How do I install the Oneleet skill?

Run npx skillmds@latest add danielgwilson/oneleet in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Oneleet safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Oneleet?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Oneleet free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Oneleet?

danielgwilson (@danielgwilson) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Oneleet by danielgwilson — Agent Skill

Name: Oneleet
Rating: 4.2 (5 reviews)
Author: danielgwilson

Oneleet

Use the Oneleet CLI to inspect Oneleet security and compliance posture through an unofficial read-first private-surface adapter. Prefer summarized JSON and aggregate reports; never print cookies or raw sensitive payloads.

danielgwilson 7782f1d 4 files · 3.7 KB Updated Sep 17, 2026

File contents

Oneleet CLI Skill

Use this skill for Oneleet compliance, HIPAA, security posture, trust-center, vendor, people, evidence, monitor, control, attack-surface, code-security, or platform-coverage analysis.

Command

Prefer an installed binary:

oneleet --help

For one-off package use after publication:

npx -y oneleet-cli --help

For a source checkout:

npm install
npm run build
node dist/cli.js --help

Safety Rules

Do not print, paste, store, or commit the oneleet-app cookie.
Do not commit raw HARs, browser traces, screenshots, storage state, cookie dumps, or full upstream JSON exports.
Prefer aggregate reports and summarized list outputs.
Use --raw and api get --unsafe-raw only for short-lived local debugging.
Mutations must stay limited to explicit typed workflow commands with narrow safety gates. monitors refresh <monitor-ref> triggers a Oneleet monitor rerun for a local monitor-### ref from monitors list.
Default summarized list rows use local ref labels and hasId booleans instead of raw upstream IDs.
Reports should use counts, statuses, categories, and control titles. Avoid names, emails, tenant IDs, filenames, raw URLs, raw upstream IDs, and raw evidence text.

First Checks

oneleet auth status --json
oneleet doctor --json

If auth is missing, ask Daniel to log into Oneleet in Chrome with remote debugging enabled, then import:

oneleet auth import-cdp --port 9333 --json

Best Starting Commands

oneleet coverage check --json
oneleet hipaa report --json
oneleet ops workforce-summary --json
oneleet vendor-risk report --json
oneleet trust readiness --json
oneleet security remediation-queue --json
oneleet monitors refresh monitor-014 --wait 120 --json

Treat scenario reports as coverage for current workflows, not full Oneleet private API coverage. If a scenario still needs raw detail, record it as a typed CLI gap before using api get.

---name: oneleetdescription: Use the Oneleet CLI to inspect Oneleet security and compliance posture through an unofficial read-first private-surface adapter. Prefer summarized JSON and aggregate reports; never print cookies or raw sensitive payloads.---# Oneleet CLI SkillUse this skill for Oneleet compliance, HIPAA, security posture, trust-center,vendor, people, evidence, monitor, control, attack-surface, code-security, orplatform-coverage analysis.## CommandPrefer an installed binary:```bashoneleet --help```For one-off package use after publication:```bashnpx -y oneleet-cli --help```For a source checkout:```bashnpm installnpm run buildnode dist/cli.js --help```## Safety Rules- Do not print, paste, store, or commit the `oneleet-app` cookie.- Do not commit raw HARs, browser traces, screenshots, storage state, cookie dumps, or full upstream JSON exports.- Prefer aggregate reports and summarized list outputs.- Use `--raw` and `api get --unsafe-raw` only for short-lived local debugging.- Mutations must stay limited to explicit typed workflow commands with narrow safety gates. `monitors refresh <monitor-ref>` triggers a Oneleet monitor rerun for a local `monitor-###` ref from `monitors list`.- Default summarized list rows use local `ref` labels and `hasId` booleans instead of raw upstream IDs.- Reports should use counts, statuses, categories, and control titles. Avoid names, emails, tenant IDs, filenames, raw URLs, raw upstream IDs, and raw evidence text.## First Checks```bashoneleet auth status --jsononeleet doctor --json```If auth is missing, ask Daniel to log into Oneleet in Chrome with remotedebugging enabled, then import:```bashoneleet auth import-cdp --port 9333 --json```## Best Starting Commands```bashoneleet coverage check --jsononeleet hipaa report --jsononeleet ops workforce-summary --jsononeleet vendor-risk report --jsononeleet trust readiness --jsononeleet security remediation-queue --jsononeleet monitors refresh monitor-014 --wait 120 --json```Treat scenario reports as coverage for current workflows, not full Oneleetprivate API coverage. If a scenario still needs raw detail, record it as a typedCLI gap before using `api get`.

Frequently asked questions