{"openapi":"3.1.0","info":{"title":"securityskills.sh API","version":"1.0.0","summary":"Security agent skills catalog","description":"A curated directory of agent skills for security and compliance: pentest, bug bounty, appsec, cloud, forensics, and audit readiness.\n\nSkills are plain markdown documents. Fetch the catalog index to discover slugs, then fetch a skillraw to install it with the `skills` CLI.\n\nPage URLs also support `Accept: text/markdown` content negotiation (acceptmarkdown.com) and respond with `Vary: Accept`.","license":{"name":"MIT","identifier":"MIT"},"contact":{"name":"Catalog repository","url":"https://github.com/securityskills/skills"}},"servers":[{"url":"https://securityskills.vercel.app","description":"Production"}],"tags":[{"name":"catalog","description":"Discover and fetch skills"},{"name":"counters","description":"Copy counts for skills and loops"}],"paths":{"/api/skills":{"get":{"tags":["catalog"],"operationId":"listSkills","summary":"List every published skill","description":"Returns the full catalog with slugs, taxonomy, and a ready-to-run install command for each skill.","responses":{"200":{"description":"The catalog index.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SkillIndex"}}}}}}},"/api/skills/{slug}/raw":{"get":{"tags":["catalog"],"operationId":"getSkillRaw","summary":"Fetch a skill as raw SKILL.md","description":"Returns the verbatim SKILL.md, frontmatter included — the machine-readable path for agents and scripts. Humans are pointed at the GitHub source instead.","parameters":[{"$ref":"#/components/parameters/Slug"}],"responses":{"200":{"description":"The SKILL.md document.","content":{"text/markdown":{"schema":{"type":"string"},"example":"---\nname: ssrf-hunting\ndescription: Find and exploit Server-Side Request Forgery…\n---\n\n# SSRF Hunting\n"}}},"404":{"$ref":"#/components/responses/NotFound"}}},"head":{"tags":["catalog"],"operationId":"headSkillRaw","summary":"Check a skill exists without fetching it","parameters":[{"$ref":"#/components/parameters/Slug"}],"responses":{"200":{"description":"The skill exists."},"404":{"description":"No such skill."}}}},"/api/installs":{"get":{"tags":["counters"],"operationId":"getInstallCounts","summary":"Read copy counts","description":"A copy count is the number of times someone copied an install command or a loop prompt — not a number of observed installations, which we cannot see because installs go straight from the user to GitHub. No ranking is published from it. With no parameters, every count; with both, one.","parameters":[{"$ref":"#/components/parameters/InstallKind"},{"name":"slug","in":"query","required":false,"description":"Skill or loop identifier. Requires `kind`.","schema":{"type":"string"},"example":"ssrf-hunting"}],"responses":{"200":{"description":"Counts, keyed by slug, or a single count.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/InstallCounts"},{"$ref":"#/components/schemas/InstallCount"}]}}}},"400":{"$ref":"#/components/responses/InvalidRequest"}}},"post":{"tags":["counters"],"operationId":"recordInstall","summary":"Record one copy","description":"What the copy buttons on this site call. A number is incremented and nothing else is stored — no address, no session, no visitor identifier — so no copy can be traced back to anyone. Unknown slugs are rejected rather than counted.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["kind","slug"],"properties":{"kind":{"type":"string","enum":["skill","loop"]},"slug":{"type":"string","example":"ssrf-hunting"}}}}}},"responses":{"200":{"description":"The count after the increment.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/InstallCount"}}}},"400":{"$ref":"#/components/responses/InvalidRequest"}}}}},"components":{"parameters":{"Slug":{"name":"slug","in":"path","required":true,"description":"Skill identifier, matching its catalog directory name.","schema":{"type":"string","pattern":"^[a-z0-9]+(?:-[a-z0-9]+)*$"},"example":"ssrf-hunting"},"InstallKind":{"name":"kind","in":"query","required":false,"description":"Which register the slug belongs to. Requires `slug`.","schema":{"type":"string","enum":["skill","loop"]}}},"responses":{"InvalidRequest":{"description":"The parameters or body did not name a published skill or loop.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"The requested resource does not exist.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Skill":{"type":"object","required":["slug","name","description","category","phase","url","raw","install"],"properties":{"slug":{"type":"string","example":"ssrf-hunting"},"name":{"type":"string"},"description":{"type":"string","description":"When an agent should reach for this skill."},"category":{"type":"string","example":"web-appsec"},"group":{"type":"string","description":"Optional sub-grouping within the category.","example":"server-side"},"phase":{"type":"string","enum":["recon","exploit","harden","respond","attest"],"description":"Where in an engagement the skill applies."},"path":{"type":"string","description":"Catalog-relative directory."},"url":{"type":"string","format":"uri"},"raw":{"type":"string","format":"uri"},"install":{"type":"string","example":"npx skills add https://github.com/owner/repo --skill ssrf-hunting"},"updatedAt":{"type":"string","format":"date-time","description":"Last commit touching the skill directory. Absent when catalog history is unavailable."},"author":{"type":"string"},"company":{"type":"string"}}},"SkillIndex":{"type":"object","required":["site","count","skills"],"properties":{"site":{"type":"string","format":"uri"},"count":{"type":"integer","minimum":0},"skills":{"type":"array","items":{"$ref":"#/components/schemas/Skill"}}}},"InstallCounts":{"type":"object","required":["skills","loops"],"properties":{"skills":{"type":"object","additionalProperties":{"type":"integer","minimum":0}},"loops":{"type":"object","additionalProperties":{"type":"integer","minimum":0}}}},"InstallCount":{"type":"object","required":["kind","slug","count"],"properties":{"kind":{"type":"string","enum":["skill","loop"]},"slug":{"type":"string"},"count":{"type":"integer","minimum":0}}},"Error":{"type":"object","required":["error"],"properties":{"error":{"type":"object","required":["code","message","hint","docs"],"properties":{"code":{"type":"string","enum":["skill_not_found","route_not_found","invalid_request","method_not_allowed","not_acceptable","internal_error"]},"message":{"type":"string"},"hint":{"type":"string","description":"Actionable next step."},"docs":{"type":"string","format":"uri"},"details":{"type":"object","additionalProperties":true}}}}}}},"externalDocs":{"description":"Agent guide","url":"https://securityskills.vercel.app/llms.txt"}}