What I teach my agents to do.
Agent Skills are folders with a SKILL.md that Claude Code, Codex, Cursor, Copilot or Gemini CLI pick up when the task fits. You do not call them by name: you ask in plain words. Some of mine are meant to be installed, others only to be read.
Application security
The practices of my GoLab talk, packaged so your agent can apply them to your repo: security CI, an audit that reports findings with evidence, and fuzz tests that prove a logic bug before anyone fixes it. Go is the first pack and TypeScript is next; every file a skill writes is tested in CI against a real project first.
davideimola/appsec-skillsFrom the talk at GoLab 2026npx skills add davideimola/appsec-skills- appsec-auditSecurity audit of a Go repo or service.
- appsec-ciInstalls security CI in a Go repo.
- appsec-proveVerifies a security hypothesis about Go or TypeScript code by writing named test cases and a property over generated inputs that fail on today's code and stay as regression tests.
- appsec-setupConfigures appsec-skills for a repo, the first skill to run before the others.
How I work
The skills I run my writing and my speaking with. They are wired to my own setup (my notes, my queue, my voice), so they will not work for you as they are: read them, take what fits, change the rest.
davideimola/skills- cfpFind open Calls for papers and bring my Talks to them, tracked on Trilium, from any repo.
- conferenceRun my Conference companion on Trilium, from any repo.
- ideaCapture a raw content spark as an idea note in my Trilium Inbox, from any repo.
- social-postWrite a LinkedIn post for something I made (a blog post, a talk, a project, an event), build a branded image when one helps, and plan it as a draft in Typefully.
- tweetsPropose a few short posts for my X + Bluesky queue from what I already make (Trilium ideas, blog posts, Argus activity, upcoming talks), then save the approved ones as planned drafts in Typefully.