Security AI Skills

Audit Chrome extensions for security issues, best practice violations, performance problems, and CWS compliance. Scans manifest, code, CSP, message handlers, storage, and dependencies.

Senior-level Android engineering expertise for Jetpack Compose, Material 3, shared element transitions, navigation, performance, security, background work, notifications, adaptive layouts, Coil image…

Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your…

10-dimension × 4-role code review skill. Fuses full-spectrum audit (security, logic, concurrency, performance, error handling, dependencies, consistency, architecture, testing, docs/CI) with…

Guides source code auditing of open-source AI IDEs for security vulnerabilities. Use when reviewing AI IDE source code, analyzing command filtering implementations, auditing MCP integration code, or…

Deep-dive usability evaluation of specific user tasks. Simulates novice user cognition step-by-step to identify learnability issues, unclear actions, and points of confusion.

Full-featured Nextcloud integration for Hermes — manage files, notes, tasks, calendar events, and contacts via WebDAV, Nextcloud Notes API, and CalDAV/CardDAV. Works with self-hosted Nextcloud…

Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and…

Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities and generate reports. Use…

Give cited, advisory-only Splunk alert, scheduled-report action, Enterprise Security finding/notable, and risk-workflow readiness guidance from supplied evidence. Use for schedule, trigger,…

Yandex Direct (API v5/v501) advertising audit, management, and optimization for Unified Performance Campaigns (ЕПК) and combinatorial ads. Full account audits, campaign management, keyword and…

Use when grading, reviewing, rewriting, or approving a Hermes Agent SOUL.md. Uses the SOUL.md field-guide research artifacts as the only normative source for what makes a good SOUL.md.

Draft phase 3.5 of a threat model from the orientation brief, surface analysis, and maintainer answers. USE WHEN writing threat-model.md to the canonical §1.1–§1.19 structure. Combines concise prose…

**WORKFLOW SKILL** - Iteratively improve skill frontmatter and routing clarity. WHEN: "run sensei", "sensei help", "improve skill", "fix frontmatter", "score skill", "check skill tokens". INVOKES:…

Kubernetes ConfigMap 与 Secret

Handle requested Agent Dispatcher work with direct execution or prepared specialist guidance. Includes named roles, context inspection and controls.

WCAG 2.2 compliance, ARIA authoring patterns, screen reader and keyboard navigation, color contrast, and cognitive/neurodiversity accommodations. Use when auditing accessibility, fixing a11y…

Use when evaluating, comparing, installing, or recommending a Claude Code plugin, Agent Skill, MCP server, agent toolkit, or GitHub-hosted AI extension, especially when popularity is weak evidence or…

Remediate Orca Security code-repository alerts end to end — change the code, validate, assess production impact, open a pull request, notify. Use whenever someone asks to fix, remediate, or patch…

Apply suggested security fixes from a prior code review. Use when the user wants to remediate security findings with before/after code diffs, severity filtering, and explicit approval before modifying…

童锦程视角：以"深情祖师爷"、直播情感内容创作者的思维框架看待人际关系、社会动态与个人成长。 平台兼容：GitHub Copilot、Claude、Qwen Code、OpenCode、Cursor。 素材来源：9个一手视频字幕（直播/约会vlog/搭讪解析），约20万字。 核心模型：5个。决策启发式：9条。 触发词：「童锦程」「深情祖师爷」「用童锦程的方式」「从童锦程视角」「景辰怎么看」…

Security best practices and vulnerability prevention guidelines

v5 — Write Hebrew content indistinguishable from a native Israeli human. Generates, rewrites, or detects AI patterns in Hebrew text. 9-layer system with Variation Fingerprint Engine: Hebrew-first…

僅在使用者明確要求用 $three-tier-agent-orchestrator 或 Three-Tier Agent Orchestrator 執行任務時啟用。由主線程承擔 GPT-6.1 Sol 統籌與複雜推理角色，以 GPT-6.1 Terra 處理視覺、電腦操作、文字與範圍明確的程式修正，以 GPT-6 Luna Max 處理可重複工作。詢問、安裝、修改或發布本 skill…

Build OpenTelemetry collector configs, instrument services, transform telemetry with OTTL, and debug missing traces, metrics, or logs. Use for OTel/otelcol collector config, OTLP export, SDK…

Use when registering or handling WordPress AJAX over admin-ajax.php - wp_ajax_{action} / wp_ajax_nopriv_{action} hooks, JavaScript that posts to admin_url('admin-ajax.php'), or wp.apiFetch / fetch…

When a decision becomes an ADR: the default is no, only durable decisions qualify, search first, one decision per ADR. Use inside a /speq-plan, /speq-record, or /speq-audit run.

Authoring, approval, immutability, and supersession of Architecture Decision Records (ADRs) in the Agile V lifecycle. Load when recording a significant, long-lived architectural, platform, tooling, or…

Use this skill for a reproducible WeChat Official Account workflow with dual channels (API draft and/or Chrome browser publish) and production default draft_notify_feishu: API draft/add then Feishu…

Experimental Agent Teams orchestration — run CC_GodMode agents as parallel teammates with SharedTaskList coordination (requires CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1)

Search ETHGlobal hackathon projects, sponsor bounties, prize winners, and qualification requirements. Use when the user asks about ETHGlobal hackathon projects and winners, sponsor bounties, prize…

Comprehensive Flutter development patterns covering widgets, testing, performance, security, and animations. Use when you need quick reference for Flutter best practices, common UI patterns,…

Audit, initialize, and maintain migration from a Claude Code harness to a Codex harness. Use for /claude-codex-harness-sync setup to inventory Claude global/project harnesses and produce a Codex…

Use when implementing accessible web content following WCAG 2.1 AA standards, semantic HTML, ARIA attributes, keyboard navigation, and screen reader support. Includes accessibility testing, compliance…

Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature — signing users in and out, sessions and tokens, guarding routes…

@DataJpaTest requires TestEntityManager + flush()/clear() before assertions — without this, tests read from Hibernate L1 cache and pass falsely. Read before writing any JPA test. Triggers:…

Scan your OpenClaw configuration for security risks and harden it with guided fixes. Supports three hardening levels. Use when asked to "security check", "安全检查", "security audit", "harden my setup",…

Headless, reproducible browser automation with Playwright for any project — screenshots of web pages or local dev servers (desktop/tablet/mobile, full page or one element, single page or every…

Runs a deliberately small, hand-curated security sweep across a repo. Finds secrets committed to git, SQL/shell injection patterns, XSS sinks, path traversal, dangerous deserialization, missing cookie…

操控没有合适 API 的 Windows 桌面 app 并留下可复现取证。用于枚举和读取原生窗口、后台窗口截图与桌面合成交叉验证、探测 CLI/COM/协议/CDP/UIA、通过 UIA 语义写入，以及在前两层不通时经安全闸短暂借前台做坐标点击、滚动、Unicode 输入与按键。普通网页优先用浏览器工具；UAC/凭据/付款/提交不操作。

Systematically audit and remediate accessibility issues in UI, focusing on keyboard navigation, screen reader support, color contrast, semantic HTML, ARIA usage, and motion sensitivity. Use when the…

Conduct accessibility audits against WCAG 2.2 guidelines. Evaluate pages, components, and flows for conformance at A, AA, and AAA levels. Identify issues, assess severity, provide code fixes, and…

Accessibility and inclusive design to WCAG 2.2 AA - contrast, keyboard and focus, semantic HTML and ARIA, screen readers, forms, motion and seizure safety, touch targets, reflow/zoom, alt text,…

Use when developing ASP.NET Core applications - Minimal APIs, dependency injection, middleware, Entity Framework Core, SignalR, authentication (JWT/Identity), configuration, health checks, caching,…

Current website-building expertise for an AI: research, design, code, accessibility, performance, search and security. Research, design, build, audit, and prepare websites for release. Use for a new…

Audit or fix accessibility issues (WCAG 2.1 AA) in HTML, Vue, Svelte, or Astro files. Checks images, ARIA, keyboard navigation, forms, and semantic HTML. Usage: /front-a11y [fix]

**MANDATORY for ALL MCP server work** - mcp-use framework best practices and patterns. **READ THIS FIRST** before any MCP server work, including: - Creating new MCP servers - Modifying existing MCP…

Comprehensive GitHub code review with AI-powered swarm coordination

Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a…

Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds…