GETTING STARTED

Use it with any agent

Security Skills is plain Markdown — there is no runtime to install. You give an agent read access to the skills/ folder and its operating guide, and it loads the right skill for each task on its own. Below is the one-minute setup for the common agents.

# Three commands to your first engagement

1

Clone the repo and run the installer once — it exposes the skills to Claude Code everywhere and puts the secskills command on your PATH.

git clone https://github.com/NoorQureshi/security-skills
cd security-skills
./secskills install
2

Scaffold a workspace for your target anywhere you like. The folder gets the skills and operating guide wired in, so it's self-contained — it doesn't have to live inside the repo.

secskills new acme.com ~/work/acme  # or just: secskills new acme.com
cd ~/work/acme

Put your authorized targets in scope.txt, then open your agent here.

claude          # or: opencode · codex · gemini

Want to see the agent's plan and live activity while it works? Run secskills watch — it opens a read-only console in your browser and runs in the background, so this terminal stays free (secskills watch --stop to stop).

3

Just describe the task — the matching skill loads itself and works the loop (recon → attack → report).

# say to the agent:
Start an authorized assessment of acme.com.
Confirm scope, then recon the attack surface.

See a full session, annotated →

# Per-agent setup

Claude Code

git clone https://github.com/NoorQureshi/security-skills
cd security-skills
claude

Or expose the skills to every project once:

cd security-skills
./install.sh   # --project · --uninstall

Codex / Gemini / other CLI agents

git clone https://github.com/NoorQureshi/security-skills
cd security-skills
codex        # or: gemini

They read AGENTS.md automatically. For a one-off, paste a single SKILL.md into the chat.

Local models (Ollama)

Bake the operating guide into a model so it always knows the method:

printf 'FROM qwen2.5-coder:14b\nSYSTEM """%s"""' \
  "$(cat AGENTS.md)" > Modelfile
ollama create security-skills -f Modelfile
ollama run security-skills

Any other agent / framework

Point it at the repo with read access to skills/ and AGENTS.md, or load the one SKILL.md for the task at hand. There is nothing else to wire up.

Full per-agent guide (USING.md) →

# Before you run it

Authorized use only. The first skill every engagement loads is tradecraft-scope-roe. Security Skills acts only inside a confirmed envelope — a signed pentest scope, a bug-bounty program you are in scope for, or systems you own. If scope is unclear it stops and asks. Read the full rule →

← BackHome Next →Skills