Recommended AI agent skills and tools

Official publisher links for browser, image, document and code tools.

A useful toolbox is worth having ready before your next project. These recommended skills and tools help agents browse, inspect images, read documents and review code. You do not need every tool: choose the setup and alternatives that fit your platform and agent.

Build on what your agent already provides. Local tools need an agent that can run commands; MCP (Model Context Protocol) tools need a compatible client. Links go to each publisher's setup guide or downloads. There is no Smith Labs toolkit or automatic installation.

For public package vulnerability and malware evidence, connect your agent to SmithGuard.

Review your code

Cloudflare's security-audit skill - official source and installation guides code reviews, including projects that do not use Cloudflare. SmithGuard checks public package evidence; the security skill reviews your code. Neither certifies safety.

After following the upstream instructions for your client, try: "Use the security-audit skill to review the authentication changes in this project. Explain evidence and uncertainties, and do not change files or probe live services."

Full audits need subagents, Node.js and controlled execution. Read the skill's execution rules before starting one. Reports can contain sensitive findings; choose a private output directory outside the repository. The default is ~/security-audit-skill/<repo-name>/run-<N>.

Browse and test websites

  • Playwright CLIBrowse and test websites. Choose CLI for a shell-capable agent or MCP for a compatible client. Official Playwright CLI setup
    Mac, Linux and Windows; supported versions and browser dependencies vary. Start with one route and an isolated browser profile.
  • Playwright MCPThe alternative browser connection for agents that use MCP. Official Playwright MCP setup
    Mac, Linux and Windows with a supported Node.js version. Configure it through your own client's instructions; no universal settings file.

Read images and small text

  • ImageMagickCrop, enlarge and inspect saved images from the command line. Official ImageMagick downloads
    Mac, Linux and Windows; choose the appropriate upstream or package-manager route. Use saved screenshots; desktop capture is a separate OS/browser feature.
  • Tesseract OCRFind text in images when visual inspection needs help. Official Tesseract installation guide
    Mac and Linux package-manager routes; the Windows builds linked by the project are third-party. OCR needs language data and can misread text. Skip third-party Windows builds if you prefer.

Read documents and PDFs

  • Microsoft MarkItDownExtract text from supported documents for an agent to read. Official MarkItDown setup
    Mac, Linux and Windows with supported Python and format-specific dependencies. Use a separate Python environment. Scans need OCR; text extraction does not verify visual layout. Optional remote/model converters can send data out.
  • PopplerRender PDF pages for visual inspection when your agent lacks a PDF renderer. Official Poppler project
    Linux distribution and Mac package-manager routes; no official Windows binary download. Windows users can keep their existing PDF renderer. WSL is a separate Linux environment.

Search files and filter JSON

  • ripgrepSearch text across files quickly. Official ripgrep releases
    Mac, Linux and Windows; choose the matching CPU architecture. Respect private files and project exclusions.
  • jqFilter and inspect JSON data. Official jq downloads
    Mac, Linux and Windows, including package-manager routes. Check commands before overwriting any output file.

Check for exposed secrets

  • GitleaksCheck files or Git history for exposed secrets. Official Gitleaks installation and releases
    Mac, Linux and Windows binaries are available. Upstream describes it as feature-complete with security patches only. Keep reports private; findings need review and a clean scan is not proof of safety.

More options for your toolbox

More options for documents, code checks and library documentation
  • PandocConvert documents and create new ones. Official Pandoc installation
    Mac, Linux and Windows. PDF creation may require a separate rendering engine.
  • Semgrep Community EditionAdd code-pattern checks using trusted local rules. Official Semgrep source and installation
    Mac and Linux; native Windows support is beta. Use a separate Python environment and --metrics off for local checks. Registry rules can require network access.
  • Context7Get current public library documentation through an MCP connection. Official Context7 setup
    Works through compatible clients; local setup requirements vary. This hosted service receives your queries. Use public library questions, not private code, and review current limits, account/key options and privacy terms.

Semgrep's default metrics setting can send pseudonymous usage data when using registry rules or a login. For local rules, use semgrep scan --metrics off --config ./rules.yml .. Read the official metrics controls.

Official links identify the publisher; they are not a safety guarantee. Check the publisher's requirements, license and current release. These tools have not been tested by Smith Labs across every operating system or agent.

Keep tool runbooks

Have your agent create a short runbook for SmithGuard and each listed tool or skill you already have or adopt. A runbook keeps the setup and everyday steps ready for the next session. Finish the package check first; then create missing runbooks or update outdated ones. Leave current runbooks alone.

Use your established documentation location and preserve unrelated content. If no location is known or writable, have the agent provide the runbooks in chat. Keep credentials and private data out, use non-sensitive samples for checks, and label untested steps unverified.

  • Purpose and official referenceWhat the tool or skill does, when to use it, and the publisher's documentation link.
  • Actual setupPlatform, installed version, dependencies and the setup steps that apply. Record known facts; mark unknown details instead of guessing.
  • Everyday useA short command or agent prompt, expected output, permissions and operating limits.
  • VerificationA small non-sensitive sample check, its actual result and the date it was last verified. Suggested checks are not proof that they ran.
  • Troubleshooting and maintenanceCommon errors, how to update or remove the tool using publisher instructions, and when the runbook needs another check.

Writing a runbook documents the toolbox. Installing software, changing configuration or running a code audit are separate actions.