Security AI Skills

Eight-step epic build cycle — reads state.yaml, execution-status.yaml, and one epic capsule; updates status via bp-yaml-set or direct edit. Resume mode runs one step per invocation. Use instead of…

Discover, inspect, safety-check, and rank open Agent Skills before installing them. Use when an agent needs to find a skill for a task, compare candidate skills, inspect provenance or risk, or avoid…

Deploy and configure 3proxy — a lightweight universal proxy server. Use when a user asks to set up HTTP, HTTPS, SOCKS4, SOCKS5, or transparent proxies, build proxy chains, configure authentication,…

Run a structured 5-pass finishing audit on any website before launch — scoring visual polish, technical foundation, UX completeness, content quality, and cross-device readiness on 100 points. Use…

This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle…

Analyze iOS applications at the binary level — decrypting FairPlay-protected IPAs with frida-ios-dump or bagbak, inspecting Mach-O load commands, recovering Objective-C headers with class-dump, and…

Read-only brief showing a contributor's activity next to the project's committer or PMC reference levels, as plain numbers. Surfaces information only: no ranking, no status, no readiness verdict — the…

Detects input validation failures and arithmetic vulnerabilities in smart contracts. Covers missing zero-address and zero-amount checks, division-before-multiplication precision loss, rounding…

Show whether each skill is earning its context-window cost — combined tokens-used view sorted by waste. Use when the user asks 'are my skills worth it', 'what's my context budget', 'which skills are…

当需要在不对 APK 全量反编译的前提下秒级定位硬编码密钥/签名函数/隐藏接口/调试后门，或 APK 过大（>100MB）JADX 全量反编译过慢、内存吃紧，或脱壳产物（裸 dex）需要快速检索，或只想先读一下 Manifest 组件面/权限清单时调用。负责基于 Droid ASC 的零预处理快速定位（findrefs 全局交叉引用搜索 + getclass 按需反编译 + Manifest…

Code review with principal-engineer-level depth. Reviews for correctness, performance, security, maintainability, and architecture. Use when completing tasks, reviewing PRs, or before merging.

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to…

Crear pull requests completas con descripcion, labels y reviewers

WordPress CI/CD and release engineering review guidance. Use when reviewing GitHub Actions, deployment pipelines, Composer/npm build steps, plugin/theme packaging, release automation, secrets…

Paid API marketplace for AI agents via Corbits. Search hundreds of premium API proxies, call them with automatic USDC micropayments (x402 protocol), and fund the payment wallet with MoonPay. Use when…

Home Assistant custom integration development in Python. Covers custom_components, DataUpdateCoordinator, config_flow, OAuth2, conversation agent, HACS publishing, device registry, entity platforms,…

Encrypt PDFs with AES-128, AES-256, or RC4 options and decrypt authorized PDFs with ComPDF. Use for PDF passwords, permission controls, encryption, decryption, and document-access protection.

Local better-auth documentation reference (1.6.18). Better Auth documentation. Use for TypeScript authentication, OAuth, email/password, 2FA, organizations, sessions, and framework-agnostic auth.

Virtual CISO role bundle for organizations without a full-time CISO. Orchestrates security program assessment, compliance readiness, risk management, and board-level reporting. Auto-invoked when the…

Build Wails v2 desktop apps around Go backends: typed bindings, lifecycle, storage, native builds and package evidence. Use after Wails is explicitly selected.

Run the personal-information protection impact assessment required by PIPL Articles 55-56: test the five mandatory triggers, then draft the three-part assessment (lawfulness, necessity and legitimacy…

Finds the outlier reels of Instagram accounts or videos of TikTok accounts (3x their own account's median views or more) through Treg and turns the 5 best into remake scripts in the creator's voice.…

Add authentication with Better Auth (TypeScript). Use for email/password, OAuth providers (Google, GitHub), 2FA/MFA, passkeys/WebAuthn, sessions, RBAC, rate limiting.

Use when asked to simplify, clean up, tidy, or refactor code for clarity without changing what it does, or when the user says "simplify this", "clean this up", "make it readable", "reduce the…

Use when the user is designing customer identity, authentication, or migrating from email-based IDs. Triggers on phrases like "primary key", "customer ID", "user identifier", "email as ID", "GUID",…

Improves Cairo performance after correctness is established. Trigger on "optimize", "gas usage", "reduce steps", "profile", "BoundedInt", "storage packing", "benchmark". Guides profiling, arithmetic…

Reviews pull requests and code changes for quality, security, and best practices. Use when user asks for code review, PR review, or mentions reviewing changes.

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds…

Game-theory review loop for AI drafts: tit-for-tat trust tracking across review rounds. Review depth adapts to the author's track record of addressing feedback, so clean drafts earn lighter reviews…

Manages Docker secrets for GitLab stack projects, ensuring secrets are never in .env or docker-compose.yml, properly stored in ./secrets directory, and securely integrated with Docker secrets. Use…

Deep Socratic grilling and interrogation protocol to stress-test assumptions, clarify non-functional requirements, and resolve edge cases before design.

Drupal Composer management — requiring modules, updates, patches via composer-patches, and version constraints.

Configure PostPeer lifecycle notifications for scheduled, published, partial, and failed posts through webhook endpoints or email recipients. Use when the user asks for webhooks, callbacks, alerts,…

DRAFT. Design and harden a standing Luma registration/unsubscribe webhook that enriches guests and writes to CRM or customer DB — with backfill and versioning. Not installed by deepline skills.

LLM-driven autonomous penetration testing framework operations covering PentestGPT, HexStrike AI, Viper, PentestAgent, AI-Infra-Guard, AutoPWN, and custom agent harness patterns — including reasoning…

Expert guidance for Git workflows, branching strategies, and version control best practices. Use when managing repositories, resolving conflicts, or establishing team workflows.

This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF",…

Run a read-only dual-verification security audit (Semgrep + Codex cross-validation). Use when: user says "security review", "audit code", "scan for vulnerabilities", "is this safe", "check for…

Run all specialist deep-dive skills in parallel for comprehensive analysis

A diagnostic tool for OpenClaw agents -- checks skill registry connectivity, AGENTS.md setup, config file validity, and installed skill health. Use when your setup seems broken, skills aren't loading,…

Validate agent configuration against its actual runtime schema.

Create, audit, or compact repository instructions in AGENTS.md, scoped overrides, and requested tool compatibility files. Use to preserve non-obvious project rules while removing stale, duplicated, or…

OpenClaw skill for the agent-browser CLI (Rust-based with Node.js fallback) enabling AI-friendly web automation with snapshots, refs, and structured commands.

Get system information for diagnostics

Existing project takeover skill: 4-phase governed runtime (Analysis → Review → Planning → Execution) for understanding, auditing, and surgically improving any existing codebase. Integrates Bug Fixer…

AI risk assessment using NIST AI RMF 1.0 framework. Evaluate AI systems across 4 core functions (Govern, Map, Measure, Manage) for trustworthy and responsible AI deployment.

Set up or troubleshoot MotherDuck connections, the MotherDuck MCP server in AI clients, authentication, client runtimes, and read scaling.

Remediate one specific vulnerable container image and deliver the fix as a PR/MR, a tracking ticket, or both — this skill is the sole ticket creator in the Sysdig vulnerability workflow. Deduplicates…

排查和管理企业连接器、连接配置与受控调用。

Emit and validate the §1.19 machine-readable companions: threat-model.yaml using schema threat-model-sidecar/v2, and the flat threat-model.json export conforming to schema.json. USE WHEN an…

Linux file and directory operations