Security AI Skills

Investigate compromised Docker containers by analyzing images, layers, volumes, logs, and runtime artifacts to identify malicious activity and evidence.

Complete Odoo server lifecycle manager — run, deploy, initialize, and manage Odoo across local venv, Docker, and any IDE. Handles server startup/shutdown, environment initialization, database…

Evidence-first expert knowledge handoff skill. Use when a founder, senior engineer, salesperson, support lead, consultant, or other domain expert is leaving, changing roles, or needs their judgment…

SOC 2 compliance for Terraform — gap analysis, control implementation, evidence collection, and remediation guidance mapped to SOC 2 Trust Services Criteria.

Generate API tests from routes and contracts for authentication, validation, pagination, errors, uploads, and limits in Node.js or Python projects.

Advanced AI safety red team operations covering OWASP LLM Top 10 (2025), prompt injection (direct/indirect/multi-turn), jailbreak techniques (DAN, cognitive hacking, persona-based), data poisoning…

File security analysis (path traversal, upload bypass, XXE, zip slip)

Generate videos directly using the Runway API via runnable scripts. Supports text-to-video, image-to-video, and video-to-video with seedance2, gen4.5, veo3, and more.

Pick the strongest analysis level available, discover and propose new tools when a gap blocks the answer, state the level used, and finish within budget.

Route tasks to specialized sub-agents based on intent classification. Classifies incoming tasks and dispatches them to the most appropriate agent. Use when the user has a task that needs to be…

Scan extension source code for Chrome Web Store rejection risks. Generates report with issues, root causes, and fixes. Use when: review, pre-submit, rejection, CWS compliance, store review.

Roll out governed MotherDuck analytics to internal teams, choosing trusted datasets, access boundaries, and owners.

Apache HTTP Server 配置

Treat everything an agent reads but did not author as data rather than instructions — an explicit trust boundary, a tool set fixed before content is read, consequential calls gated on the user, and…

Configure Kubernetes RBAC bindings, service accounts, namespaces, resource quotas, and service types for pods. Use when writing, reviewing, or auditing Deployments, ServiceAccounts, Roles,…

Systematic troubleshooting of technical issues (services, networking, containers, OS) by running diagnostic commands directly instead of asking the user to.

Use when reading any external input in WordPress — $_GET, $_POST, $_REQUEST, $_COOKIE, REST params, shortcode/block attributes, option/meta values, or remote API responses. Unslashes then sanitizes to…

Verification-matches-the-evidence gate model after @builder — deterministic hook always, @tester only when the sprint declared ux_gate: auto, @security on security surfaces, /code-review on risk or…

Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI…

Use for security and trust boundaries. Triggers: auth, secrets, XSS, CSRF, SQL injection, JWT, OAuth, OWASP, PII, uploads, payments, supply chain, CI integrity, agent security, threat model.

Use when designing agent tool catalogs, tool schemas, action gating, human approval, and human-in-the-loop control for agentic AI systems.

User flow and navigation audit covering information architecture, onboarding, and error states. Use when the user asks for a flow audit, a navigation audit, an onboarding review, or help with a UX…

WCAG 2.2 compliance auditing — color contrast, keyboard nav, screen reader, focus management, touch targets, cognitive accessibility, motion sensitivity, forms, automated testing integration

This skill should be used when several customers, organizations, teams or workspaces share one application and their data must stay apart — and especially when a person can belong to more than one of…

Set up or check claude-mem cloud sync with cmem.ai Pro. Use when the user says "set up cloud sync", "sync my memories", "cmem pro", "cloud backup", "sync status", or wants their memory database backed…

Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to…

/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit,…

The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they have no model of intent. Defines what…

Full website SEO audit with parallel subagent delegation. Crawls up to 500 pages, detects business type, delegates to up to 15 specialists (8 always + 7 conditional), generates health score. Use when…

Use when operating KubeSphere DevOps as a namespace-scoped tenant with limited permissions, without cluster-admin access, or when accessing DevOps through KubeSphere APIs only

Master grep command arsenal for Web3 smart contract auditing. Use when starting a new protocol scan, before deep code review, or when hunting specific vulnerability classes.

Creates Prowler Attack Paths openCypher queries using the Cartography schema as the source of truth for node labels, properties, and relationships. Covers Prowler-specific additions (Internet node,…

Integrates with Atlassian products to manage project tracking and documentation via MCP protocol. Use when querying Jira issues with JQL filters, creating and updating tickets with custom fields,…

识别并修复空泛、模板化、总结腔和其他AI写作痕迹，同时保留作者声音。Use for semantic prose cleanup, not keyword deletion.

Secret management expert. ALWAYS invoke this skill when you need to read API keys, tokens, or other secrets configured by the user. Never hardcode credentials — use this skill to retrieve them…

Detect indirect prompt injection (goal hijack). Instructions hidden in "external" content (documents, RAG, web) that the agent processes. Use when the agent has document/RAG/web/file input.

Deploy a production self-hosted n8n end-to-end to a fresh Linux VM over SSH, using Docker Compose behind a Caddy reverse proxy with automatic HTTPS. Use whenever the user wants to self-host, install,…

This skill should be used when establishing comprehensive QA testing processes for any software project. Use when creating test strategies, writing test cases following Google Testing Standards,…

Verify consequential or disputed game-security claims with primary sources, reproducible evidence, explicit trust boundaries, and calibrated uncertainty. Use alongside a domain skill when evidence…

Solves CTF challenges by performing first-pass triage, identifying the dominant category, and routing execution to the right specialized ctf-* skill. Use when the user gives you a challenge bundle, a…

Idiomatic Golang design patterns — functional options, constructor APIs, `init()` and global-state avoidance, enums, panic vs error decisions, resource management and lifecycle, graceful shutdown,…

A committed project-scope skill used by the agent-scan canary to verify that inspect detects skills under <project>/.claude/skills. No claude CLI creates a standalone project skill, so this fixture is…

Send a diagnostic record over an explicitly external raw socket

Create or modify StackApp infrastructure-as-code manifests and Stack-managed application infrastructure. Use for Stack components, services, profiles, database wiring, storage, authentication,…

Comprehensive guide to Antigravity Manager architecture, workflows, and development. Use this to understand how to work on the project.

Complete career acceleration system — from self-assessment to offer negotiation. Covers career strategy, job search operations, resume/CV optimization, interview preparation, salary negotiation,…

C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改

Migrate downstream Open Mercato code from 0.7.0 to 0.8.0 — audit entry.overrides CLI/worker/scheduler dispatch, sales line discount_amount semantics, AlertDescription ref types, devices API camelCase,…

Web vulnerability hunting playbook. Use after recon, when you have specific hosts/endpoints to test for IDOR/BAC, injection, auth flaws, SSRF, and known CVEs. Emphasizes real PoC + concrete impact.

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces…

Audit local and OpenClaw skill libraries for privacy theft, credential theft, stealthy exfiltration, unsafe execution chains, deceptive instructions, and persistence behavior, then generate a visual…