Installation

Install the skill

SecHelix is distributed as an Agent Skill. The recommended path is the cross-client Agent Skills CLI, which copies the self-contained bundle into the host location your agent already reads.

The installed bundle carries the methodology, the 546-item catalog, the specialist role profiles, the JSON schemas, the evidence adapters, the report renderer, and the public policy examples. It contains no references to a parent repository, so it works after a copy install.

Per-host paths

Claude Code

Standard Agent Skill discovery, or a project-local copy under .claude/skills/sechelix/. The repository also ships a Claude Code plugin manifest for packaged team use.

OpenAI Codex

Use .agents/skills/sechelix/ for repository-local discovery, or the portable bundle. SecHelix deliberately does not ship a repo-local .codex/skills/ mirror because that is not the documented repository discovery path.

GitHub Copilot / VS Code agents

Read .github/skills/sechelix/SKILL.md, or install the portable source with the Agent Skills CLI.

Cursor, Gemini CLI, GLM, OpenCode

Use the cross-client installer where supported, otherwise point the host loader at the vendor-neutral skills/sechelix/ bundle.

git clone https://github.com/omarmohelal/SecHelix.git
claude --plugin-dir ./SecHelix

mkdir -p .claude/skills
cp -R skills/sechelix .claude/skills/sechelix

Compatibility matrix

SecHelix separates format compatibility from model compatibility. A model does not need a SecHelix-specific API; it needs a coding-agent host that can load the skill or the equivalent files. Statuses below mirror the framework's docs/reference/compatibility.md and are never upgraded from documentation alone.

Portable fallback

If a coding agent has no native skill loader:

• Place skills/sechelix/ in the repository.
• Point the agent at skills/sechelix/SKILL.md.
• Use AGENTS.md for repository-level instructions.
• Keep scanner, browser, and database tooling outside the model-specific methodology.

This preserves one SecHelix workflow instead of maintaining incompatible prompts for every model vendor. It also keeps the safety contract identical across hosts, which matters because the contract is what makes the output comparable.

Verify the install

From a clone of the framework repository, the bundled validation scripts confirm catalog identity, schema conformance, the standalone install bundle, and secret hygiene.

If your agent can read the skill, ask it to state the four execution modes and the four release outcomes back to you. Both lists are in the installed SKILL.md, and a correct answer is a cheap confirmation that the skill actually loaded.