Security AI Skills

Reviews DeerFlow skill packages for readiness, triggers, safety boundaries, resources, and evidence. Invoke when users ask to audit, grade, or production-check an existing skill.

Reverse engineer and security-review Chrome/Firefox browser extensions — unpacking the CRX/XPI, reading the manifest for over-broad permissions, and tracing the trust boundary between page, content…

Read-only audit of GitHub Actions runner compatibility for one repository, a repository set, one Apache project, or the full Apache org. Finds obsolete GitHub-hosted runner labels and macOS…

当目标为 Windows PE 程序（EXE/DLL/SYS/驱动）、.NET 程序、Windows 服务、内核组件，或需要静态/动态逆向分析挖掘缓冲区溢出、远程命令执行、权限提升、信息泄露、拒绝服务等二进制漏洞时调用。负责反汇编/反编译分析、内存破坏漏洞挖掘、协议逆向、反调试对抗、漏洞利用链构造、shellcode 编写与 PoC 验证。

Automated penetration testing — web, API, browser, GitHub, and local code. Zero false positives. Use when user wants to hack-test their app, find vulnerabilities, or run security pentesting.

Use when building high-performance async Python APIs with FastAPI and Pydantic V2. Invoke to create REST endpoints, define Pydantic models, implement authentication flows, set up async SQLAlchemy…

Configure and operate the Neo4j Connector for Kafka (sink + source) and the native Neo4j CDC API. Covers Cypher/Pattern/CUD sink strategies, CDC-based and query-based source, exactly-once semantics,…

Build local semantic review slices by combining clawpatch feature maps, deepsec threat candidates, visual review maps, and optional gitcrawl/discrawl evidence for repos such as openclaw/openclaw.

Reviews a GitHub pull request or focused branch diff for correctness, regressions, security, compatibility, test gaps, and maintainability. Use when an implementation needs an independent source-aware…

Governor｜重大结论与完成声明的独立证据复核者。需要独立复核重大结论、发布、安全、资金、法律或完成声明，并给出放行门决定或风险升级时调用。 不适用：需要设计与实现交付物、替领域负责人作专业判断、替 CEO 作资源取舍，或声明方无法提供可复核证据。

Performs a structured DNS security review against NIST SP 800-81 Rev 2 (Secure Domain Name System Deployment Guide) and CIS Controls v8 (Control 9.2 -- Use DNS Filtering Services). Auto-invoked when…

Review security-sensitive code as HALO treats an untrusted model — the reviewer is a fallible monitor, so demand independent evidence, re-verify stale verdicts, check the worst case, and fail closed.…

Prevent panics, silent corruption, and subtle runtime bugs in Go: typed-nil interfaces, slice aliasing, integer overflow on conversion, float comparison, defer in loops, defensive copying at API…

Security vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.

React Query and Zustand patterns for state management. Use when implementing data fetching, caching, mutations, or client-side state. Triggers on tasks involving useQuery, useMutation, Zustand stores,…

Zoom OAuth authentication and authorization. Covers four authorization flows: Account (S2S), User (authorization code), Device (device flow), and Client (chatbot). Use when implementing authentication…

Use when auditing Python code involving file path operations (os.path.join, pathlib), file upload/download, archive extraction (tarfile, zipfile), or file inclusion. Covers CWE-22/23. Keywords: path…

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

Infrastructure skill for application UI observation, scoped action, waits, and CUA trajectory recording when a typed DCC tool cannot expose the needed interface. Use this skill when the user asks for…

Log out of Corezoid: remove saved credentials for the current workspace from `~/.corezoid/config.json`. Activate when the user says "logout", "log out", "sign out", "disconnect", "выйти",…

Complete CI/CD guide for Capacitor apps covering GitHub Actions, GitLab CI, build automation, app signing, and deployment pipelines. Use this skill when users need to automate their build and release…

Layer-2 blockchain attack — Lightning Network (BOLT, HTLC), Optimistic Rollups (Optimism/Arbitrum/Boba/Base), ZK Rollups (zkSync/StarkNet/Polygon zkEVM/Scroll/Linea), Polygon PoS, Gnosis sidechain,…

Design, implement, and audit provably fair RNG and cryptographic seed workflows for casino games. Use when defining commit-reveal architecture, server/client seed lifecycle, nonce progression,…

Administer MotherDuck service accounts, tokens, Ducklings, and Dive embed sessions through the control-plane REST API.

Expert guidance on wendy-agent runtime interop with the SaaS stack: polling for changes, verifying operator-signed requests, and pulling images. Use when developers mention: (1) the postbox or device…

Route SOC work across the agent swarm — decide which specialist handles a case next, write a complete handoff message, and stop cleanly; use whenever you are the commander or must decide who acts…

Generates SEO and AEO optimized blog posts from source content. Supports feature announcements, product launches, thought leadership, cookbooks/tutorials, report conversions, and news analysis.…

Triage a cloud control-plane alert where an actor stages, copies out, or destroys data and resources — sharing or exporting snapshots, disks, or AMIs, downloading volumes at scale, unmasking sensitive…

Enforce SPIFFE/SPIRE plus mTLS for agent-to-agent communication. Use when designing, building, or reviewing authentication between AI agents or multi-agent systems.

Use when adding HTTP response headers to a WordPress site or plugin: Content-Security-Policy (or Report-Only), X-Content-Type-Options, frame protection (X-Frame-Options or frame-ancestors),…

Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention…

Power Platform integration patterns with Azure services. Use when: Service Bus, Azure Functions, webhook, event-driven, hybrid, on-premises gateway, VNet, integration pattern, Event Grid, Azure Relay,…

Decide what to build first, or critique a prioritization. Derives criteria from strategy, picks the right framework for the context (RICE/ICE/MoSCoW/Kano/Impact-Effort), scores to expose trade-offs…

Use when integrating an LLM provider into an application with streaming, structured outputs, tool calls, embeddings, multi-model routing, retries, caching, and usage metering, or when choosing regex,…

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login…

Analyze Windows Shellbag (BagMRU) registry artifacts with SBECmd and Shellbags Explorer to reconstruct folder browsing activity and prove user interaction with directories, including removable media…

Execute any of 240+ specialized prompt patterns natively across Extraction, Summarization, Analysis, Creation, Improvement, Security, Rating. Common: extract_wisdom, create_threat_model,…

Ansible automation expert for playbooks, roles, inventories, and infrastructure management

Creates new Prowler cloud providers or adds services to existing providers. Trigger: When extending Prowler SDK provider architecture (adding a new provider or a new service to an existing provider).

Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-less email verification flow into an Android app.…

This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission", "decide if a finding is valid", "review a security finding",…

The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills, scans skills before…

Diagnostic protocol to run before reporting a sandbox blocker or asking for a configuration change. Eight checks that eliminate false positives, then a report template the person holding the settings…

JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header…

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill…

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities",…

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are…

Diagnose and transform any authorized video URL, upload, recording, transcript, podcast, interview, presentation, screen recording, webinar, ad, or published video into the strongest justified content…

Inspect or modify Letta Code's own memory, model, context window, system prompt, compaction, permissions, toolsets, mods, skills, channels, schedules, agent secrets, and local runtime settings. Use…

Domain routing and boundary guidance for authorized operating system command injection testing, including direct injection, blind injection, out-of-band callbacks, and argument injection. Use when a…

Run the one-command quality gate and report the real N/N result. Use before claiming any build/review is done.