> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/agent-skills.md).

# Install Agent Skills

Install Heeler's Agent Skills into your AI coding agents with dotagents so developers can run scans in natural language.

**Agent Skills** are drop-in security capabilities an AI agent discovers automatically in a repository — for Claude Code, Cursor, OpenCode, Codex, and VS Code. Each wraps a [`heelercli`](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/cli.md) command. This page installs them; for the skill catalog and what each does, see [Prevent → Agent Skills](/mrecEO40m5D6bt7Pq5pE/prevent/agent-skills.md).

## Prerequisites

* **Node.js 18+** (for [dotagents](https://github.com/getsentry/dotagents)).
* [`heelercli`](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/cli.md) **1.0.23 or later** installed and authenticated — most skills call it. This version provides batched dependency assessment, bounded rate-limit retries, and complete coverage signals. **Secrets scanning is the exception** and works without auth.
* **The toolchain for each ecosystem you want scanned**, on the same machine as the agent. Dependency skills — vulnerability, license, and malicious-package — build an SBOM from lockfiles directly where supported and shell out to ecosystem tooling where needed.

{% hint style="warning" %}
**A missing toolchain can narrow the scan.** Dependency detection covers C#/.NET (NuGet), Go, Java (Maven), JavaScript/TypeScript (npm, pnpm, Yarn, Bun), PHP (Composer), Python, Ruby (Bundler), and Rust (Cargo). Yarn and Bun text lockfiles are read directly; Go detection needs `go` on `PATH`, Java needs `mvn` and a working JDK, and other ecosystems may need `dotnet`, `npm`/`pnpm`, `composer`, `bundle`, or `cargo` when a lockfile alone is not enough.

If a required toolchain is missing, SBOM generation fails **for that manifest only**. The scan continues over the rest and reports incomplete coverage in its output. Ask the agent to confirm that coverage is complete before treating a clean result as complete.

Full list: [Current limitations and prerequisites](https://github.com/Heeler-Security/heelercli#current-limitations-and-prerequisites) in the `heelercli` README.
{% endhint %}

## Install with dotagents

Skills install into `.agents/skills/` — commit that directory so the whole team gets them:

```bash
npx @sentry/dotagents init                              # create agents.toml
npx @sentry/dotagents add Heeler-Security/heelercli --all
npx @sentry/dotagents install
```

* **Install a subset** by naming skills instead of `--all` — e.g. `… add Heeler-Security/heelercli heeler-security-review heeler-scan-all`.
* **In CI**, use `npx @sentry/dotagents install --frozen` for deterministic, lockfile-pinned installs.
* **Refresh an existing installation** by updating the source with dotagents and running `npx @sentry/dotagents install` again. The current package installs all eight Heeler skills with `--all`.

## Roll it out across your org

Add `npx @sentry/dotagents install` (and the [pre-commit setup](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/cli.md#install-as-a-pre-commit-hook)) to your repo template or `make setup` so new repos have both from day one.

## Verify and troubleshoot

* Ask the agent *"What Heeler skills are available?"* to confirm discovery. The agent should list the installed Heeler skills by name — for example security review, secrets scanning, vulnerability scanning, license check, and malicious-package detection — rather than saying it has none. If it lists them, discovery is working.
* **Skills not discovered?** Confirm `.agents/skills/` exists and each skill has a `SKILL.md`, then restart the agent.
* **Skill errors?** Check `heelercli --version` and authentication — if the CLI works standalone, the issue is agent discovery; restart the agent.

## Related

* [Prevent → Agent Skills](/mrecEO40m5D6bt7Pq5pE/prevent/agent-skills.md) — the full skill catalog and how to invoke them.
* [Connect the MCP server](/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/mcp.md) — give the agent live Heeler context too.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/get-started/set-up-developer-tooling/agent-skills.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.