{
  "markdown": "# Mondoo Skills\n\nA collection of agent skills for [xgrep](https://github.com/mondoohq/xgrep)-powered security work — code inspection, rule authoring, finding triage, and remediation. Compatible with Claude Code, Codex, Gemini CLI, and Cursor.\n\nThe skills in this repository follow the standardized [Agent Skills](https://agentskills.io/home) format.\n\n> [!NOTE]\n> **Looking for the MQL skill?** It lives in the cnspec repository, at\n> [`mondoohq/cnspec/skills`](https://github.com/mondoohq/cnspec/tree/main/skills),\n> next to the policy content it documents. `mondoo-mql` was mirrored here until it\n> fell behind the maintained copy, so it has been removed rather than left to drift\n> further. Install the current skills from cnspec:\n>\n> ```shell\n> /plugin marketplace add mondoohq/cnspec\n> /plugin install mql@cnspec-skills\n> /plugin install policy-graph@cnspec-skills\n> ```\n\n> [!TIP]\n> If your agent doesn't support skills, you can use [`agents/AGENTS.md`](agents/AGENTS.md) directly as a fallback.\n\n## Installation\n\n### Claude Code\n\nInstalling is a **two-step** flow — registering the marketplace makes the skills\n*available*, but each skill is installed individually (opt-in), so you pull only the\nones you want.\n\n1. Register the repository as a plugin marketplace (once):\n\n```shell\n/plugin marketplace add mondoohq/skills\n```\n\n2. Install the skills you want:\n\n```shell\n/plugin install xgrep-inspect@mondoohq/skills\n/plugin install xgrep-rule-creator@mondoohq/skills\n/plugin install xgrep-triage@mondoohq/skills\n/plugin install xgrep-remediate@mondoohq/skills\n/plugin install xgrep-fix@mondoohq/skills\n/plugin install secure-coding@mondoohq/skills\n```\n\nOr run `/plugin` and pick from **Browse plugins** interactively. Adding the marketplace\nalone does **not** install anything — if `/plugin install …@mondoohq/skills` reports\n*\"Marketplace not found\"*, run step 1 first.\n\nFrom a shell, the same works non-interactively with the `claude` CLI:\n\n```shell\nclaude plugin marketplace add mondoohq/skills\nclaude plugin install xgrep-triage@mondoohq/skills\n```\n\n### Codex\n\n1. Copy or symlink skills from this repository's `skills/` directory into one of Codex's standard `.agents/skills` locations (e.g., `$REPO_ROOT/.agents/skills` or `$HOME/.agents/skills`) as described in the [Codex Skills guide](https://developers.openai.com/codex/skills/).\n\n2. Once available, Codex will discover the skill and load the `SKILL.md` instructions automatically.\n\n3. If your Codex setup still relies on `AGENTS.md`, use the generated [`agents/AGENTS.md`](agents/AGENTS.md) file as a fallback bundle.\n\n### Gemini CLI\n\nInstall locally:\n\n```shell\ngemini extensions install . --consent\n```\n\nOr use the GitHub URL:\n\n```shell\ngemini extensions install https://github.com/mondoohq/skills.git --consent\n```\n\nSee [Gemini CLI extensions docs](https://geminicli.com/docs/extensions/#installing-an-extension) for more help.\n\n### Cursor\n\nThis repository includes Cursor plugin manifests:\n\n- `.cursor-plugin/plugin.json`\n- `.cursor-plugin/marketplace.json`\n\nInstall from repository URL or local checkout via the Cursor plugin flow.\n\n## Usage\n\nThe skills automatically activate when working on relevant tasks. You can also invoke them directly:\n\n```shell\n/xgrep-triage\n/xgrep-rule\n```\n\n## Available Skills\n\n<!-- BEGIN_SKILLS_TABLE -->\n| Name | Description | Documentation |\n|------|-------------|---------------|\n| `secure-coding` | Secure coding guidance for AI agents - proactively avoid generating vulnerable code patterns across 7 languages | [SKILL.md](skills/secure-coding/SKILL.md) |\n| `xgrep-fix` | Fix a whole set of xgrep findings — or just the triage-confirmed true positives in a findings.json — in one pass through the verify/apply harness | [SKILL.md](skills/xgrep-fix/SKILL.md) |\n| `xgrep-inspect` | Navigate and understand source code using xgrep's AST-powered code intelligence | [SKILL.md](skills/xgrep-inspect/SKILL.md) |\n| `xgrep-remediate` | Fix a confirmed xgrep finding safely using the verify/apply harness — apply deterministic fixes, author and verify assisted fixes against the fix contract, and surface advisory guidance | [SKILL.md](skills/xgrep-remediate/SKILL.md) |\n| `xgrep-rule-creator` | Create custom xgrep rules for detecting security vulnerabilities and code patterns with test-first methodology | [SKILL.md](skills/xgrep-rule-creator/SKILL.md) |\n| `xgrep-triage` | Investigate and classify xgrep scan findings using code graph analysis | [SKILL.md](skills/xgrep-triage/SKILL.md) |\n<!-- END_SKILLS_TABLE -->\n\n## What's Included\n\n### xgrep Skills\n\nA set of skills built on [xgrep](https://github.com/mondoohq/xgrep), Mondoo's fast,\nSemgrep-compatible SAST scanner, for security review and remediation workflows:\n\n- **`xgrep-inspect`** - Navigate and understand source code using xgrep's AST-powered code intelligence\n- **`xgrep-rule-creator`** - Create custom xgrep rules with a test-first methodology, or port rules to new languages\n- **`xgrep-triage`** - Investigate and classify scan findings using code-graph analysis\n- **`xgrep-remediate`** - Fix a confirmed finding safely using xgrep's verify/apply harness\n- **`xgrep-fix`** - Fix a whole set of findings — or the true positives a triage report confirmed — in one pass\n- **`secure-coding`** - Proactively avoid generating vulnerable code across 7 languages\n\nThese skills drive the `xgrep` CLI; install it from the\n[xgrep repository](https://github.com/mondoohq/xgrep) to use them.\n\n## Releasing\n\nAll skills share one version, and you decide when it moves by merging a release\nPR.\n\n1. **Actions → Prepare Release**, pick `patch`, `minor`, or `major` (or type an\n   explicit version like `2.0.0` or `2.0.0-rc.1`). Tick **dry run** first to see\n   the computed version and release notes in the job summary without pushing\n   anything.\n2. It opens a **`chore: release vX.Y.Z`** PR with every manifest stamped, the\n   `CHANGELOG.md` section written, and `agents/AGENTS.md` plus the README table\n   regenerated. Review the diff — editing the notes here changes what the\n   release page says.\n3. **Merge it.** That is the release. `release.yml` sees the version change on\n   `main`, mints the `vX.Y.Z` tag, and publishes the GitHub Release from\n   `CHANGELOG.md`. No tag push, nothing else to run.\n\nA version with a hyphen (`2.0.0-rc.1`) publishes flagged as a pre-release, so it\nnever becomes the repo's *Latest release*.\n\nAfterwards, anyone with a skill installed picks it up with:\n\n```shell\nclaude plugin update <skill>@mondoo-skills\n```\n\n> [!IMPORTANT]\n> **Never edit a version by hand.** `claude plugin update` compares the version\n> in a skill's `plugin.json` and skips the copy when it hasn't changed, so a\n> version that doesn't move leaves everyone who installed the skill on old\n> content indefinitely. `./scripts/publish.sh --check` fails if any manifest's\n> version drifts from the root, and CI runs it on every pull request.\n\n## License\n\nApache-2.0\n",
  "bytes": 6914,
  "sha": "22c899761e7bc25ed2995d4390fffbfe679e717594bace6eaef81f662997cf35",
  "repo_slug": "mondoohq/skills",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_mondoohq_skills_0b99f96e/readme"
}