safedep
OrganizationSecurity layer for AI coding agents. Works with Claude Code, Cursor, Windsurf, Gemini CLI, OpenCode, Pi Agent and more.
Categories
Indexed Skills (4)
aarm-policy-layer
Use when working on Gryph's AARM security layer or policy engine. Trigger this whenever the user changes code under aarm/ or cli/policy.go, or works on policy evaluation, the PDP, policy rules, CEL conditions, receipts and the receipt hash chain, receipt signing, the context accumulator, approvals, deferrals, identity capture, data classification, injection scoring, or the self-protection rules. Also trigger on phrases like "policy engine", "policy decision point", "AARM", "receipt chain", "gryph policy", "policy rule", or "context accumulator", even when the user does not name a file.
gryph-policy-authoring
Use when a human wants help to author or change a Gryph security policy that governs what an AI coding agent may do, often with an agent's help. Trigger whenever the user wants Gryph to block, allow, warn on, or require approval for an agent action, wants to write or change a policy rule, asks how to match a tool, command, file path, or URL, works with CEL conditions or context counters, wants to split policy into many files, or wants to dry-run a rule. Also trigger on phrases like "write a gryph policy", "add a policy rule", "make gryph block X", "help me write a policy", or "policy for my agent", even when the user does not name a file. This skill drafts a policy in a workspace directory and hands the user an install command. It never installs the policy and never writes into Gryph's config directory. It is not for changing the policy engine code (use aarm-policy-layer for engine work under aarm/ or cli/policy.go).
add-agent-adapter
Use when adding support for a new AI coding agent to Gryph, or when changing how an existing agent adapter is wired. Trigger this whenever the user wants to integrate a new agent (for example Claude Code, Cursor, Gemini, Codex, Windsurf, or any other tool), add a new adapter package under agent/, wire agent hook events, or asks how adapters detect, install hooks, parse events, or register. Also trigger on phrases like "add a new agent", "support agent X", "new adapter", or "hook up agent X to gryph", even when the user does not say the word "adapter".
safedep
SafeDep protects developers and AI coding agents against malicious open source components. External components are the blindspot: developers and agents can inspect the code they own, not the packages, IDE extensions, Agent Skills, MCP servers, and GitHub repositories they pull in, and every one of those can carry a supply chain attack (Shai-Hulud, Miasma, S1ngularity). The toolset: vet (scan dependencies for malware and known vulnerabilities), PMG (block malicious npm/pip/other packages at install time), gryph (audit what AI coding agents read, write, and execute), xBom (AI- and SaaS-aware bill of materials), plus SafeDep Cloud, Endpoint Hub, and an MCP server for hosted governance and fleet visibility. Use this skill whenever the user wants to secure their dependencies, block or detect malicious packages, scan a repository for vulnerabilities, deploy SafeDep for a team, install or configure vet / PMG / gryph / xBom, monitor developer machines for malicious package installs, investigate package activity or a
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.