Skip to main content

Claude Code skill

The Vulkro skill teaches Claude Code (and Cursor and Codex CLI) when to run vulkro and vulkro-sf, and how to read their results.

curl -fsSL https://dist.vulkro.com/skill-install.sh | bash

The installer asks which AI coding agents to set up, then writes the instruction files:

AgentWhere it installs
Claude Code (claude-code)~/.claude/skills/vulkro/ and ~/.claude/skills/vulkro-sf/
Cursor (cursor)~/.cursor/rules/vulkro.md
Codex CLI (codex)~/.codex/AGENTS.md (appended, never overwritten)

Pick agents without the prompt, or preview first:

curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --agent claude-code,cursor
curl -fsSL https://dist.vulkro.com/skill-install.sh | bash -s -- --dry-run

Each file is checked against the SHA-256 in the skill manifest before it is written. The skill needs the scanner itself: install Vulkro and sign in first.

What it does​

  • Runs the right command. Ask "scan this project for security issues" or "block this PR if it adds new Critical findings" and the agent picks the matching vulkro command (for Salesforce code, vulkro-sf).
  • Keeps answers short. The agent reads the JSON report and summarises the findings, then can show one finding, its proof, or a fix on request, instead of pasting the whole scan into the conversation.
  • Stays local. The scan runs on your machine. Your code is not sent anywhere by Vulkro; only the report the agent reads enters its context. With VULKRO_OFFLINE=1 set, the agent uses vulkro update --bundle <file> instead of a network update.

For tool calls instead of shell commands, add the MCP server too:

claude mcp add vulkro -- vulkro mcp serve
claude mcp add vulkro-sf -- vulkro-sf mcp serve   # Salesforce

See vulkro mcp serve.

Settings​

VariableWhat it does
VULKRO_AGENTComma-separated agent list (claude-code, cursor, codex); skips the prompt. Same as --agent
VULKRO_FORCESet to 1 to overwrite existing skill files without asking. Same as --force
VULKRO_CDNDownload from a mirror instead of https://dist.vulkro.com. Same as --cdn
Last updated on