Policy
Terms
This is a directory of security methodologies written by other people. Read them before you run them, use them only where you have permission, and treat everything here as a starting point rather than an authority.
Authorized testing only
Every skill and loop here describes techniques for testing systems you own or have written permission to test. Running them against anything else is likely a criminal offence in your jurisdiction, and it is your responsibility — not ours and not the author's. Scope and rules of engagement are part of each entry for a reason. By using this site you accept that the consequences of ignoring them are yours.
Details
No warranty
Everything here is provided as-is. We do not guarantee that a skill is correct, current, safe to run, or fit for anything in particular, and we do not guarantee the site stays available. A skill can be wrong, out of date, or plainly bad advice — you are the one deciding to act on it.
What the audits do and do not mean
The verdicts on /audits come from an automated scan looking for a specific, narrow set of problems: hidden characters, embedded credentials, exfiltration sinks, prompt-injection phrasing, and instructions to bypass controls. A passing result means those checks found nothing. It is not a review of whether the methodology is sound, and it is not a safety guarantee.
Who owns what
Skills and loops belong to the people who wrote them. Each is published here with the author's attribution, and any licence in its source repository continues to govern it — check there before you redistribute one.
The catalog lives at securityskills/skills. Submitting a skill or a loop means confirming it is your own work or openly licensed, and that we may publish it here with your attribution.
You are handing these to an agent
A skill is a set of instructions you give a coding agent that acts with your credentials, in your repositories, on your infrastructure. Read one before installing it, the same way you would read a script before running it as root. The raw text of every skill is a click away on its page precisely so you can.
The API
The endpoints under /api are open, need no key, and are documented at openapi.json. Use them, build on them, and cache what you fetch. There is no published rate limit, which is not a promise that abuse will be tolerated: traffic heavy enough to degrade the site for everyone else may be blocked.
Corrections and removal
If something here misattributes your work, is out of date, or should not be listed, tell us and we will fix or unpublish it. Authors can also open a pull request against the catalog directly.
Changes
These terms may change. The date at the top moves when they do, and the full history is in the site repository.