Security AI Skills

当目标存在评论/昵称/富文本/私信/工单/搜索反射/Markdown解析/AI输出渲染/前端DOM操作/postMessage/跨域配置等功能时调用。负责反射型/存储型/DOM XSS、AI/Markdown 渲染型存储 XSS、CSRF、CORS错误配置、Clickjacking 的深度挖掘与绕过。命中跳转页/开放重定向/target 参数驱动 location 跳转时优先测试跳转型…

Run Lighthouse performance audit with auto-fix for common issues. Use when user wants to check or improve site performance.

Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting…

Flutter Security. Use when reviewing security, implementing auth, or hardening code.

PE (Linus Torvalds)｜已批准的设计需要跨模块实现、集成、测试、代码评审、缺陷修复或可回退交付时调用。 不适用：设计尚未批准、需要产品或优先级取舍、架构边界存在争议，或只需窄领域专家给出专项建议而不承担跨模块实现。

Caching Strategies knowledge base. Provides caching patterns (Cache-Aside, Read-Through, Write-Through, Write-Behind), invalidation approaches, multi-level caching, and Redis data structures for…

Performs a structured firewall rule base audit against CIS Controls v8 (Controls 4.4 and 4.5) and NIST SP 800-41 Rev 1 (Guidelines on Firewalls and Firewall Policy). Auto-invoked when reviewing…

NIS2 scope and obligations triage (Directive (EU) 2022/2555) - a scope navigator in fixed order: is the entity in scope at all (Annex I and II sectors, size-cap rule, size-independent exceptions),…

Review security-sensitive code changes before they ship — injection, broken auth, access control, secrets, data exposure — for diffs touching auth, user input, APIs, databases, or credentials. Use…

Simulating users to evaluate existing flows and generate synthetic demand: cognitive walkthroughs, feature requests, unmet needs, JTBD, and opportunity trees. Not real-user research.

Use when auditing Python code involving HTTP client calls (requests, httpx, urllib, aiohttp), webhook endpoints, proxy forwarding, file/model downloads, or SVG/XML external resource loading. Covers…

Blockchain & Web3 security — Solidity/Vyper smart contract auditing, DeFi attack vectors (flash loans, MEV, oracle manipulation), bridge attacks, wallet security, with tooling from…

Provide cited, read-only Splunk Enterprise administration guidance for routine local users, roles, capabilities, configuration precedence, service ownership, maintenance readiness, and safe…

Enforce authentication for agents connecting to MCP servers via MCP clients. Use when designing or reviewing how AI agents authenticate to MCP servers.

Use when building an options or settings page with the WordPress Settings API - register_setting, add_settings_field, settings_fields, an options.php form, or update_option / get_option on plugin…

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the…

Use when designing or building an LLM gateway for provider abstraction, tenant-aware routing, fallbacks, quotas, residency, audit logging, cost capture, and kill-switch enforcement.

Meta-skill for comprehensive web design reviews. Orchestrates all 20 domain skills for systematic analysis of websites, designs, and prototypes against enterprise design standards.

Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up…

Reviews DeerFlow skill packages for readiness, triggers, safety boundaries, resources, and evidence. Invoke when users ask to audit, grade, or production-check an existing skill.

Test RAG vector stores (Pinecone, Qdrant, Weaviate, Chroma, pgvector, FAISS) for embedding inversion, cross-tenant data leakage, and data poisoning per OWASP LLM08:2025. Use when performing an…

Socket command threading and focus policy for cmux CLI/socket work. Use when adding or changing socket commands, CLI commands, telemetry commands, focus/select/open/close/send-key behavior, or…

Updates the "Prowler at a Glance" table in README.md with accurate provider statistics. Trigger: When updating README.md provider stats, checks count, services count, compliance frameworks, or…

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or…

Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your…

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection…

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact,…

Host security hardening and risk-tolerance configuration for Brigade deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, Brigade cron…

Domain routing and boundary guidance for authorized source code security review, including dangerous function tracing, data-flow analysis, logic flaw detection, and dependency review. Use when a task…

Validate a filename extension without opening any filesystem path

SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.

Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks OpenClaw to add a note, list notes, search notes, or manage note…

供应链安全审计与攻击。当指纹识别发现 WordPress/Jenkins/Struts/Django 等已知框架、或发现 /package.json /composer.json /package-lock.json /Gemfile 等依赖声明文件时使用。也适用于发现 CI/CD 构建系统（Jenkins/GitLab…

Build standalone email, shipping, payment, data-sync, webhook, storage, import/export, and external API provider integrations with packaging, encrypted credentials, idempotency, retries, cursor…

Agent wallet on the Stripe Link CLI (link-cli). Connect the wallet, then buy, purchase and pay for things on the user's behalf via approved spend requests, one-time-use cards, and 402 / Machine…

Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews…

Use when auditing an authorized website, SaaS, API, AI app, local code path, GitHub repo, staging URL, or owned runtime for security risks, vulnerability checklist scoring, static review, dynamic…

Step of the email-lifecycle playbook: audits list, consent, live flows, recent sends and sending setup, marking every item verified, from-you or unknown. Run email-lifecycle instead; not for direct…

This skill should be used when user asks to "deploy to Hetzner", "create Hetzner server", "manage Hetzner Cloud", "hcloud CLI", or works with Hetzner Cloud infrastructure including servers, networks,…

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS,…

Create, search, and manage Bear notes via grizzly CLI.

NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200…

Deep code property graph analysis with Joern CPG (AST+CFG+PDG) and CodeQL for control flow, data flow, taint analysis, and security auditing

MANDATORY agent discovery system for token-efficient agent loading. Claude MUST use this skill instead of loading agents directly from ~/.claude/agents/ or .claude/agents/. Provides lazy loading via…

Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind.…

Network infrastructure testing - port scanning, DNS attacks, MITM, VLAN hopping, IPv6, SMB/NetBIOS, sniffing, and DoS assessment.

Run semgrep via the mantis_semgrep MCP server and triage results into the candidate/confirmed/rejected lifecycle

Terse "caveman" reply style, full technical accuracy. CAVEMAN=auto (default): on for development (write / fix / refactor / deploy), off for analysis / docs / review; on / off override. Force on:…

JWT, OAuth2, SAML, session management, RBAC, ABAC, and MFA implementation

Tighten a README: a one-line description, install steps that work, and a minimal usage example.

Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK emulation plans, rules of engagement,…