Maintainer of this skill?
Automated security scan — not a certification.
by h5i-dev
An agent-native web security workspace. Find vulnerabilities through red-teaming. Formally verify properties of Rust codes in Lean 4.
# Add to your Claude Code skills
git clone https://github.com/h5i-dev/h5iLast scanned: 6/1/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-06-01T09:27:45.781Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how h5i compares with popular alternatives.
h5i is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by h5i-dev. An agent-native web security workspace. Find vulnerabilities through red-teaming. Formally verify properties of Rust codes in Lean 4. It has 774 GitHub stars.
Yes. h5i passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/h5i-dev/h5i" and add it to your Claude Code skills directory (see the Installation section above).
h5i is primarily written in Rust. It is open-source under h5i-dev on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh h5i against similar tools.
No comments yet. Be the first to share your thoughts!
30 days in the Featured rail · terms & refunds
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Automated security scan — not a certification.
h5i (pronounced high-five) is a workspace for securing web applications through two complementary approaches: finding vulnerabilities with AI agents and proving correctness with formal verification.
h5i-app, an Axum-based Rust framework designed for verification with Lean 4. Prove authorization, data isolation, and business logic properties directly against your Rust implementation.Build with agents. Red-team for bugs. Formally verify properties.
# Find bugs in web applications
h5i browser open https://example.com # Open a website in the browser
h5i browser click @e3 # Interact with page elements
h5i websec requests # Inspect captured HTTP traffic
h5i websec replay req_42 --set query.id=456 # Modify and replay a request
h5i recon crawl --max-requests 200 # Crawl the application for attack surfaces
# Prove correctness of Rust application logic
h5i app new counter && cd counter # Create an h5i-app project
h5i app extract # Translate Rust logic into Lean 4
h5i app prove # Build and check formal proofs
h5i app mutate # Test proof sensitivity with mutations
curl -fsSL https://h5i.dev/install.sh | sh -s -- --websec --recon --test # `websec`, `recon`, and `test` are optional plugins
# curl -fsSL https://raw.githubusercontent.com/h5i-dev/h5i/main/install.sh | sh # if you would rather not add a domain to the chain:
# cargo install --path . # build from source
# h5i plugin list # says what is installed
The agent-facing interface is a skill, and the binary carries it:
npx skills add h5i-dev/h5i # if you do not have the binary yet
# h5i skill install # writes it where your runtime looks
Let AI agents explore, attack, and test web applications using h5i's integrated security toolkit.
h5iworks with any web services regardless of their framework, and no migration toh5i-appis required.
Just open your favorite agent harness and say "Audit https://<your-target>.com with h5i."
h5i-app is an Axum-based Rust web framework that makes application logic amenable to Lean 4.
Red-teaming discovers bugs through testing. Formal verification takes a complementary approach: proving that specified properties hold for all possible inputs and behaviors.
[dependencies]
h5i-app = { version = "0.1.1", features = ["http", "postgres"] }
We can write web applications in Rust, translate them into Lean 4 via Aeneas, and prove various properties like authorization, isolation, business logics, and more.
While agents access these capabilities through a unified CLI, you can also monitor their activity through the dashboard:
h5i ui # Open the local dashboard
man h5i: full command referencecurl -fsSL https://h5i.dev/man/man1/h5i.1 -o ~/.local/share/man/man1/h5i.1: install the man pageh5i is licensed under the Apache License 2.0. See LICENSE.