Sechelix

Evidence-first application-security audit workflow for authorized repositories and environments. Use when reviewing a codebase, pull request, API, web application, AI-generated code, agent or MCP integration, cloud configuration, authorization (BOLA, IDOR, BFLA), business logic, payments, race conditions, secrets, supply chain, or release readiness for security weaknesses. Also supports explicitly requested technical SEO audits and evidence-backed codebase cleanup. Maps trust boundaries, selects applicable checks, runs parallel specialist review, independently verifies every material finding a

1 starsAI, LLMs & Agents

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add omarmohelal/SecHelix --skill sechelix

Manual install

git clone --depth 1 https://github.com/omarmohelal/SecHelix.git /tmp/SecHelix
mkdir -p ~/.claude/skills
cp -r /tmp/SecHelix/skills/sechelix ~/.claude/skills/sechelix

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# SecHelix

SecHelix is a portable AppSec review workflow for **authorized** systems. Treat every scanner/model output as a hypothesis until evidence supports it.

## Optional quality workflows

Only when the user explicitly asks for them: an SEO audit (`references/seo-audit.md`) or codebase
cleanup (`references/codebase-cleanup.md`; it defines the combined order if both are requested).
They produce separate quality reports, never security findings or a security `PASS`. Run the
security phases below whenever a security audit is also requested.

## Non-negotiable rules

1. Work only on repositories, applications, accounts, and environments the operator owns or is explicitly authorized to test.
2. Default to `STATIC` or `LOCAL` mode. Never turn a code-review request into uncontrolled internet scanning.
3. Do not use destructive payloads, credential theft, persistence, denial-of-service, malware, or data exfiltration as verification methods.
4. In production, prefer read-only evidence and safe proof. If a test could mutate money, identity, inventory, authorization, external providers, or customer data, require explicit authorization or move the proof to local/staging fixtures.
5. Losing integrity through a security test is itself a security failure. Preserve evidence, auditability, and rollback.
6. A scanner alert is not a vulnerability. A model suspicion is not a vulnerability. Two models agreeing is not independent proof.

Read the full skill on GitHub

Details

Skill name: sechelix
Repository: omarmohelal/SecHelix
Path: skills/sechelix/SKILL.md
License: Apache-2.0
Repo updated: 30 October 2026
Listed in: karanb192/awesome-claude-skills

FAQ

What does the Sechelix skill do?

How do I install the Sechelix skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add omarmohelal/SecHelix --skill sechelix. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Is Sechelix popular?

It lives in omarmohelal/SecHelix, which has 1 GitHub stars and 0 forks, and is included in 1 curated skill list.

Related skills

Skill Freshness

kvozianov/skill-freshness

Use this skill first whenever the user asks about the health of their installed agent skills: auditing, checking, cleaning up, updating or de-duplicating skills in ~/.claude/skills, ~/.codex/skills, ~/.agents/skills or plugin folders, or finding skills that are broken (missing CLI or script), outdated versus upstream, duplicated across agents, or made redundant by built-in features like /loop or /schedule. Do not inspect skill folders by hand: this skill ships a scanner that covers every agent (Claude Code, Codex, Cursor, Gemini CLI, Copilot, OpenCode, Antigravity), maps which agent loads each

AI, LLMs & AgentsIn 1 list

Rule Architect

moveju112/rule-architect

Use when a project needs AI agent rules built or upgraded — no AI_RULES.md exists, an existing rule index has grown into one bloated file, or the user asks for a project rule set. Triggers on "make rules for this project", "generate AI rules", "set up project rules", "upgrade the project rules", "rule-architect", "/rule-architect", and the Korean equivalents "룰 만들어줘", "룰 생성", "AI 룰 만들어", "프로젝트 룰 고도화", or refreshing rules after a major refactor ("--update"). English and Korean triggers are equivalent.

AI, LLMs & AgentsIn 1 list

Stipend

stipend-sh/stipend

A non-custodial USDC wallet on Base that an AI agent installs by itself, with spending limits enforced in the signing path rather than in a prompt. Receive payments, pay HTTP 402 / x402 charges automatically, and answer whether you are worth running. No account and no API key: the only approval needed is from the person who runs you.

AI, LLMs & AgentsIn 1 list

Moodtrip Hotel Search

adiny/moodtrip-hotel-search

Search, compare, evaluate, and hand off hotel bookings using the MoodTrip.ai MCP server (api.moodtrip.ai). Use this skill whenever the user mentions hotels, accommodation, lodging, stays, travel bookings, hotel search, hotel comparison, hotel reviews, hotel pricing, or anything related to finding or booking a place to stay. Also trigger when the user asks about hotel amenities, room types, check-in/check-out logistics, travel destinations with accommodation needs, or says things like "find me a hotel", "where should I stay", "book a room", "hotel recommendations", or "compare hotels". This ski

AI, LLMs & AgentsIn 1 list

Aeo Check

pchewlo/aeo-check

Run aeo-check on a website's code (or a live URL) to find answer engine optimisation problems that stop ChatGPT, Claude, Perplexity, Gemini and Google AI Overviews from crawling, understanding, citing or buying from the site, then fix them. Use when asked to check or improve AEO, GEO, AI search visibility, llms.txt, robots.txt for AI crawlers, structured data, or agent readiness.

AI, LLMs & AgentsIn 1 list

Gedik

onur-kesim/gedik

Breaks your own code, artifacts, and configuration like an attacker to find gedik — so they can be closed. First MEASURES the architecture (triage T1-T12), then opens only that architecture's surface - A client/offline/mobile (Android, iOS) · B server/API/DB/identity (injection variants, IDOR, OAuth/MFA, CORS, webhook, rate limiting, business logic, WebSocket, GraphQL, request smuggling, fail-open) · C BaaS-RLS (Supabase/Firebase, PostgREST) · D AI/LLM (prompt injection, tool authorization, vector/embedding, MCP) · E shipped-artifact hygiene - plus code review + mechanical scanning, dependency

AI, LLMs & AgentsIn 1 list

Browse the most popular Claude skills, all ai, llms & agents skills, or write your own with the skills generator.