raw URL. Either way the CLI writes plain markdown into your agent's skills directory.

77 at last count — Claude Code, Codex, Cursor, OpenCode, Windsurf, GitHub Copilot, Gemini CLI, Droid, Kimi, Cline, Amp, Zed and many more. They follow a shared Agent Skills specification, and the CLI auto-detects which ones you have installed. The agents reference lists every one with its -a id and install path. Note that GLM / Zhipu is not currently supported by the CLI.

Run npx skills update to pull the latest versions of your installed skills. New installs always fetch the current contents. Update tracking is strongest for GitHub-backed sources — the lockfile records the source and its tree hash for comparison.

No. The site collects no personal data. Download counting is anonymous and aggregate-only. The CLI's optional telemetry is separate and can be disabled with DISABLE_TELEMETRY=1 — see the CLI reference.

Create a directory with a SKILL.md containing a name and description in the frontmatter, followed by markdown instructions for the agent. Write the description as when to use this, not as a summary — that is the text an agent matches a task against. Then submit via the submission form.

skills/<category>/<skill>/SKILL.md, or skills/<category>/<group>/<skill>/SKILL.md where a category has an axis worth splitting — cloud providers, container runtimes, compliance frameworks. Adding a provider is just adding a folder; the site picks it up at build time and turns it into a filter. Both shapes can coexist in one category.

Skills are maintained by their respective authors. Open an issue on github.com/securityskills/skills and it will be routed to the maintainer. Attribution is shown on each skill page.

Skills are instruction documents, not executables — nothing runs unless your agent acts on it. Every submission is reviewed for responsible-use framing (authorized testing only), and the catalog is audited. Still, read a skill before installing it, as you would any code or prompt you feed an agent.