Agent skills

Agent skills teach an AI agent (Cursor, Claude Code, Codex and others that read the Agent Skills format) how to use VulnGraph well: which tool to call for a question, how to work the plan the way a developer would, and what to do when something fails. They sit on top of the MCP server and the API.

Skills

Skill	Use it to
vulngraph-connect	Get an API key with the right scopes, connect over MCP or HTTP, verify
vulngraph-ask	Answer questions about vulnerabilities, services, packages, CVEs, changes and trend
vulngraph-remediate	Work the plan in waves, one PR per repository, and record step status
vulngraph-decide	Choose an option on Decide steps with a recorded reason, or escalate
vulngraph-debug	Fix 401/403/404/429, stale or truncated answers and MCP connection issues

Install

The skills CLI (Node.js 22.20 or later) finds the skills on this site and copies them into your agent's skills folder:

# All skills, for all your projects, in Cursor and Claude Code
npx skills add https://docs.vulngraph.igentify.in -g -a cursor -a claude-code

# See what is available
npx skills add https://docs.vulngraph.igentify.in --list

# One skill only, in the current project
npx skills add https://docs.vulngraph.igentify.in --skill vulngraph-ask

Add -y to skip the prompts. Update later with npx skills update. With -g the CLI keeps one copy in ~/.agents/skills (Cursor reads it there) and links it into ~/.claude/skills for Claude Code.

Without Node.js, download the bundle and unpack it into the skills folder of your agent (~/.claude/skills for Claude Code, ~/.cursor/skills for Cursor):

mkdir -p ~/.claude/skills
curl -fsSL https://docs.vulngraph.igentify.in/agent-skills/vulngraph-agent-skills.tar.gz | tar -xz -C ~/.claude/skills

Before you use them

1. Create an API key. Read-only questions need findings:read; the plan needs plans:read and sketches:read; recording progress needs step-status:write; Decide choices need decisions:write. vulngraph-connect has the full table by role.
2. Add the MCP server to your agent with the key in an environment variable, never in the config file. vulngraph-connect walks through Cursor and Claude Code.
3. Ask in plain words, for example "How are we doing on vulnerabilities?", "Are we affected by CVE-2021-44228?" or "Work through the next wave of the plan for HIGH and open the PRs."

Raw files

File	What it is
/.well-known/agent-skills/index.json	Discovery index (one archive per skill, with a SHA-256 digest)
/.well-known/skills/index.json	Older index format that lists each skill's files
/.well-known/skills/<skill>/SKILL.md	Each skill's instructions, for example vulngraph-ask
/agent-skills/vulngraph-agent-skills.tar.gz	Every skill in one archive, for a manual install

Agents that read /llms.txt also find the list of skills there.