Verified skills for AI coding agents
Skills, rules, subagents and commands for Claude Code, Codex and Cursor. The Verified seal means a version passed structure, compatibility and security checks — and is pinned to the exact commit you can review.
npx @denofy/cli add <package>Works with your coding agent
How it works
From search to installed in a minute
Denofy does the reviewing busywork so you can see at a glance what a package does before your agent uses it.
- Step 1
Find
Search skills, Cursor rules, AGENTS.md snippets, subagents and slash commands by tool, type and category.
- Step 2
Check
Every version has a public verification report: structure, compatibility and a security scan with file and line.
- Step 3
Install
One command. The CLI detects Claude Code, Codex or Cursor, checks the tarball hash and installs to the right folder.
Popular packages
Be the first to publish a skill
Why Verified?
Know what your agent is about to run
Skills can contain scripts and instructions your agent follows blindly. Every version on Denofy is checked before it gets a seal.
Structure
Required files and frontmatter, valid names and descriptions, links that resolve, size limits.
Compatibility
The package can be installed for every tool it declares, in the format that tool expects.
Security
Static scan for remote code execution, secret exfiltration, prompt injection and risky scripts — context-aware.
Pinned and immutable
Each version points at an exact Git commit and a tarball hash. The CLI re-checks both before installing.
commit-helper
v1.4.0
Structure
SKILL.md with valid frontmatter, all links resolve
Compatibility
Claude Code · Codex · Cursor install targets OK
Security
25 rules · 0 findings above low
1 informational finding
SKILL.md:42 · unknown-url · low
Verified
All checks pass, no finding above low.
CLI: Installs directly.
Warning
Installable, but with medium/high findings or new risks since the last version.
CLI: Shows the findings and asks first.
Failed
Broken structure, an incompatible tool or a critical security finding.
CLI: Refuses unless you explicitly confirm.
For authors
Publish once, reach every agent
Import from GitHub in a few clicks. Denofy verifies every version, hosts an immutable tarball and gives you a page your users can trust.
A seal users trust
Show the Verified badge in your README. Users see the report before they install.
Privacy-friendly analytics
Installs, page views, tools and versions — aggregated, no cookies, no IP addresses.
Reach every agent
One package, installable for Claude Code, Codex and Cursor. Publish on every push via webhook.
FAQ
Questions, answered
What is Denofy?
Denofy is a registry for skills and extensions for AI coding agents: Agent Skills, Cursor rules, AGENTS.md snippets, subagents and slash commands. Every version is verified and pinned to a Git commit.
What does the Verified seal mean?
The version passed all automated checks: correct structure, compatible with the tools it declares, and no security finding above low. The full report is public on every package page. How we verify
Does Verified mean a package is safe?
It is a strong signal, not a guarantee. Read what a skill does before you let your agent use it — especially if it runs scripts. The CLI verifies the tarball hash and re-runs the checks on your machine before installing.
Which tools are supported?
Claude Code, OpenAI Codex and Cursor today. The CLI detects which one your project uses and installs to the right folder. More agents will follow.
How do I install a package?
Run npx @denofy/cli add <package> in your project. Add --tool to pick a tool or --global for a user-wide install. See the CLI reference.
How do I publish my own skill?
Sign in with GitHub, choose a repository and path, and Denofy imports, verifies and publishes it. A webhook can publish every new version automatically. Publishing guide
Is Denofy free? Does it track me?
Browsing, installing and publishing public packages is free. Denofy sets no tracking cookies; install counts are anonymous aggregates and CLI telemetry can be turned off with DENOFY_TELEMETRY=0. Privacy policy
Give your agent skills you can trust
Browse verified packages or publish your own in minutes.