Back to the catalog

mondoo-skills

xgrep security skills for Claude Code and other agents

Open source Open in the app JSON README (API)

About

xgrep security skills for Claude Code and other agents

Details

Kind
Plugins
Topic
No topic detected
Publisher
mondoohq
Origin
gemini
Category
ferramentas
Version
1.0.1
Last push
2026-09-05T05:53:26Z
Repository state
ativo
Language
TypeScript
License
Apache-2.0
Added
2026-08-30 14:13:39
Updated
2026-09-07 21:05:29
Origin id
mondoohq/skills

README

# Mondoo Skills

A collection of agent skills for [xgrep](https://github.com/mondoohq/xgrep)-powered security work — code inspection, rule authoring, finding triage, and remediation. Compatible with Claude Code, Codex, Gemini CLI, and Cursor.

The skills in this repository follow the standardized [Agent Skills](https://agentskills.io/home) format.

> [!NOTE]
> **Looking for the MQL skill?** It lives in the cnspec repository, at
> [`mondoohq/cnspec/skills`](https://github.com/mondoohq/cnspec/tree/main/skills),
> next to the policy content it documents. `mondoo-mql` was mirrored here until it
> fell behind the maintained copy, so it has been removed rather than left to drift
> further. Install the current skills from cnspec:
>
> ```shell
> /plugin marketplace add mondoohq/cnspec
> /plugin install mql@cnspec-skills
> /plugin install policy-graph@cnspec-skills
> ```

> [!TIP]
> If your agent doesn't support skills, you can use [`agents/AGENTS.md`](agents/AGENTS.md) directly as a fallback.

## Installation

### Claude Code

Installing is a **two-step** flow — registering the marketplace makes the skills
*available*, but each skill is installed individually (opt-in), so you pull only the
ones you want.

1. Register the repository as a plugin marketplace (once):

```shell
/plugin marketplace add mondoohq/skills
```

2. Install the skills you want:

```shell
/plugin install xgrep-inspect@mondoohq/skills
/plugin install xgrep-rule-creator@mondoohq/skills
/plugin install xgrep-triage@mondoohq/skills
/plugin install xgrep-remediate@mondoohq/skills
/plugin install xgrep-fix@mondoohq/skills
/plugin install secure-coding@mondoohq/skills
```

Or run `/plugin` and pick from **Browse plugins** interactively. Adding the marketplace
alone does **not** install anything — if `/plugin install …@mondoohq/skills` reports
*"Marketplace not found"*, run step 1 first.

From a shell, the same works non-interactively with the `claude` CLI:

```shell
claude plugin marketplace add mondoohq/skills
claude plugin install xgrep-triage@mondoohq/skills
```

### Codex

1. Copy or symlink skills from this repository's `skills/` directory into one of Codex's standard `.agents/skills` locations (e.g., `$REPO_ROOT/.agents/skills` or `$HOME/.agents/skills`) as described in the [Codex Skills guide](https://developers.openai.com/codex/skills/).

2. Once available, Codex will discover the skill and load the `SKILL.md` instructions automatically.

3. If your Codex setup still relies on `AGENTS.md`, use the generated [`agents/AGENTS.md`](agents/AGENTS.md) file as a fallback bundle.

### Gemini CLI

Install locally:

```shell
gemini extensions install . --consent
```

Or use the GitHub URL:

```shell
gemini extensions install https://github.com/mondoohq/skills.git --consent
```

See [Gemini CLI extensions docs](https://geminicli.com/docs/extensions/#installing-an-extension) for more help.

### Cursor

This repository includes Cursor plugin manifests:

- `.cursor-plugin/plugin.json`
- `.cursor-plugin/marketplace.json`

Install from repository URL or local checkout via the Cursor plugin flow.

## Usage

The skills automatically activate when working on relevant tasks. You can also invoke them directly:

```shell
/xgrep-triage
/xgrep-rule
```

## Available Skills

<!-- BEGIN_SKILLS_TABLE -->
| Name | Description | Documentation |
|------|-------------|---------------|
| `secure-coding` | Secure coding guidance for AI agents - proactively avoid generating vulnerable code patterns across 7 languages | [SKILL.md](skills/secure-coding/SKILL.md) |
| `xgrep-fix` | Fix a whole set of xgrep findings — or just the triage-confirmed true positives in a findings.json — in one pass through the verify/apply harness | [SKILL.md](skills/xgrep-fix/SKILL.md) |
| `xgrep-inspect` | Navigate and understand source code using xgrep's AST-powered code intelligence | [SKILL.md](skills/xgrep-inspect/SKILL.md) |
| `xgrep-remediate` | Fix a confirmed xgrep finding safely using the verify/apply harness — apply deterministic fixes, author and verify assisted fixes against the fix contract, and surface advisory guidance | [SKILL.md](skills/xgrep-remediate/SKILL.md) |
| `xgrep-rule-creator` | Create custom xgrep rules for detecting security vulnerabilities and code patterns with test-first methodology | [SKILL.md](skills/xgrep-rule-creator/SKILL.md) |
| `xgrep-triage` | Investigate and classify xgrep scan findings using code graph analysis | [SKILL.md](skills/xgrep-triage/SKILL.md) |
<!-- END_SKILLS_TABLE -->

## What's Included

### xgrep Skills

A set of skills built on [xgrep](https://github.com/mondoohq/xgrep), Mondoo's fast,
Semgrep-compatible SAST scanner, for security review and remediation workflows:

- **`xgrep-inspect`** - Navigate and understand source code using xgrep's AST-powered code intelligence
- **`xgrep-rule-creator`** - Create custom xgrep rules with a test-first methodology, or port rules to new languages
- **`xgrep-triage`** - Investigate and classify scan findings using code-graph analysis
- **`xgrep-remediate`** - Fix a confirmed finding safely using xgrep's verify/apply harness
- **`xgrep-fix`** - Fix a whole set of findings — or the true positives a triage report confirmed — in one pass
- **`secure-coding`** - Proactively avoid generating vulnerable code across 7 languages

These skills drive the `xgrep` CLI; install it from the
[xgrep repository](https://github.com/mondoohq/xgrep) to use them.

## License

Apache-2.0

More