Snyk Security agent skills for Claude Code, Cursor and RevampKey

3 ready-made playbooks that teach an AI agent how to do real Snyk Security work: which tools to call, what to check first, and when to stop and ask you.

Download RevampKey, free I have it: connect Snyk Security

Connect Snyk Security once and all 3 skills install themselves and stay up to date. Mac, Windows and Linux.

All 3 Snyk Security skills

Each skill is one job. You ask in plain words and the agent loads the skill that matches, then follows its steps.

Start hereAsks before writing11 Snyk Security tools

Use Snyk Security with AI, safely

Connects your AI assistant to Snyk so it can run code, dependency, IaC, container and SBOM scans. It confirms sign-in and scope, picks the right scan, and asks before logging out, trusting a folder or sending feedback.

Use it when

You are connecting Snyk for the first time and want to know what it can check.
A Snyk scan fails with a sign-in or permission error.
You want to scan a repo, image or SBOM without accidentally trusting the wrong folder.

Tools it uses

snyk_version
snyk_auth
snyk_code_scan
snyk_sca_scan
snyk_iac_scan
snyk_container_scan
snyk_sbom_scan
snyk_aibom
snyk_logout
snyk_trust
snyk_send_feedback

Example

Check my payments-service repo with Snyk for vulnerable dependencies and code issues.

Signed in to Snyk as your team organisation. I ran the dependency scan (SCA) and the code scan on payments-service. The dependency scan found 14 issues: 3 critical, 6 high, 5 medium. The code scan found 2 high issues. Container and IaC scans were not run because no image or Terraform files were in scope.

Use in RevampKeyRead the full skill →

Asks before writing10 Snyk Security tools

Review a release or pull request with Snyk scans

Runs the Snyk code, IaC, container and SBOM scans that apply to a target, separates new findings from old ones, and gives a ship or hold call. It asks before changing any ignore or organisation setting.

Use it when

A pull request touches authentication or permissions and needs a security read before merge
A release candidate image needs a gate decision before it goes out
An infrastructure change is hidden inside a feature branch and needs a check

Tools it uses

snyk_version
snyk_auth
snyk_code_scan
snyk_sca_scan
snyk_iac_scan
snyk_container_scan
snyk_sbom_scan
snyk_aibom
snyk_trust
snyk_send_feedback

Example

Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.

I ran code and IaC scans on payments-api and skipped the container scan since no image was built. The auth middleware change introduces one high finding, a token comparison that can be bypassed, with a reachable path and a fix in the middleware itself. The new Terraform file opens a security group to 0.0.0.0/0 on port 5432. Verdict: ship after fixes, with those two items resolved first.

Use in RevampKeyRead the full skill →

Read-only3 Snyk Security tools

Triage Snyk dependency vulnerabilities with AI

Turns Snyk open-source scan results into a short, prioritised list of upgrades, separating runtime risk from dev-only findings and flagging issues with no fix yet. It asks before changing any manifest or lockfile.

Use it when

A backlog of Snyk open-source issues needs a sprint plan
You want to know which single upgrade clears the most real risk
A critical finding has no fix and you need the options

Tools it uses

snyk_version
snyk_auth
snyk_sca_scan

Example

Snyk flagged 240 dependency issues in the billing service. Which upgrades should we do first this sprint?

Of 240 findings across 61 packages, the top upgrade is one transitive parent bump: express from 4.17.1 to 4.19.2, which clears 14 findings, including 3 high ones in a runtime request parser. Two further direct upgrades clear 9 more. Eleven findings have no fixed version yet, so they are listed separately with replace or compensate options. I have not changed any manifest; say the word and I will draft the edits.

Use in RevampKeyRead the full skill →

Get all 3 without copying a file

RevampKey adds the skills when you connect Snyk Security, updates them for you and removes them when you disconnect.

Download RevampKey

How Snyk Security skills work

Connect Snyk Security
The Snyk Security MCP server gives the agent its tools.
Ask in plain words
“Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.” Each SKILL.md says when it applies, so only the one that fits is loaded.
Approve any change
The agent calls the tools in order, checks its work, and shows you any change before it makes it.

How to install Snyk Security skills

In RevampKey the skills install themselves when you connect Snyk Security. In other tools each skill is one folder with a SKILL.md file, and you also need the Snyk Security MCP server connected there.

About 1 minute · nothing to copy

Download RevampKey for Mac, Windows or Linux and sign in.
Open Connectors and connect Snyk Security. All 3 skills come with it and stay up to date; they go away when you remove the connector.
Ask in plain language, for example “Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.”
Download RevampKeyConnect Snyk Security · 1 click
Get RevampKey to connect Snyk Security
RevampKey is a free desktop app for Mac, Windows and Linux. Install it, sign in, and Snyk Security is one click away with its skills already attached.
Download RevampKey
Not now? Use the skills in your current tool
for s in essentials scan-review snyk-dependency-vulnerability-triage; do curl -fsSL --create-dirs -o .claude/skills/snyk-security-$s/SKILL.md https://revampkey.com/marketplace/snyk-security/skills/$s/SKILL.md done
Other tools

Into this project’s .claude/skills folder

Connect the Snyk Security MCP server in Claude Code.

Run this in your project folder to add all 3 skills:

for s in essentials scan-review snyk-dependency-vulnerability-triage; do
  curl -fsSL --create-dirs -o .claude/skills/snyk-security-$s/SKILL.md https://revampkey.com/marketplace/snyk-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.”

Into the shared .agents/skills folder

Connect the Snyk Security MCP server in Cursor.

Run this in your project folder to add all 3 skills:

for s in essentials scan-review snyk-dependency-vulnerability-triage; do
  curl -fsSL --create-dirs -o .agents/skills/snyk-security-$s/SKILL.md https://revampkey.com/marketplace/snyk-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.”

Into the shared .agents/skills folder

Connect the Snyk Security MCP server in Codex.

Run this in your project folder to add all 3 skills:

for s in essentials scan-review snyk-dependency-vulnerability-triage; do
  curl -fsSL --create-dirs -o .agents/skills/snyk-security-$s/SKILL.md https://revampkey.com/marketplace/snyk-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.”

Into the shared .agents/skills folder

Connect the Snyk Security MCP server in VS Code.

Run this in your project folder to add all 3 skills:

for s in essentials scan-review snyk-dependency-vulnerability-triage; do
  curl -fsSL --create-dirs -o .agents/skills/snyk-security-$s/SKILL.md https://revampkey.com/marketplace/snyk-security/skills/$s/SKILL.md
done

Ask in plain language, for example “Can you check the payments-api branch for security issues before we merge? It changes the auth middleware and adds a new Terraform file.”

RevampKey or copy the files?

In RevampKey

One click when you connect Snyk Security
Updated for you when a skill improves
Removed when you disconnect
The MCP server is set up for you
800+ other connectors, same way

Download free

Copy into your project

One command per project
Run it again to get updates
You connect the Snyk Security MCP server yourself
Works in Claude Code, Cursor, Codex and VS Code

See the command

Snyk Security skills FAQ

What is a Snyk Security agent skill?

A SKILL.md file: a short playbook an AI agent loads when your request matches it. Each Snyk Security skill describes one job, which Snyk Security tools to use in which order, what to check first and when to stop and ask you.

Do the Snyk Security skills change anything on their own?

1 of the 3 only read. The others tell the agent to show you the change and wait for a yes before it creates, edits or deletes anything in Snyk Security.

Which tools can use these skills?

Any agent that reads the open Agent Skills format: Claude Code, Cursor, Codex, VS Code with Copilot and RevampKey. In RevampKey they are attached when you connect Snyk Security; elsewhere you copy the folders into your project or skills directory.

Do I need the Snyk Security MCP server too?

Yes. The skills tell the agent how to do the work; the Snyk Security MCP server gives it the tools to do it. The Snyk Security MCP setup guide covers every client.

Snyk Security MCP server setup · This page as Markdown

Put Snyk Security’s best workflows in your agent

Download RevampKey, connect Snyk Security and ask your first question in about a minute.

Download RevampKey Connect Snyk Security · 1 click

All 3 Snyk Security skills

Use Snyk Security with AI, safely

Use it when

Tools it uses

Review a release or pull request with Snyk scans

Use it when

Tools it uses

Triage Snyk dependency vulnerabilities with AI

Use it when

Tools it uses

Get all 3 without copying a file

How Snyk Security skills work

How to install Snyk Security skills

RevampKey or copy the files?

In RevampKey

Copy into your project

Snyk Security skills FAQ

Put Snyk Security’s best workflows in your agent

Skills for related tools