Security AI Skills

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we…

Security auditing skill following OWASP Top 10 and SANS Top 25. Use when reviewing code for vulnerabilities, handling user input, or implementing authentication/authorization systems. Based on OWASP…

Build and maintain modern WordPress plugins and MCP servers, including hybrid WordPress+MCP products. Use when implementing plugin architecture (PHP, REST API, Gutenberg/admin/page-builder…

Design or critique a login / sign-up screen. Applies the always-true core (separate pages, minimal fields, inline validation, full password-reset flow) and gates context-dependent choices (social…

Stop coding agents from shipping generic UI. Use UIZZE's 800,000+ real web and iOS screens to build product-specific interfaces, define a design contract, cover required states, and run a hard finish…

Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to extract HTTP/DNS transforms, URIs, headers,…

Gmail: Show unread inbox summary (sender, subject, date).

Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++. Replaces raw pointers with smart pointers, SFINAE…

Creates comprehensive Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec",…

Amazon search and category listing scraper: extract product listings from any Amazon search results page, keyword search URL, or category browse page and return per-item cards (asin, title, url,…

This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on…

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct…

Deep security audit covering OWASP Top 10, authentication, authorization, data protection, dependency vulnerabilities, and secrets scanning. Delegates to the Centinela (QA) agent.

Audit connected MCP servers for token overhead, redundancy, and security. Use when sessions feel slow or before adding new MCPs.

Binary protection bypass playbook. Use when identifying and bypassing ASLR, PIE, NX/DEP, stack canary, RELRO, FORTIFY_SOURCE, CET, and MTE protections in ELF binaries to enable exploitation.

Azure 云环境渗透测试总体方法论。当目标使用 Azure/Microsoft 365/Entra ID、发现 Azure 相关资产（Blob Storage/App Service/Azure VM/Azure Functions）、获取 Azure 凭据（Service Principal/Managed Identity/Access Token）、或需要对 Azure…

Create or review Terraform infrastructure and plans. Use for cloud resources, IAM, networking, state management, and infrastructure changes.

Use when the user mentions security review, App Store submission prep, Privacy Manifest requirements, hardcoded credentials, or sensitive data storage.

Implement feature flags for progressive feature rollout using LaunchDarkly, Unleash, or custom solutions. Control feature visibility, perform A/B testing, and enable trunk-based development. Use when…

Use when you need to control Slack from OpenClaw via the slack tool, including reacting to messages or pinning/unpinning items in Slack channels or DMs.

Technical SEO - robots.txt, sitemap, meta tags, Core Web Vitals

Implement backup strategies, disaster recovery plans, and data restoration procedures for protecting critical infrastructure and data.

Exploit LDAP injection vulnerabilities during authorized penetration testing.

Synthesizes supplied, evidence-backed reconnaissance and structural-path outputs into an opaque organizational exposure profile with preserved lineage, freshness, contradictions, privacy boundaries,…

Using lib-observability/tracing for OTEL provider lifecycle, trace-context propagation across HTTP/gRPC/queues, span error/event recording, and PII redaction, in two modes. Sweep Mode detects raw OTEL…

Plan, implement, or review google cloud waf security work in an existing codebase with compatibility, security, and verification controls. Use when the user explicitly requests google cloud waf…

Audit dependencies for licensing, security, and maintenance risk. Use when a senior developer needs risk assessment.

Attack Bluetooth Classic, BLE, and NFC targets -- device enumeration, GATT characteristic exploitation, BLE MITM and replay, Ubertooth and nRF sniffing, MIFARE Classic cracking, Proxmark3 card…

End-to-end testing with Playwright 1.50+, fixtures, and Vitest 3+ / Pengujian E2E dengan Playwright 1.50+, fixtures, dan Vitest 3+.

Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities — including custom security implementations such as hashing passwords with…

Swarm audit of a repository: Workflow fleet of single-lens Sonnet investigators, adversarial verification, Opus interpreters and critic, 10-minute check-ins, kill and respawn, nothing unreviewed.

Use when creating, updating, reviewing, restructuring, or harmonizing a repository's project README from verified local evidence for user-oriented or developer/library-oriented readers, with…

Ship a hosted Summer multiplayer game: the bundle, server preset, pre-upload checks, a new Build.

Zoom Team Chat MCP server guidance for channel, message, contact, session, and file search/read workflows plus write-capable message and channel operations. Use for Team Chat MCP endpoints, OAuth…

End-to-end penetration test project management skill. Orchestrates the full engagement lifecycle from scoping through reporting, managing skill composition, evidence chains, and phase transitions.

Code review skill for analyzing code quality, detecting bugs, and ensuring best practices. Use proactively when user requests code review, quality check, or bug detection. Triggers: code review,…

Manage Huawei Cloud ModelArts Notebook instances through full lifecycle operations via hcloud CLI. Covers 31 API interfaces across 7 functional domains: instance management…

Use when reviewing code for security vulnerabilities, OWASP Top 10 compliance, secure coding standards, authentication/authorization patterns, and vulnerability remediation. Includes static analysis,…

Generate deterministic code and pipeline recipes for automating prior authorization (PA) workflows: parsing X12 278 and FHIR PAS requests, extracting clinical features, rules-based adjudication,…

Use when a coding task should be driven end-to-end from issue intake through implementation, review, deployment, and acceptance verification with minimal human re-intervention.

Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom protocols to reverse-engineer beacon patterns, command structures, data encoding, and infrastructure (primary servers, fallback…

Use when reviewing, scoring, or auditing third-party SaaS / vendor relationships — running a vendor scorecard with industry tuning, tracking SLA compliance with credit-claim flags, classifying…

Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.

Creates Cursor-specific AI subagents with isolated context for complex multi-step workflows. Use when creating subagents for Cursor editor specifically, following Cursor's patterns and directories…

Extracts full item detail from any open eBay item URL, returning JSON with url, itemNumber, title, subTitle, categories, price, priceWithCurrency, currency, wasPrice, available, availableText, sold,…

Give the AI agent its own EVM wallet with admin-controlled policies the agent CANNOT bypass even under prompt injection. Encrypted keystore (AES-256-GCM, scrypt KDF), policy file the agent has no tool…

Use this skill when reviewing or writing code that handles user input, authentication, file I/O, network requests, or database queries. Always check for common security vulnerabilities before…

Use when the user asks to "build a B2B cold-outbound sequence", "design reply-triage branching", "plan a domain warmup / sending throttle", or "make my outbound CAN-SPAM / opt-in compliant"; produces…

CI/CD 流水线与供应链攻击方法论。当发现目标使用 GitHub Actions/Jenkins/GitLab CI/CircleCI/Terraform Cloud/Atlantis 等 CI/CD 系统、需要测试流水线安全性、或发现 .github/workflows/Jenkinsfile/.gitlab-ci.yml 等配置文件时使用。覆盖 PPE（Poisoned Pipeline…

Build production-ready Web3 applications, smart contracts, and decentralized systems. Implements DeFi protocols, NFT platforms, DAOs, and enterprise blockchain integrations. Use PROACTIVELY for smart…

Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN:…