Google Antigravity SDK
google-antigravity/antigravity-sdk-python
Design, implement, and debug autonomous AI agents and multi-agent systems using the Google Antigravity (AGY) SDK.
Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review.
Install Windsurf Security Basics
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basics --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .claude/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .claude/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basicsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basics --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .agents/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .agents/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basics --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .cursor/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .cursor/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/jeremylongshore/tons-of-skills-marketplace.git --path skills/.curated/windsurf-security-basics--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basics --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .gemini/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .gemini/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basicsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .github/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .github/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace windsurf-security-basics --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/.curated/windsurf-security-basics .opencode/skills/windsurf-security-basics && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "windsurf-security-basics" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/windsurf-security-basics into .opencode/skills/windsurf-security-basics/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "windsurf-security-basics", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
windsurf-security-basics- GitHub stars
- 2.8k
- Token cost
- ~1.2k tokens
- SKILL.md length
- 527 words
- Files
- 2 (incl. references)
- Skills in repo
- 3,342
- Repo updated
- First seen
- Licence
- MIT
At a glance
Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review.
- Works in 6 steps: Map trust boundaries → Configure context exclusions → Enforce durable behavior → …
- Protecting secrets
- SKILL.md covers Overview, Prerequisites, Tool Use and Instructions, plus 5 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Windsurf Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review. Use when protecting secrets, hardening a workspace, or assessing AI-editor risk. Trigger with "windsurf security", "windsurf secrets", "codeiumignore", or "Cascade guardrails".
Its SKILL.md is about 1.2k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/official-docs.md`). Compatibility notes: Designed for Claude Code
It sits in Agent Workflows. It works with Model Context Protocol. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.
When your agent uses it
- Protecting secrets
- Hardening a workspace
- Assessing AI-editor risk
- With windsurf security
Example prompts
- “windsurf security”
- “windsurf secrets”
- “codeiumignore”
- “/windsurf-security-basics”
Requirements
- Compatibility (from SKILL.md): Designed for Claude Code
- Pre-approved tools (allowed-tools): Read, Write, Grep
Workflow steps
6 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
ReadWriteGrep
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are gitignore).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Links to these hosts (documentation or services it may open):
docs.devin.ai
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Designed for Claude Code
From compatibility in the SKILL.md frontmatter.
Context cost
Windsurf Security Basics loads about 1.2k tokens when it runs, and up to ~1.3k if it reads all its reference files. Until then it costs about 80 tokens; SKILL.md has 527 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:50
.env - NoteMentions a .env fileSKILL.md:51
.env.* - NoteMentions a .env fileSKILL.md:98
**Finding:** "`.env.production` was not excluded. Add `.env.*`, rotate any exposed credential, verify with a harmless ca
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 527 words, ~1,244 tokens.
Download SKILL.mdSave it as
.claude/skills/windsurf-security-basics/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.- name
- windsurf-security-basics
- description
- Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review. Use when protecting secrets, hardening a workspace, or assessing AI-editor risk. Trigger with "windsurf security", "windsurf secrets", "codeiumignore", or "Cascade guardrails".
- allowed-tools
- Read, Write, Grep
- compatibility
- Designed for Claude Code
- argument-hint
- [scope or requirements]
- version
- 1.12.0
- license
- MIT
- author
- Jeremy Longshore <jeremy@intentsolutions.io>
- tags
- saas, windsurf, security, privacy, compliance
Devin Desktop Security Basics
Overview
Devin Desktop is the current name for Windsurf. Secure it with layered controls: repository permissions and secret management are authoritative; .codeiumignore, Rules, and prompts reduce context exposure but do not replace access control.
Prerequisites
- A version-controlled workspace and clean working tree
- The organization's data-classification and secret-handling policy
- Authorization to inspect configuration without collecting secret values
Tool Use
- Use
Readto inspect only the repository files and configuration needed for the request. - Use
Grepto locate relevant settings, rules, logs, or code without broad collection. - Use
Writeonly for a new artifact the user requested; never write credentials or unreviewed production configuration.
Instructions
Step 1: Map trust boundaries
Record repository sensitivity, connected organizations, enabled models, MCP servers, Hooks, terminal permissions, remote indexing, and deployment integrations. Identify which controls are local, repository-owned, or centrally administered.
Step 2: Configure context exclusions
Create .codeiumignore at the repository root using gitignore syntax. Include only project-relevant patterns, for example:
.env
.env.*
*.pem
*.key
credentials/
secrets/
customer-data/
dist/
node_modules/Windsurf also honors .gitignore, and Enterprise administrators can add a global .codeiumignore under ~/.codeium/. Verify behavior with a harmless canary filename; do not place a real secret in the test.
Step 3: Enforce durable behavior
Use repository AGENTS.md or .devin/rules/*.md to require secure coding, validation, least privilege, and explicit approval for risky operations. Keep each workspace Rule within the documented 12,000-character limit and use the correct trigger: mode.
Step 4: Review tools and automation
- Disable unused MCP servers and tools.
- Prefer provider OAuth or environment-backed secrets over literal values in
mcp_config.json. - Review Hooks as executable policy code and fail closed where required.
- Keep protected branches, code owners, CI, and deployment approvals outside the model's discretion.
- Require human approval for production, destructive, identity, and billing mutations.
Step 5: Respond to exposure
If a secret appears in a prompt, output, log, diff, or diagnostic bundle, treat it as exposed: stop sharing, revoke or rotate it through the provider, remove it from history where authorized, and document the incident. Adding an ignore rule alone is not remediation.
Show full SKILL.md (190 more words)Show less
Step 6: Verify
Confirm ignored paths are absent from context, protected branches still require review, MCP tools match policy, Hooks run on representative success and failure paths, and no configuration file contains credential material.
Output
Deliver a security review with context boundaries, ignored paths, organization policy, MCP and Hook exposure, repository protections, detected secret locations without values, remediation owners, and verification evidence. Mark controls as preventive, detective, or corrective.
Error Handling
| Issue | Response |
|---|---|
| Ignored file still appears | Check syntax, location, gitignore interaction, and current indexing state |
| MCP requires a token | Use provider OAuth or an approved secret store; never commit the value |
| Hook blocks legitimate work | Preserve the event, fix the narrow rule, and retest failure handling |
| Compliance claim is uncertain | Link first-party evidence and route the decision to security or legal |
Examples
Finding: ".env.production was not excluded. Add .env.*, rotate any exposed credential, verify with a harmless canary, and retain protected-branch review as the enforcement boundary."
Resources
Related Skill
Continue with windsurf-data-handling to build a regulated-data inventory, verify mutable vendor claims, and record control evidence without exposing sensitive values.
© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 1 other file (references) in skills/.curated/windsurf-security-basics of jeremylongshore/tons-of-skills-marketplace.
- SKILL.md
- references/official-docs.md
Open the folder on GitHubat commit cfae287
Compare with similar skills
Windsurf Security Basics next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Windsurf Security Basics this skilljeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1.2k | Automated safety check: Notes | MIT | |
| Google Antigravity SDKgoogle-antigravity/antigravity-sdk-python | 3.7k | — | ~2.1k | Automated safety check: Notes | Apache-2.0 | |
| Chatgpt AppsHaohao-end/openagent | 791 | 1 repos | ~4.9k | Automated safety check: Pass | Apache-2.0 | |
| Autocontext for Hermesgreyhaven-ai/autocontext | 1.3k | — | ~2.5k | Automated safety check: Pass | Apache-2.0 | |
| Workflow Schema Tuningbreaking-brake/cc-wf-studio | 5.4k | — | ~1.3k | Automated safety check: Pass | Custom licence | |
| Documentation Serverandrea9293/mcp-documentation-server | 343 | — | ~2.3k | Automated safety check: Pass | MIT |
Similar skills
Chatgpt Apps
Haohao-end/openagent
Build, scaffold, refactor, and troubleshoot ChatGPT Apps SDK applications that combine an MCP server and widget UI.
Autocontext for Hermes
greyhaven-ai/autocontext
Lets a Hermes agent run Autocontext scenarios, inspect Hermes curator state, export reusable knowledge and prepare local MLX or CUDA training data through the autoctx CLI.
Workflow Schema Tuning
breaking-brake/cc-wf-studio
Guides edits to cc-wf-studio's workflow schema so AI agents generate better workflows, treating schema text as prompt engineering rather than validation.
Documentation Server
andrea9293/mcp-documentation-server
A skill your agent uses when you need to store, retrieve, search, or manage documents in a local knowledge base with semantic search and hybrid (vector + full-text) retrieval.
Clawmem
yoloshii/ClawMem
ClawMem operational reference for agents at query time — the 3-rule escalation gate, MCP tool routing, the 4 query-optimization levers, pipeline behavior (query vs intentsearch), composite scoring…
More from jeremylongshore/tons-of-skills-marketplace
All 3,342 skills in this repoPerforming Security Code Review
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.
Adapting Transfer Learning Models
jeremylongshore/tons-of-skills-marketplace
Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.
Agent Context Loader
jeremylongshore/tons-of-skills-marketplace
Execute proactive auto-loading: automatically detects and loads agents.md files.
Aggregating Performance Metrics
jeremylongshore/tons-of-skills-marketplace
Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.
Analyzing Capacity Planning
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.
Analyzing Database Indexes
jeremylongshore/tons-of-skills-marketplace
Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.
Related
Works with
Categories
Questions about Windsurf Security Basics
What does Windsurf Security Basics do?
Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review. Windsurf Security Basics is an agent skill from jeremylongshore/tons-of-skills-marketplace. Secure Devin Desktop (formerly Windsurf) with context boundaries, repository controls, Rules, Hooks, and MCP review.
When should I use Windsurf Security Basics?
Windsurf Security Basics fits situations like: protecting secrets; hardening a workspace; assessing AI-editor risk; with windsurf security.
How do I install Windsurf Security Basics in Claude Code?
Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a claude-code`. Or copy the skill folder (skills/.curated/windsurf-security-basics in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/windsurf-security-basics in your project. Claude Code loads it when a task matches its description.
How do I install Windsurf Security Basics in Codex?
Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a codex`. Or copy the skill folder (skills/.curated/windsurf-security-basics in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/windsurf-security-basics in your project. Codex loads it when a task matches its description.
Can I use Windsurf Security Basics in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill windsurf-security-basics -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/windsurf-security-basics, .gemini/skills/windsurf-security-basics, .github/skills/windsurf-security-basics and .opencode/skills/windsurf-security-basics in your project.
What does Windsurf Security Basics need to run?
SKILL.md names no scripts, command-line tools or credentials: Windsurf Security Basics is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Write, Grep. Compatibility (from SKILL.md): Designed for Claude Code.
Does Windsurf Security Basics access the network?
SKILL.md names 1 domain. As links in the text: docs.devin.ai. This is read from the text; nothing was executed.
Is Windsurf Security Basics safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Windsurf Security Basics use?
Windsurf Security Basics is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Windsurf Security Basics use?
About 1.2k tokens (SKILL.md is roughly 5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 98 tokens, read only when the agent opens those files.
What are the alternatives to Windsurf Security Basics?
Skills that share tags, products or a category with Windsurf Security Basics: Google Antigravity SDK (google-antigravity/antigravity-sdk-python, 3.7k stars), Chatgpt Apps (Haohao-end/openagent, 791 stars), Autocontext for Hermes (greyhaven-ai/autocontext, 1.3k stars) and Workflow Schema Tuning (breaking-brake/cc-wf-studio, 5.4k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Windsurf Security Basics?
jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.
Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.