commandvault-libraryBLOCK
Community-voted AI prompts, CLAUDE.md/AGENTS.md templates, Cursor rules, Agent Skills and MCP servers from commandvault.ai, synced daily. MCP server + Claude Code plugin included.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Community-voted AI commands from commandvault.ai: prompts, CLAUDE.md / AGENTS.md templates, Cursor rules, Claude Code slash commands and subagents, Agent Skills and MCP servers. Every item has fill-in {{blanks}} and links back to its page, where you can vote, comment and fill the blanks in the browser.
This repo is synced automatically every day from the site. To suggest a change, comment on the item's page on commandvault.ai (pull requests to the generated files are overwritten by the next sync).
Use it from your AI tool
MCP server (no key needed):
claude mcp add --transport http commandvault https://commandvault.ai/api/mcp
Setup for Cursor, VS Code, Codex, Claude Desktop and Gemini CLI: commandvault.ai/mcp.
Claude Code plugin (MCP server + a lookup skill + /vault command):
/plugin marketplace add geronco/commandvault-library /plugin install commandvault@commandvault
Layout
License
Content: CC BY 4.0. Credit "CommandVault (commandvault.ai)" with a link. Code (scripts, workflow, plugin): MIT.
Synced from [commandvault.ai](https://commandvault.ai) on 2026-10-13: 240 items.
Agent Skills (75)
ef4d0477e10fOBSERVED · 2026-10-13Install
Commands as the repository documents them. They are shown, not run.
claude mcp add --transport http commandvault https://commandvault.ai/api/mcp
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| claude-desktop | mentioned | |
| codex | mentioned | |
| copilot | mentioned | |
| cursor | mentioned | |
| gemini-cli | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: accessibility-check description: Check and fix accessibility issues in UI code. Use when building or reviewing pages, forms or components, or when the user asks about a11y or WCAG. --- # Accessibility check Go through the component and fix what fails: - **Semantics:** real buttons and links (not clickable divs), one h1, headings in order, lists as lists, landmarks (header, nav, main). - **Names:** every input has a label; icon-only buttons have aria-label; images have alt (empty alt for decorative). - **Keyboard:** everything works with Tab/Shift+Tab/Enter/Space/Escape; focus is visible; dialogs trap and return focus. - **Contrast:** text at least 4.5:1 (3:1 for large text and UI parts) in both light and dark themes. - **Motion:** respect prefers-reduced-motion. - **Forms:** errors are announced (aria-live or aria-describedby) and say how to fix them. - **Targets:** at least 24×24 px. Report each issue with the fix you made. If a tool like axe or Lighthouse is available, run it and include the result.
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
- Read, print, log or commit secrets (`.env*`, keys, tokens). Refer to them by name only.
tags: ["access control", "login", "password protected", "roles"]
You are a senior engineer reviewing changes in {{project_name}}.| [AWS API MCP server (AWS Labs)](mcp-servers/aws-api.json) · [web](https://commandvault.ai/commands/aws-api-mcp-server-aws-labs-351b5a0b) | Let an agent run validated AWS CLI commands across every AW
Gates applied: no_behavioural_pass.
ef4d0477e10ffull audit observations/trust-audit/skill/geronco__commandvault-library.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-13 | ef4d0477e10f | BLOCK | D | 69 | first audit |
Questions
What does the commandvault-library skill do?
Community-voted AI prompts, CLAUDE.md/AGENTS.md templates, Cursor rules, Agent Skills and MCP servers from commandvault.ai, synced daily. MCP server + Claude Code plugin included.
Is commandvault-library safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can commandvault-library access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
Which assistants does commandvault-library work with?
Its documentation mentions claude-code, claude-desktop, codex, copilot, cursor and gemini-cli. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (ef4d0477e10f), read on 2026-10-13. The repository is watched, and a new audit runs when it changes — this is the first audit.