Pi Security agent skills for Claude Code, Cursor and RevampKey

6 ready-made playbooks that teach an AI agent how to do real Pi Security work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Pi Security

Connect Pi Security once and all 6 skills install themselves and stay up to date. Mac, Windows and Linux.

All 6 Pi Security skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing19 Pi Security tools

Use Pi Security safely with AI

Confirms which Pi tenant you are querying, picks the right lookup tool, keeps results narrow, and asks before changing anything in Pi.

Use it when

You have just connected Pi Security and want to confirm the right account is signed in
You are not sure which Pi lookup tool fits your question
An authentication or permission error stopped a Pi query

Tools it uses

whoami
pi_finding_get
pi_findings_list
pi_gatekeeper_pr_get
pi_gatekeeper_issue_get
pi_threat_model_app_get
pi_threat_model_app_section_get
pi_threat_model_apps_list
pi_design_review_get
pi_design_reviews_list
pi_knowledgebase_query
pi_playbook_task_query
pi_remediation_plan_fetch
pi_package_remediation_plan_fetch
pi_package_remediation_plan_prepare
pi_design_review_url_create
pi_design_review_markdown_create
pi_report_markdown_upload
pi_playbook_comment_create

Example

Check which Pi tenant I'm connected to, then show me the open findings for the payments service.

You're signed in to the Pi tenant "Acme Payments". I found 14 open findings for the payments service, showing the first 10 by severity. Nothing has been changed in Pi. Say if you want the next page.

Use in RevampKeyRead the full skill →

Asks before writing2 Pi Security tools

Ingest a Markdown security report into Pi Security

Submits a security report pasted as Markdown or plain text to Pi Security for ingestion. It confirms the tenant and report name, screens the content for secrets, and asks for your explicit yes before the one hosted upload.

Use it when

You have a pentest summary written as Markdown and want it in Pi
You want to send an audit write-up to Pi under a clear report name
You need to check a report for secrets before it leaves the conversation

Tools it uses

whoami
pi_report_markdown_upload

Example

Submit this pentest summary to Pi as pentest-q3.md

Tenant: acme-prod. Report: pentest-q3.md, about 420 lines of inline Markdown. I found one API key in the appendix and asked you to redact it before continuing. After your yes, the report was uploaded once and Pi returned a report reference. I have not confirmed ingestion has finished.

Use in RevampKeyRead the full skill →

Read-only4 Pi Security tools

Investigate a Pi Security finding with AI

Reads one Pi Security finding by display id, UUID or URL, explains it, and shows any existing remediation plan. It only reads: it never changes anything in Pi.

Use it when

You want to understand what FND-1042 means and how serious it is.
You need to know whether two findings are related or duplicates.
You want to see if Pi already has a remediation plan for a finding.

Tools it uses

whoami
pi_findings_list
pi_finding_get
pi_remediation_plan_fetch

Example

Explain FND-1042 and how it compares to FND-977.

Tenant confirmed as Acme Payments. FND-1042 is a high-severity SQL injection in the checkout service, first seen 3 weeks ago, and Pi has a remediation plan with 2 steps. FND-977 affects the same service but a different query path, so they look related but are not duplicates. I could not establish whether the vulnerable endpoint is reachable from the internet.

Use in RevampKeyRead the full skill →

Read-only3 Pi Security tools

Find or prepare remediation guidance in Pi Security

Looks up existing remediation plans for a Pi finding or vulnerable package first, and only prepares a missing package plan after you confirm. It does not change code.

Use it when

You want to know how to fix a Pi finding or a vulnerable package
You need to check whether a remediation plan already exists before asking Pi to make one
You want Pi to prepare a plan for a package that has none, with your approval first

Tools it uses

pi_remediation_plan_fetch
pi_package_remediation_plan_fetch
pi_package_remediation_plan_prepare

Example

Is there a remediation plan for lodash 4.17.20 in the storefront repo? If not, ask Pi to prepare one.

Pi already has a plan for lodash 4.17.20 (CVE-2021-23337, npm). It recommends upgrading to 4.17.21, a patch release with no breaking changes listed. I have not prepared anything new, since a plan already exists. Let me know if you want me to check a different version.

Use in RevampKeyRead the full skill →

Read-only7 Pi Security tools

Review security posture with Pi Security

Combines an application's threat model with Gatekeeper pull request and issue state to show where open risk concentrates and which boundary-touching changes have not been reviewed. Read-only, so it asks nothing before running.

Use it when

Asking how secure a service is before a release
Checking whether recent changes to auth or input handling were reviewed
Finding which parts of a threat model have no review activity

Tools it uses

pi_threat_model_apps_list
pi_threat_model_app_get
pi_threat_model_app_section_get
pi_gatekeeper_prs_list
pi_gatekeeper_issues_list
pi_gatekeeper_pr_get
pi_gatekeeper_issue_get

Example

How exposed is the payments service right now, and did the recent changes to its auth middleware get reviewed?

Payments is most exposed at the webhook signature boundary. PR #812 changed the signature check and merged two days ago with no Gatekeeper review. Two open issues, one on refund idempotency and one on logging card tokens, both touch the export boundary. Reviewing the signature check first is the fastest reduction in risk.

Use in RevampKeyRead the full skill →

Asks before writing4 Pi Security tools

Start a Pi Security design review

Creates a hosted Pi design review from a Confluence or Notion URL or inline Markdown. It checks the input, confirms the tenant and target, and asks before submitting anything.

Use it when

You have a new system design doc and want Pi to review it
A design lives in Confluence or Notion and you have its link
You pasted a spec into chat and want it reviewed without a file upload

Tools it uses

whoami
pi_design_reviews_list
pi_design_review_url_create
pi_design_review_markdown_create

Example

Start a Pi design review of https://example.atlassian.net/wiki/spaces/ENG/pages/123 (a synthetic URL), named payments-v2 design.

Tenant is acme-staging. I checked existing reviews and found none for this page. The URL is a design page with about 2,400 words covering flows and trust boundaries. Target: 'payments-v2 design' from URL. Pi will create a hosted review that runs on its side. Reply yes to submit.

Use in RevampKeyRead the full skill →

Get all 6 without copying a file

RevampKey adds the skills when you connect Pi Security, updates them for you and removes them when you disconnect.

Download RevampKey

How Pi Security skills work

Connect Pi Security
The Pi Security MCP server gives the agent its tools.
Ask in plain words
“Submit this pentest summary to Pi as pentest-q3.md” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Pi Security skills

In RevampKey the skills install themselves when you connect Pi Security. In other tools each skill is one folder with a SKILL.md file, and you also need the Pi Security MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Pi Security. All 6 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Submit this pentest summary to Pi as pentest-q3.md”
Download RevampKeyConnect Pi Security · 1 click
Get RevampKey to connect Pi Security
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Pi Security is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials ingest-markdown-report investigate-finding remediation-guidance review-security-posture security-design-review; do curl -fsSL --create-dirs -o .claude/skills/pi-security-$s/SKILL.md https://revampkey.com/marketplace/pi-security/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Pi Security MCP server in Claude Code.

Run this in your project folder to add all 6 skills:

for s in essentials ingest-markdown-report investigate-finding remediation-guidance review-security-posture security-design-review; do
  curl -fsSL --create-dirs -o .claude/skills/pi-security-$s/SKILL.md https://revampkey.com/marketplace/pi-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Submit this pentest summary to Pi as pentest-q3.md”

Into the shared .agents/skills folder

Connect the Pi Security MCP server in Cursor.

Run this in your project folder to add all 6 skills:

for s in essentials ingest-markdown-report investigate-finding remediation-guidance review-security-posture security-design-review; do
  curl -fsSL --create-dirs -o .agents/skills/pi-security-$s/SKILL.md https://revampkey.com/marketplace/pi-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Submit this pentest summary to Pi as pentest-q3.md”

Into the shared .agents/skills folder

Connect the Pi Security MCP server in Codex.

Run this in your project folder to add all 6 skills:

for s in essentials ingest-markdown-report investigate-finding remediation-guidance review-security-posture security-design-review; do
  curl -fsSL --create-dirs -o .agents/skills/pi-security-$s/SKILL.md https://revampkey.com/marketplace/pi-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Submit this pentest summary to Pi as pentest-q3.md”

Into the shared .agents/skills folder

Connect the Pi Security MCP server in VS Code.

Run this in your project folder to add all 6 skills:

for s in essentials ingest-markdown-report investigate-finding remediation-guidance review-security-posture security-design-review; do
  curl -fsSL --create-dirs -o .agents/skills/pi-security-$s/SKILL.md https://revampkey.com/marketplace/pi-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Submit this pentest summary to Pi as pentest-q3.md”

RevampKey or copy the files?

In RevampKey

One click when you connect Pi Security
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Pi Security MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Pi Security skills FAQ

What is a Pi Security agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Pi Security skill describes one job, which Pi Security tools to use in which order, what to check first and when to stop and ask you.

Do the Pi Security skills change anything on their own?

3 of the 6 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Pi Security.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Pi Security; elsewhere you copy the folders into your project or skills directory.

Do I need the Pi Security MCP server too?

Yes. The skills tell the agent how to do the work; the Pi Security MCP server gives it the tools to do it. The Pi Security MCP setup guide covers every client.

Pi Security MCP server setup · This page as Markdown

Put Pi Security’s best workflows in your agent

Download RevampKey, connect Pi Security and ask your first question in about a minute.

Download RevampKey Connect Pi Security · 1 click

All 6 Pi Security skills

Use Pi Security safely with AI

Use it when

Tools it uses

Ingest a Markdown security report into Pi Security

Use it when

Tools it uses

Investigate a Pi Security finding with AI

Use it when

Tools it uses

Find or prepare remediation guidance in Pi Security

Use it when

Tools it uses

Review security posture with Pi Security

Use it when

Tools it uses

Start a Pi Security design review

Use it when

Tools it uses

Get all 6 without copying a file

How Pi Security skills work

How to install Pi Security skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Pi Security skills FAQ

Put Pi Security’s best workflows in your agent

Skills for related tools