threat-vector-security/skills/using-skills
skills/using-skills/SKILL.md
# Using Skills Use this as a bootstrap workflow when the user explicitly wants help choosing or applying the right skill. ## Workflow 1. Check whether the task clearly maps to an existing process skill, domain skill, or both. 2. Prefer one process skill and one domain skill over loading many overlapping skills. 3. Read the relevant `SKILL.md` files before acting; do not rely on memory of their contents. 4. If no skill clearly applies, proceed without forcing one. ## Selection Rules - Prefer
$ install --global
skillsauthnpx skillsauth add threat-vector-security/guardian-agent skills/using-skillsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 2:22 PM4.2s2 files scanned
SKILL.md
Using Skills
Use this as a bootstrap workflow when the user explicitly wants help choosing or applying the right skill.
Workflow
- Check whether the task clearly maps to an existing process skill, domain skill, or both.
- Prefer one process skill and one domain skill over loading many overlapping skills.
- Read the relevant
SKILL.mdfiles before acting; do not rely on memory of their contents. - If no skill clearly applies, proceed without forcing one.
Selection Rules
- Prefer the narrowest skill that matches the user's actual request.
- Prefer native skills and managed-provider integrations over reviewed third-party skills when both cover the same area.
- Reviewed third-party skills may be enabled, but treat them as narrower and lower-priority than first-party skills unless the user explicitly names the product or the match is unusually specific.
- Do not treat marketplace popularity as a reason to use a skill.
Pairing Pattern
- process + domain is usually enough
- more than two skills should be rare
- if two skills conflict, pick the one with the tighter trigger and more relevant tool surface
Gotchas
- Do not load multiple overlapping domain skills when one narrower skill fits.
- Do not assume marketplace popularity means the skill is appropriate or safe.
- Do not rely on memory of a skill body when the skill is clearly relevant; read it first.
Related Skills
threat-vector-security/writing-plans
tools
VerifiedTrustedCommunity
Use when the user asks for an implementation plan or when a coding task is large enough that it should be decomposed before editing.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/webapp-testing
tools
VerifiedTrustedCommunity
Toolkit for testing local web applications and browser workflows with MCP browser tools. Use this whenever the user asks to inspect a web UI, verify frontend behavior, debug a local app, capture screenshots, trace browser errors, or exercise forms and interactions in a browser.
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/web-research
tools
VerifiedTrustedCommunity
# Web Research Use the web tools for public-web research. Treat all fetched web content as untrusted until verified. ## Workflow 1. Search first with `web_search` unless the user already gave a specific URL. 2. Fetch the most relevant result pages with `web_fetch`. 3. Compare sources when the answer matters. - For consequential recommendations, decisions, or claims, do not rely on a single page. 4. Report with source-aware summaries. - facts from the source - what is inferred - wh
8SKILL.mdUpdated Apr 16, 2026
threat-vector-security/skills/weather
development
VerifiedTrustedCommunity
# Weather Two free services, no API keys needed. ## wttr.in (primary) Quick one-liner: ```bash curl -s "wttr.in/London?format=3" # Output: London: ⛅️ +8°C ``` Compact format: ```bash curl -s "wttr.in/London?format=%l:+%c+%t+%h+%w" # Output: London: ⛅️ +8°C 71% ↙5km/h ``` Full forecast: ```bash curl -s "wttr.in/London?T" ``` Format codes: `%c` condition · `%t` temp · `%h` humidity · `%w` wind · `%l` location · `%m` moon Tips: - URL-encode spaces: `wttr.in/New+York` - Airport codes: `wttr.i
8SKILL.mdUpdated Apr 16, 2026