dreadnode/capabilities: Public source of the Dreadnode capabilities in app.dreadnode.io — agents, tools, skills, MCP servers, and workers. · GitHub

This is the source repo for the capabilities Dreadnode publishes to app.dreadnode.io. A capability is a directory — a manifest plus any combination of agents, tools, skills, and MCP servers — that a Dreadnode runtime picks up and loads:

ai-red-teaming/
  capability.yaml     # manifest
  agents/             # markdown prompts
  tools/              # python @tool functions
  skills/             # SKILL.md packs

• Published — dn capability install dreadnode/ai-red-teaming (swap in any name from capabilities/)
• From source — dn capability install ./capabilities/ai-red-teaming symlinks the directory into your runtime, so edits go live on reload
• From the TUI — start dn, press Ctrl+P, filter for dreadnode/

dn is the Dreadnode CLI — see getting-started to install and authenticate. Full install reference for capabilities lives at docs.dreadnode.io/capabilities/installing.

Every directory under capabilities/ is a shipped, working example. Read one alongside the docs:

• Concepts and load model
• Manifest reference
• Quickstart — scaffold to running in the TUI in about ten minutes

Every skill in this repo is scanned with NVIDIA SkillSpector for prompt injection, data exfiltration, tool-chaining abuse, and supply chain risk. CI runs SkillSpector in static mode (--no-llm) for deterministic scans without provider API keys, uploads SARIF reports to GitHub Code Scanning, and reports findings. Because security-focused capabilities intentionally contain offensive security content, the workflow currently reports findings without blocking merges while thresholds are tuned.

just security-scan                    # scan all capabilities
just security-scan web-security       # scan one capability
just security-scan behavioral="true"  # ignored by SkillSpector; kept for compatibility

Note: SkillSpector is not yet published to PyPI. The scanner is installed from git+https://github.com/NVIDIA/SkillSpector on each run; uv caches the build aggressively.

This repo is published for reference, not as a contribution target — we don't generally accept external PRs that add new capabilities. See CONTRIBUTING.md for what's useful to send and how to build your own capabilities instead.

Each capability declares its license in its capability.yaml.