Security AI Skills

Use when starting any conversation involving bundle-plugins — blueprinting, scaffolding, authoring, auditing, testing, optimizing, or releasing. Also use when feeling unsure which bundles-forge skill…

Use when the user wants to turn one or more Entire-tracked sessions, checkpoints, or repeated agent workflows into a reusable agent skill.

Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code…

Run a bounded Sakana Fugu repository task or explicit review through codex-fugu. Use when the user types /fugu, asks to use Fugu, or asks for a Fugu review.

Transform extracted engineer expertise into an actionable skill with progressive disclosure, allowing agents to find and apply relevant patterns for specific tasks.

Chain multiple bigpowers skills into a custom workflow recipe saved in specs/. Use when a project repeats a non-standard skill sequence, or user wants a documented playbook beyond orchestrate-project…

Plan, implement, or review application insights instrumentation work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests application…

Generate or update documentation for code, APIs, or systems

Threat-model and harden AI agents, RAG systems, assistants, and tool-using workflows against direct, indirect, stored, cross-agent, and multimodal prompt injection. Use when reviewing an agent…

Systematically analyze existing media to extract transferable elements for new settings. Use when adapting TV, film, or games to fiction, translating tropes across genres, or transforming genre…

Enforce web security and avoid security vulnerabilities

Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis. Use when reviewing a codebase or diff for security bugs,…

Skill for integrating Better Auth - the comprehensive TypeScript authentication framework.

Measure contributor-sentiment signals on `<upstream>` over a window: thread tone, time-to-first-reply, first-PR retention, and reviewer load. Compares signals against baseline to generate a mode…

Systematically detects all reentrancy vulnerability variants in smart contracts — classic, cross-function, cross-contract, and read-only reentrancy. Builds call graphs, verifies CEI…

Use when installed Hermes skills must be audited for overlap, staleness, broken references, usage-integrity problems, and dead weight without changing the installation.

当目标涉及云资产（对象存储/云元数据/Serverless）、容器/K8s、运维面板（宝塔/Grafana/Zabbix/Jenkins/GitLab/Nacos等）、消息队列/缓存中间件、CI/CD流水线、第三方回调集成、依赖组件CVE、信息泄露配置时调用。负责未授权访问、弱口令、云配置错误、供应链漏洞与敏感信息挖掘。

Demo-Ready Mode — prepare your app for demos, screenshots, and presentations. Use when user wants to demo their app, take screenshots, prepare for a presentation, or clean up dev artifacts.

Abrir y operar el companion visual de Selina para elegir una direccion de estilo en proyectos con interfaz. Skill manual: levanta un servidor local y escribe artefactos visuales.

WordPress performance code review and optimization analysis. Use when reviewing WordPress PHP code for performance issues, auditing themes/plugins for scalability, optimizing WP_Query, analyzing…

Version-aware guide for configuring and running Apollo Router for federated GraphQL supergraphs. Generates correct YAML for both Router v1.x and v2.x. Use this skill when: (1) setting up Apollo Router…

SE Ranking AI visibility analyst (extension). Tracks AI Share-of-Voice across ChatGPT, Gemini, Perplexity, AI Overviews, and AI Mode in a single query.

Export a monorepo into review-ready zip bundles for a non-agentic frontier model (GPT Pro on the ChatGPT web UI, or any chat model with file upload) — node_modules-free, secret-free, split by…

Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail…

Use when drafting a Data Processing Agreement (DPA) compliant with UAE Federal Decree-Law 45/2021 on Personal Data Protection (UAE PDPL). Covers UAE PDPL key requirements, the separate DIFC (Law…

Benchling Python SDK and REST API integration for registry entities, inventory, ELN entries, workflows, Benchling Apps, and Data Warehouse queries. Use when automating lab data with benchling-sdk or…

Builds and deploys Docker containers on Render—Dockerfiles, multi-stage builds, Blueprint Docker fields, private registries, layer caching, and platform constraints. Use when the user mentions Docker,…

Claim the single next governance todo (marks in_progress).

Use when introducing ANY external dependency into the project — npm packages (`npm install` / `pnpm add` / `yarn add`), GitHub repo content fetched via curl / WebFetch, external workflow JSON files…

Coordination protocol for main Claude Code agent. Explicit user invocation required ("mobilize agents", "coordinate", "check registry"). Provides agent orchestration, registry management, and handoff…

Bridge to Starknet from any EVM chain and register with Huginn agent registry. Enables cross-chain agent onboarding with AVNU bridge integration.

Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.

Review a change with an optional workflow contract using deterministic scope, adaptive cross-model reviewers, verified findings, fixes, and a gate. Use standalone or from wf-impl.

Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases an adversary has completed, where defenses succeeded or failed, and what controls would have…

Detects skill name shadowing and description-overlap conflicts that cause OpenClaw to trigger the wrong skill or silently ignore one when two skills compete for the same intent.

Establishes idempotency, self-containment, immutable artifacts, self-healing, zero-downtime, and zero-knowledge security for CI/CD pipelines, including delivery-strategy choice, evidence-gated…

Catalyst serverless functions — all 7 types (Basic I/O, Advanced I/O, Event, Cron, Job, Integration, Browser Logic), handler signatures, catalyst-config.json, Security Rules, API Gateway routing, file…

Security configuration analysis (Headers, CORS, Docker, CI/CD, Cloud, K8s)

Operate an InboxAPI mailbox from ZeroClaw through the official InboxAPI CLI. Use when the user wants the agent to search mail, read messages or threads, send new email, forward mail, inspect…

Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks to add a note, list notes, search notes, or manage note folders.

Senior architect workflow: 5-phase governed runtime (Pre-Research → Requirements → Draft → Planning → Execution) with brainstorm deep-thinking at critical decisions.

Write and run HTTP API tests in Hurl's plain-text format. Use when testing REST/GraphQL APIs, writing integration or smoke tests for HTTP endpoints, chaining requests with captured values, polling…

Use when the user wants to upload or schedule a TikTok video through Publora, with privacy, comment, duet, stitch and commercial-disclosure settings. Video runs 3 seconds to 10 minutes at 23+ FPS;…

Look up or repair DuckDB SQL syntax and verify MotherDuck-specific command and feature support.

管理 Skill 的提交、审批、上架与安装。

Write shift, daily, weekly, executive and incident reports in BLUF style with risk expressed in business terms, and save them with save_report; use whenever a report or summary for humans is requested…

Linux system administration and monitoring

Traces any Orca alert back to who deployed it, what tool was used, what introduced the issue, and a full timeline of events. Use when user asks about origin, deployment, or ownership of an alert…

Use when building dynamic blocks or block-editor features - a render_callback, server-side rendered blocks via ServerSideRender, REST-backed block data, or register_rest_field for the editor.…

Verification loop for Django projects: migrations, linting, tests with coverage, security scans, and deployment readiness checks.

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management…