Security AI Skills

Comprehensive XSS vulnerability detection skill with 14 layers of checks for React/TypeScript/JavaScript codebases (static audit). Use when the user wants an in-depth XSS audit with broad static…

Operates Flounder, an autonomous white-hat security auditor. Use when a user asks for a security audit, bug-bounty review, vulnerability investigation, or exploit proof for a public-source or…

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose…

End-to-end, approval-gated video editing workflow for arbitrary user-selected video, audio, and optional image media. Use when Codex must scan footage, review and classify material, develop a topic…

Implement comprehensive audit logging and reporting for multi-agent systems. Covers event capture, structured logging, traceability, compliance reporting, forensic analysis, and real-time monitoring…

Operate the 10xProductivity assistant inbox workflow. Use when running or debugging 10x-host, Slack self-DM polling, macOS notification triggers, scheduling runtime, or trigger-to-workflow routing.

GoPlus AgentGuard — AI agent security guard. Run /agentguard checkup for a full security health check, scans all installed skills, checks credentials, permissions, and network exposure, then delivers…

结束审计会话，汇总审计数据，执行完整性检查，保存到 .claude/runs/。当用户说"完成了"、"结束"、"暂停"、"今天到这"，或当前任务已完成需要保存审计记录时使用。

Bug bounty and security audit engine — trust-first iterative hunting. The "3rd eye" for pentesting.

Execute one bounded RED to GREEN experiment from bead or caller intent; return derived subject identity and check facts. Triggers: "implement", "implement this bead", "run the experiment". Full…

后端开发 Agent — API 设计、数据库优化、服务器端逻辑、认证授权、性能优化

Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 173 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt…

Enforces design review gate after brainstorming — bridges superpowers:brainstorming into the metaswarm quality pipeline

The single interface for building, improving, and debugging exo workflows. Routes to one of three intents. BUILD takes a rough idea, or an agent template slug from the ghostsecurity.ai catalog,…

微信小程序全自动安全审计 Skill。使用 Agent Teams 编排 Agent，分阶段完成从反编译到报告生成的全流程静态安全分析。覆盖敏感信息泄露、API接口提取、加解密算法分析、漏洞分析四大维度。采用"脚本预扫描 + LLM智能分析"双层架构，脚本保证覆盖率，LLM保证准确率。

Comprehensive Android APK security audit with static analysis, dynamic instrumentation, source-to-sink tracing, IPC/component abuse analysis, and CVSS 4.0 reporting. Covers decompilation, manifest…

Web accessibility patterns for news and academic sites. Use for WCAG audits, alt text, accessible data viz, and assistive tech.

Use when developing features for the noodle terminal REST client — adding panes, keybindings, hooks, overlays, auth types, body types, I/O operations, environment features, importers, CLI flags, or…

Use when attacking a Windows Active Directory domain — Kerberos roasting/delegation, coercion + NTLM/Kerberos relay (CVE-2025-33073), ADCS ESC1-16 (EKUwu), ticket forgery & DCSync, dMSA BadSuccessor…

Reviews code for security vulnerabilities and guides secure implementation using OWASP Top 10:2025, ASVS 5.0, the OWASP Top 10 for LLM Applications (2026), and the OWASP Top 10 for Agentic…

Evaluates code against Apple's App Store Review Guidelines. Use this skill when reviewing iOS, macOS, tvOS, watchOS, or visionOS app code (Swift, Objective-C, React Native, or Expo) to identify…

Generate and interpret security-research diffs between Windows versions or patch levels using this repo's WinDiff CLI and databases. Use when comparing Windows builds or binaries such as ntoskrnl.exe,…

Use whenever security, policies, governance, guardrails, compliance, or safety are relevant — including blocked commands, audit trails, dangerous operations, deletions, file modifications, shell…

Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.

Reverse engineering assistant powered by Ghidra. Use for binary analysis, decompilation, vulnerability research, auditing compiled code, renaming symbols, annotating disassembly, cross-references, or…

Run an enterprise pre submission compliance audit on a mobile app project before uploading to the Apple App Store or Google Play. Use when the user is about to submit, ship, or release an iOS or…

Analog, VHS, CRT, and found-footage horror aesthetics for Blender shots including camera imperfections and documentary framing.

Adds automated accessibility (a11y) testing to test suites on TestMu AI cloud by enabling WCAG scans through driver capabilities. Framework-agnostic, works with Selenium, Playwright, and Cypress. Use…

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web…

Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode…

Security hardening toolkit for OpenClaw. Run audits, apply fixes, scan skills, monitor costs and memory integrity.

Use OpenHunterAI to prepare and run authorized web, API, and AI/LLM application security assessments from a local workspace. Use when asked to red-team an owned application, configure OpenHunterAI…

Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'.…

Research and advise on the best way to approach a software project, including architecture, tech stack, implementation strategy, pricing/operating-cost tradeoffs, benchmark research, and comparisons…

Ревью изменений с фокусом на безопасность по стандартам команды. Используй перед мерджем или по просьбе проверить безопасность.

Generates Architecture Decision Records capturing context, rationale, alternatives, and consequences in numbered status-tracked format. Triggers on: "write an ADR", "document this decision",…

Parse C source code into an Abstract Syntax Tree (AST). Use when analyzing C programs, understanding code structure, performing static analysis, or preparing code for further program analysis (e.g.,…

DSH 插件适配与破坏性变更核查，兼造插件脚手架与性能架构审计。run.mjs 一键编排全流程并把每次运行写进本地日志（list 回看、doctor 交叉核对宿主日志、sanitize 脱敏后才能外发）；查 DeepSeek 官方最新版本，取该版本的官方升级指南，扫描本机插件代码（package 命中自动到目标宿主 node_modules…

Interview the user about a product idea and write PRD.md. Use at the start of a new project, before features, rules or RFCs exist.

Use for any password, API key, token, credential, secret, or 1Password task, including finding credentials, injecting them into commands or env files, saving new API keys, checking or updating login…

Writes an implementation plan as a file artifact in the task directory (.ork/tasks/TASK/NN-plan-SLUG.md) with phases, exact file changes and runnable success criteria, so reviewers comment on the file…

Use when scanning code for security vulnerabilities. Use when user says "scan security", "kiểm tra bảo mật", "security audit", "review security", or invokes `/vbs-scan-security`. For large scans (>20…

Use when a request involves Ethereum, the EVM, or blockchain systems. Applies to building, auditing, deploying, or interacting with smart contracts, dApps, wallets, or DeFi protocols. Covers Solidity…

NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for…

General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find…

Guides Claude in creating well-structured SKILL.md files following best practices. Provides clear guidelines for naming, structure, and content organization to make skills easy to discover and…

Use when Codex needs to coordinate ChatGPT, Chrome, Cloudflare tunnels, verified bridge Restart/Reboot recovery, or task routing between local code execution and ChatGPT reasoning/review. Handles the…

<What this skill does in 2-3 sentences. Focus on technique scope and when to use it. No trigger phrases, negative conditions, or OPSEC details here.>

Use when analyzing owned or authorized software artifacts for source recovery, architecture mapping, security auditing, dependency review, and defensive remediation.

Autonomous, looping, multi-altitude security vulnerability hunting for source code using RAPTOR's inventory-first generate-judge-verify methodology. Use by default when the user points to a repo,…

Use when adding existing remote MCP servers from a local client inventory to an explicit Speakeasy AI Control Plane project, including discovering which servers are missing.