Security AI Skills

Google Workspace Admin SDK: Audit logs and usage reports.

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger…

Vitest unit testing patterns with React Testing Library. Trigger: When writing unit tests for React components, hooks, or utilities.

Structured task planning with clear breakdowns, dependencies, and verification criteria. Use when implementing features, refactoring, or any multi-step work.

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy…

Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET…

Domain routing and boundary guidance for authorized post-exploitation testing after initial access, including privilege escalation, persistence, lateral movement, data collection, and cleanup…

Use when auditing content quality, E-E-A-T, or publish readiness; runs a typed 80-item CORE-EEAT profile with evidence coverage, veto checks, and a fix plan. Not for structural tags/headers alone —…

WebSocket handshake, CSWSH, tooling (wsrepl, ws-harness, Burp), and common flaws. Use when apps use real-time channels, chat, notifications, or WS-backed APIs.

Multi-dimensional code assessment across security, quality, performance, and maintainability with confidence-gated reporting (>=80%) and Router Contract generation.

IMAP 邮件服务（143/993 端口）渗透测试方法论。涵盖 IMAP 服务发现、Banner 信息提取、凭据爆破、邮箱枚举与邮件下载、IMAP 命令注入、已知漏洞利用。 当 Agent 扫描发现 143 或 993 端口开放、需要测试 IMAP 认证强度、枚举邮箱内容、或利用 IMAP 服务漏洞时，触发此 Skill。

Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or…

Exploit Firebase/Supabase for data via JS config leak probe.

CP-7 retrospective: audit checkpoints, evidence quality, action items, and harvest candidates. Closes the V-model cycle and feeds the next run. Use via /retro after ship, escalate, or significant…

Manage containers using Podman, the daemonless container engine. Run rootless containers, create pods, manage images, and use Docker-compatible commands. Use when working with Podman or requiring…

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron…

Operate Spatie and Freek's hosting with private credentials. Use for requests to move a site to Laravel Cloud, inspect or change DigitalOcean (DO) droplets, manage Forge servers, deploy or…

Security leadership for growth-stage companies. Use when building security programs, selecting compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR), managing incidents, or assessing vendor risk.

CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

Run four parallel read-only subagents that each review the same diff from a different lens — security, performance, correctness, and readability — then merge findings into one report. Use before…

Thin Bevy genre router for Metroidvania. Godot counterpart: godot-genre-metroidvania. Keywords: Bevy, Metroidvania, genre, ECS, router.

Medusa headless commerce - modules, workflows, API routes, admin UI

Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits. Use when creating, updating, or improving skills.

Perform a focused security review of pending git changes to identify high-confidence security vulnerabilities with real exploitation potential. Use this skill when the user asks for a security review,…

This skill should be used when the user asks to "write a SQLScript procedure", "create HANA stored procedure", "implement AMDP method", "optimize SQLScript performance", "handle SQLScript exceptions",…

Reference data, not a reviewer. Review UI for cognitive load, plain language clarity, and WCAG 2.2 cognitive SC (3.3.7, 3.3.8, 3.3.9). Includes COGA guidance, reading level, auth patterns, and timeout…

Use this skill when the user says 'performance audit', 'why is it slow', 'optimize performance', 'page speed', 'Core Web Vitals', 'lighthouse', 'load time', or needs to diagnose and fix frontend or…

Search 21st.dev component registry for production-ready React components. Finds components by natural language description, filters by framework and style system, returns ranked results with install…

Windows local privilege escalation enumeration and attack surface mapping.

Blue-team CLI threat hunt over Windows Event Logs. Sweeps high-signal security events (failed logons, new accounts/services, cleared logs, PowerShell, Sysmon) via native PowerShell or Hayabusa/Sigma,…

Instruments structured Sentry logs in a new or existing application.

End-to-end change-shipping closed loop for non-trivial work — research → proposal doc → phased guarded implementation → PR self-review → harden → merge. Use when taking a substantial change from idea…

Evaluates classifiers and scoring models used as security gates for adversarial robustness, preprocessing differences, thresholds, abstention, and fallback behavior. Use when an authorized assessment…

This skill should be used when the user asks to "find hardcoded secrets", "audit for credential leaks", "check for API keys in code", "review secret scanning alerts", "rotate a leaked secret", or…

Analyze raw shellcode and position-independent code — extracting the bytes, guessing architecture, disassembling at the right base, decoding self-decoder stubs, resolving hashed Windows APIs,…

Check a published security model per repository: is it reachable via `AGENTS.md` → `SECURITY.md` at a named commit, and does it cover the minimum-bar sections? Proposes one fix per failing check (a PR…

Specialized knowledge of Bash and Zsh scripting, shell automation, command-line tools, and scripting best practices. Use when the user needs to write, debug, or optimize shell scripts or work with…

Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized report with concrete fixes. Use when the…

Analyzes PHP code for connection pool issues. Detects connection leaks, improper pool sizing, missing connection release, timeout issues.

Assess product assumptions, operational/security exposure and unresolved variables before a build decision.

动态给对象添加职责。在需要为对象增加功能但又不想改变类本身时使用。

Cryptographic Attacks target implementation flaws and algorithm weaknesses in encryption systems, covering OWASP A04: Cryptographic Failures.

The first non-PowerShell client for the Nerdio Manager for MSP API - cross-account AVD fleet audits, async-job plumbing, and offline search no other Nerdio tool has. Trigger phrases: `list nerdio…

Triage a risk-based alert where an entity's aggregated risk score crossed a threshold — a risk notable built from accumulated risk events across detections, sources, or MITRE tactics. Reads the mix of…

Use when designing and executing load testing, stress testing, endurance testing, spike testing, and performance testing. Includes test planning, test script creation, result analysis, and performance…

Draft or post OpenClaw beta, stable, or extended-stable Discord release announcements from changelog, tag, registry, and validation evidence. Use when announcing a release, release candidate, or…

Advanced RuView capabilities — RuvSense multistatic sensing (attention-weighted fusion, geometric diversity, persistent field model), cross-viewpoint fusion across multiple nodes, RF tomography (ISTA…

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for custom binary or text protocol recovery, handshake reconstruction, framing, sequence control, checksums, stateful…

Build an automated adversary infrastructure tracking system in Python (dnspython, python-whois, shodan, networkx) that pivots across passive DNS, certificate transparency logs, WHOIS records, and IP…

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the…

GitHub operations expert for PRs, issues, code review, Actions, and gh CLI