Security AI Skills

Secure authentication patterns (OWASP, NIST). Use for login, registration, password reset, sessions, JWT, OAuth, MFA, passkeys.

When the user needs a technical SEO audit, on-page optimization guidance, or help resolving crawlability, indexation, or performance issues that affect search rankings.

Universal demo video creator for skills, agents, plugins, tutorials, CLI commands, and code walkthroughs. Generates scripts, storyboards, VHS terminal recordings, and Remotion video compositions with…

Analyze custom applications, scripts, and binaries that standard technique skills could not exploit. Performs source code review, attack surface mapping, CVE research, and PoC adaptation. Route here…

Assesses network protocol exploitation candidates while separating observed service behavior, advisory applicability, reproduced faults, demonstrated impact, authorization, disruption risk, telemetry,…

Secure API authentication with JWT, OAuth 2.0, API keys. Use for authentication systems, third-party integrations, service-to-service communication, or encountering token management, security headers,…

Design and implement integration architectures connecting financial systems — APIs, FIX protocol, ISO 20022, event-driven patterns, batch feeds, idempotency, and resilience. Use when building…

Routes Snowflake-related operations to Cortex Code CLI for specialized Snowflake expertise. Use when user asks about Snowflake databases, data warehouses, SQL queries on Snowflake, Cortex AI features,…

Expert in on-chain privacy technologies - ZK-SNARKs, ZK-STARKs, mixers, stealth addresses, ring signatures, and confidential transactions for building privacy-preserving blockchain applicationsUse…

This skill should be used when the user asks to "triage security findings", "fix an Aikido finding", "review Aikido issues", "dismiss a false positive", "check SAST/IaC alerts", or needs to work with…

Investigate security incidents in Amazon Web Services -- reconstruct attacker activity from CloudTrail, VPC Flow Logs, and GuardDuty, anchor the investigation on the compromised principal (access key…

Walk an adopter through the first-time install of the secure agent setup (sandbox, approval and clean-environment layers) for Claude Code, Codex, Antigravity, Pi or Goose. Interactive throughout;…

Whole-repo audit for over-engineering. Like ponytail-review, but scans the entire codebase instead of a diff: a ranked list of what to delete, simplify, or replace with stdlib/native equivalents. Use…

Creates or guides creation of greenfield Oracle Fusion Cloud 26B implementation users with the minimum Functional Setup Manager role grant.

Security - React Native Best Practices. Use when reviewing security, implementing auth, or hardening code.

Analyzes PHP code for cryptography issues. Detects weak algorithms, hardcoded keys, insecure random, poor key management, deprecated functions.

Execute a workload migration from x86 (amd64) to AWS Graviton (arm64) — set up the Arm migration MCP server for code, dependency, and container arm64-readiness scanning, then run the migration —…

Implement comprehensive security patterns to protect applications against OWASP Top 10 vulnerabilities including XSS, CSRF, SQL injection, authentication bypass, and data exposure. Use when handling…

Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing…

Remediating known failure patterns automatically from Triage diagnoses and Beacon alerts: runbooks with safety-tier classification, staged verification, rollback. Use for automated remediation.

Reasoning skill for healthcare claims billing rules and fraud detection logic. Use when the user asks about CMS billing rules, place of service codes, global surgery periods, modifier usage (25 59 76…

Detect and respond to in-container threats at the syscall level using Falco (eBPF-based, CNCF, open-source, no license cost). Covers Falco installation on EKS/GKE with eBPF driver, custom rule…

Simulator.Company environment setup specialist. Use when the user wants to connect to Simulator.Company, set up credentials, authenticate, configure the workspace, or start working with Simulator for…

Applies governance, lineage, ownership, and sensitive-data controls to data changes. Use when a pipeline touches published datasets, regulated information, or shared business metrics.

Apply defense-in-depth by layering multiple independent security controls. Use when reviewing system architecture, evaluating whether a single control is the only barrier, or assessing blast radius of…

Design or critique how a product prevents, surfaces, and recovers from errors — input/validation errors, system & network failures, AI/prediction failures, destructive actions, and 404/dead-end pages.…

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

Harden AI/LLM deployments against prompt injection, data exfiltration, model theft, and supply chain attacks.

Coordinate parallel code reviews across multiple quality dimensions with finding deduplication, severity calibration, and consolidated reporting. Use this skill when organizing multi-reviewer code…

Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score…

Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit…

Query curated cybersecurity market and company intelligence. USE WHEN security market data OR cybersecurity funding OR cyber M&A OR security-company/investor research OR market maps OR deal activity…

Launch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.

Server management principles and decision-making. Process management, monitoring strategy, and scaling decisions. Teaches thinking, not commands.

Phishing campaign execution methodology for authorized red team engagements. Covers end-to-end campaign lifecycle: infrastructure provisioning (GoPhish, SMTP relay configuration, domain acquisition…

思维链 (Chain-of-Thought) 注入攻击方法论。当目标系统使用 ReAct/CoT 框架进行多步推理、 Agent 依赖中间推理结果做决策、或需要测试思维链完整性时触发。 覆盖: 思维链干扰注入(伪造中间 Agent 结果)、思维链操纵注入(跳过验证步骤直接调度敏感操作)、 查询注入(在数据查询 Agent 中注入恶意查询语句)。

Configure Grafana Loki for log aggregation and analysis. Set up Promtail for log collection, write LogQL queries, and integrate with Grafana for visualization. Use when implementing lightweight log…

结构化系统优化扫描工作流，适用于显式 optimize、性能评估、体验评估或代码质量扫描场景；默认输出问题与建议，不直接改代码。

Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi works but VPS/tailnet does not, or errors…

JavaScript static analysis agent for client-side security review. Use for analyzing JS bundles, finding hardcoded secrets, tracing DOM XSS source-sink flows, identifying postMessage handlers,…

Expert knowledge for Azure Confidential Computing development including decision making, architecture & design patterns, limits & quotas, security, configuration, integrations & coding patterns, and…

Multi-agent orchestration with container-isolated workspaces — each agent session runs in its own Docker container with independent git branches

Review PL self-approvals, estimates, board drift, and close quality after a declared night shift. Loaded ONLY by the cos core via its routing table; NEVER auto-load from context or invoke directly.

Pre/post dev toolbox — named bundles of skills/agents loaded before development work and councils of experts invoked after. Run /toolbox or the toolbox.py CLI to list, activate, initialize, export,…

Drives iOS/Android mobile devices via Appium MCP. Runs a preflight, picks local emulator/simulator/USB or a device cloud, captures screenshots/page source into a named evidence dir. Use for verifying…

Correlation, confidence scoring, and conflict resolution across all tech-stack signals. Cross-validates and assigns High/Medium/Low confidence per technology.

Expert backend architect specializing in scalable API design, microservices architecture, and distributed systems. Masters REST/GraphQL/gRPC APIs, event-driven architectures, service mesh patterns,…

Reference data, not a reviewer. Integrate GitHub Accessibility Scanner. Detects configuration, parses scanner issues, correlates with local scans, and tracks Copilot-assigned fixes.

Create or redesign enterprise AI, automation, security, and operations product pages that explain system boundaries, approvals, auditability, exceptions, and rollback. Use for dark cinematic heroes,…

Pre-deployment security audit organized by OWASP Top 10. Use when reviewing code before shipping or going to production.

Use when implementing exception mapping or RFC 9457 error responses in Spring Boot 4. Preserve an existing legacy error contract unless migration is requested.