Install AgentProof agent skills

Add AgentProof skills to Claude Code, Codex, Cursor and other coding agents. Run production audits and local Next.js, Postgres and Supabase audits.

BY AGENTPROOF 9 NOV 2026

AgentProof skills teach your coding agent how to test an app for security problems. There are two kinds.

Remote audits use AgentProof's own agents. Your coding agent asks AgentProof to test your live website, then reads the findings back to you. Remote audits need an AgentProof account and the AgentProof MCP server.

Local audits run inside your coding agent, against your code and a local or staging copy of your app. They write tests for each problem they find, fix it, and keep the test so the problem cannot come back. Local audits do not need an AgentProof account.

The skills

The skills
Skill	Kind	What it does
`agentproof`	Remote	Connects the AgentProof MCP server and uses its tools: account, members, runs, reports and findings.
`agentproof-production-audit`	Remote	Runs an AgentProof audit of your live website and summarizes the findings by severity.
`nextjs-security-audit`	Local	Checks a Next.js app: sign-in checks in route handlers and Server Actions, secrets in `NEXT_PUBLIC_` variables, and known vulnerable versions.
`postgres-security-audit`	Local	Checks a Postgres database and the code that queries it: roles and grants, row-level security, unsafe functions and SQL built from strings.
`supabase-security-audit`	Local	Checks a Supabase project: row-level security on every table, service role keys in client code, storage policies and Edge Function sign-in.

Install with the skills command

The skills command works with Claude Code, Codex, Cursor and many other coding agents. It needs Node.js.

Install every skill:

npx skills add GravyPouch/agentproof-skills

Install one skill:

npx skills add GravyPouch/agentproof-skills --skill nextjs-security-audit

See the skills before you install them:

npx skills add GravyPouch/agentproof-skills --list

Install in Claude Code

Add the AgentProof marketplace, then install the plugin you want:

/plugin marketplace add GravyPouch/agentproof-skills
/plugin install agentproof-remote-audits@agentproof-skills
/plugin install agentproof-local-audits@agentproof-skills

The remote audits plugin also adds the AgentProof MCP server. The local audits plugin adds no server and sends nothing to AgentProof.

Use a skill

Ask your agent in plain words. For example:

"Run an AgentProof audit of https://example.com."
"Audit this Next.js app for security problems."
"Check our Supabase tables for missing row-level security."

Local audits only test code and systems you own or have written permission to test. They use a local or staging copy by default and ask before they connect to anything. Each finding goes in a security-findings/ folder with the evidence, the fix and the test that proves it.

Source

The skills are open source under the MIT license at github.com/GravyPouch/agentproof-skills.