Review the repository, its license, and the commit you intend to use. A skill contains instructions that influence an agent, and may contain executable helpers. Avoid automatic updates from a moving branch in a sensitive workflow.
Obtain the repository through your normal Git workflow and check out a reviewed commit. There is no installer that downloads or executes remote code. Specialist skills contain Markdown references; the coordinator also contains an optional local Python evidence utility.
The repository follows the Agent Skills specification:
each directory under skills/ has a SKILL.md with name and description,
plus supporting resources. agents/openai.yaml supplies optional UI metadata.
No tool permission is granted by the package itself.
agents/openai.yaml is optional host metadata. The portable instructions do not
depend on that file, a particular model, vendor-specific substitutions, or a
specific tool API. Equivalent packaging does not establish equivalent reasoning
quality across assistants.
Copy complete skill directories, retaining their names and references. For a comprehensive assessment, install all twelve modules together. A specialist can also be used independently. The main skill reports absent specialist modules and must not pretend that they have been applied.
Locate installed entrypoints through the host registry or the supplied bundle.
The repository's skills/ layout is an example, not the current directory of
every application. Resolve Markdown links from their containing file; resolve
a catalog entry's reference from the installed root named by its skill field.
Use sibling directories only after confirming that the installation retains
the full collection layout. If a resource cannot be opened, state that gap.
| Environment | Integration | Validation status |
|---|---|---|
| Claude Code | Use the skill installation locations described in its official documentation; project skills commonly reside in .claude/skills/. |
Standard file format; no claim of a completed Claude runtime test. |
| Codex | Use the current project or user skill directory documented by your Codex distribution; explicit invocation uses the skill name. | Includes agents/openai.yaml; exact local discovery depends on the host. |
| ChatGPT | Use the supported custom-skill import or authoring workflow in your account when available. A GitHub repository alone does not install a skill into a chat. | Packaging supplied; account-specific installation is outside this repository. |
| DeepSeek-backed coding harness | Configure that harness to load the selected SKILL.md and its referenced files. |
Model-independent instructions; no untested native integration is promised. |
| Other file-aware agents | Supply the selected entrypoint and allow progressive loading of its references. | Requires file access and a suitable context/tool policy. |
Avoid overwriting existing skills with the same names. Compare their revisions first. To update an installation, review the source diff and deliberately replace the selected version through your environment's normal package process.
Some hosts expose $web-security; Claude Code may expose a slash command such
as /web-security. The invocation syntax belongs to the harness. The following
request works conceptually in any file-aware agent when adapted to its syntax:
Read skills/web-security/SKILL.md and apply it to this application's current
revision. Use review mode. Identify trust boundaries, inspect applicable
specialist controls, and report findings with evidence and unverified checks.
For a focused task:
Apply web-security-access-control to the invoice API. Trace authentication,
object ownership, tenant membership, field-level permissions, caches, exports,
and queued work. Propose a targeted correction and regression tests for any
confirmed defect. Do not claim runtime checks that were not performed.
For a Cloudflare build:
Apply web-security in build mode to this Workers application. Include the
configuration skill's Cloudflare profile, R2 object authorization, private
cache behavior, secret bindings, deployment identity, and failure handling.
Implement the authorized changes and record tests and deployment prerequisites.
- Without file access, assess the supplied excerpts and identify their scope. Request a relevant missing excerpt when needed; do not claim repository-wide inspection or invent the contents of a referenced file.
- Without execution, report source-supported findings and proposed checks. Clearly mark those checks as unexecuted; a reasoning walkthrough is not a test run.
- Without network access, use identified bundled or supplied references. State that version-sensitive behavior has not been rechecked against current sources.
- Without Python, use the human-readable report template. The evidence helper is optional and does not determine whether the requested report is finished.
- With limited context, work in bounded passes. Retain the task, source and bundle identities, reviewed controls, evidence locations, unresolved questions, and next scope. Do not silently mark omitted work verified or inapplicable.
No subagent capability is required. A more capable host can automate additional steps, but it must use the same evidence and authorization distinctions.
The skills do not bundle a browser, scanner, package manager, credentials, or production access. Use the tools already available and appropriate to the task. Record missing tools and unavailable evidence. Installation does not authorize live attacks, deployment, third-party scanning, or disclosure of source code.
The optional evidence helper requires Python 3.10 or newer. Its command-line arguments, limits, and output semantics are documented in the evidence format. It can run offline.
Documentation was consulted during authoring. Recheck the relevant product documentation when installation behavior changes; do not infer feature parity between a model, an API, a chat product, and a coding harness.