Prevent · Agent Skills

Security guidance and checks, built into code generation.

A coding agent writes the change but follows none of your policy. Heeler Agent Skills give it the safe version and your rules first, then check its work before commit, with the same engine your CI runs.

What Heeler Agent Skills give your agent

The safe choice before it writes. A verdict before it commits.

Some skills guide the agent before it writes. Others check the change and return a verdict, so it fixes what fails in the same session.

GUIDANCE AND CHECKS ON THE CHANGEWHAT THE AGENT DOES WITH ITSecretschecked live with the providerDependenciesCVEs, malicious packages, safe versionsLicenses and package ageagainst your allowed set and policyCode and IaCtaint and misconfigurations, Heeler SASTAgent attack surfaceprompt injection and tool misuseAgent Skillsrun the Heeler CLI,return a verdictCoding agentClaude Code · CursorCodex · VS CodeWRITE IT SECURERight from the first lineFlaws caught, safe versions, allowed licensesKEEP THE DEVELOPER SAFENo surprises at the PRLive keys and malicious packages stoppedHELP FIX ITHand off, don't hand-editReplace or pin what fails, then a ship call
Before you set policyNo policy yet: a judgment you can act on. With one: pass or fail.
Release review

A ship decision before every release.

The same checks across the whole repository, plus the risks a scan cannot see.

1 · SCANEvery check aboveacross the whole repositoryHeeler SAST seeds the code review2 · REVIEWThen what scans missOutbound request abuse (SSRF)Supply chain and buildRepository operationsAgent attack surfaceCritical and High: path, evidence and fix3 · DECIDEreadyready with conditionsnot readya hard gate where you have policy
Why not just let the agent handle it?

Answered from your live data and policy, not training data and a best guess.

A skill checks current data against your policy and returns the same verdict every time.

Coding agent alone
Coding agent with Heeler
Is this package safe?
Training data with a cutoff date
Current vulnerability and malicious-package data
Which version?
Whatever the model remembers
One your repos run: no open CVEs, not malicious, allowed license, past minimum age
Is the license allowed?
A guess about your policy
Checked against your allowed set
Is that key live?
Unknown unless tested by hand
Checked with the provider: live or inactive
Across the team
Depends on model, prompt and person
One verdict, from the CLI engine your CI runs
What it costs without Heeler

Every check skipped now costs more later.

Without skills, checks are done by hand, skipped, or left for CI.

Developer time

Without HeelerManual scans, reports and license lookups.

With HeelerThe agent runs the check and reports.

Tokens in the context window

Without HeelerFull scanner reports pasted into the chat.

With HeelerThe verdict and fix, detail only on findings.

Agent reasoning

Without HeelerGuessed versions and licenses, then rework.

With HeelerTrusted versions, your allowed set, first time.

Fixes that come late

Without HeelerLive keys and bad packages fail CI, fixed after review.

With HeelerFixed in the session that introduced it.

Team rollout

Commit the skills once. Every clone of the repo has them.

Skills live in the repo, so the whole team gets the same checks.

Same checks for the whole team

Versioned with the code, there on clone.

Whichever agent they use

Claude CodeCursorCodexOpenCodeVS Code

Says what is missing

No CLI or sign-in? It stops and gives the fix. Never a false pass.

For example, in the repo
npx @sentry/dotagents add Heeler-Security/heelercli --all
Where it fits

Checked while the agent writes, not after the build fails.

Skills check the change as the agent writes it, with the engine that guards commit and CI. Hover a layer to explore it.

Workstation Sensor →PromptTool callsshell · skills · MCPDiffSecret in a promptDangerous actionInjected instructionWORKSTATION SENSOR · AS THE AGENT ACTSWorkstation Sensor →Heeler CLI →CommitCommit blockedHEELER CLIHeeler CLI →PR Guardrails →Pull requestthe merge gateGated at mergePR GUARDRAILSPR Guardrails →Coding agentClaude Code · Codex · CursorOpenCode · VS Code (Copilot)Guided as it writesMCP · AGENT SKILLSYOU ARE HERE
Purpose-built for the AI SDLC

Put security guidance and checks where the code gets written.