Claude Code skill
Vulkro ships a skill for Claude Code (and other AI coding agents) that
teaches them how to invoke the CLI, interpret its JSON output, and
surface findings effectively. The skill itself runs entirely on your
machine - Vulkro is invoked as a subprocess, your code never leaves
your laptop, and VULKRO_OFFLINE=1 is honoured if set.
Install
Run the skill installer:
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash
The installer detects which AI agents you have configured locally and drops the Vulkro skill into the right place for each one:
| Agent | Where it installs |
|---|---|
| Claude Code | ~/.claude/skills/vulkro/SKILL.md |
| Cursor | ~/.cursor/rules/vulkro.md |
| Codex CLI | ~/.codex/AGENTS.md (appended, never overwritten) |
Pick a subset with --agent:
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --agent claude-code,cursor
Or preview what it would do:
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --dry-run
Every fetched file is SHA-256 verified against a signed manifest from the Vulkro CDN. One HTTPS call per file, no telemetry.
Environment overrides
| Variable | Purpose |
|---|---|
VULKRO_AGENT | Comma-separated agent list (skips the interactive prompt). |
VULKRO_SKILL_BASE | Override the CDN (advanced; default https://dist.vulkro.com). |
VULKRO_FORCE | Set to 1 to overwrite existing skill files without prompting. |
What it enables
Once installed, Claude responds to natural-language requests like:
- "Scan this codebase for security issues"
- "Run a SOC2 readiness check"
- "Generate a CycloneDX SBOM"
- "What API endpoints does this app expose, and which lack auth?"
- "Block this PR if it introduces new critical findings vs main"
Claude picks the right CLI invocation, parses the JSON, and explains the findings in plain English. It never sends your code to the model - the scan runs locally and only the JSON-shaped report ends up in the model's context.
Air-gap behaviour
The skill respects VULKRO_OFFLINE=1. If set, Claude will refuse to
run vulkro update and will instead suggest vulkro update --bundle
with a path to a locally-staged bundle.