Security AI Skills

Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'pentest the code', 'OWASP check', or any variation of wanting a…

Interactive HTTPS proxy for API security testing with traffic interception, modification, and replay capabilities. Supports HTTP/1, HTTP/2, HTTP/3, WebSockets, and TLS-protected protocols. Includes…

Configure Better Auth server and client, set up database adapters, manage sessions, add plugins, and handle environment variables. Use when users mention Better Auth, betterauth, auth.ts, or need to…

Triggers — CN: 你是审计夕潮 · 审计模式 · 跑一遍审计 · 代码审查 · 提交前 review · 质量评审 | EN: You are Auditor Yushio · Audit mode · Code review · Pre-commit review · Quality review | JA: あなたは監査夕潮です · 監査モード · 監査して | KO: 당신은…

Review Sui Move code that integrates OpenZeppelin Contracts for Sui against the library's own patterns and conventions. Use this when a developer wants their integration checked before shipping.…

Design and implement end-to-end client onboarding workflows from prospect intake through funded account, covering KYC verification, document collection, e-signature, and custodian submission. Use when…

Auditing a service's production readiness against Ring engineering standards across base dimensions plus a conditional multi-tenant dimension, then emitting a scored report and an HTML dashboard. Use…

MANDATORY skill that activates whenever the OpenSpec design phase begins. Triggers: /opsx-new or /opsx-continue runs; openspec-new-change, openspec-continue-change, or openspec-explore is active;…

Authenticate with the Woz service. Use when the user needs to log in or when authentication is required.

AI可读性审计工具，模拟AI爬虫视角评估网站对大语言模型的友好程度，分析结构化数据、语义HTML和Meta信息

CI/CD pipeline design, optimization, DevSecOps security scanning, and troubleshooting. Use this skill whenever the user mentions CI/CD, GitHub Actions, GitLab CI, pipelines, workflows, builds, or…

Design system architecture and high-level technical strategy

Perform deep analysis of CVEs and security vulnerabilities including CVSS scoring, affected versions, exploit maturity, and remediation steps. Use when the user needs detailed vulnerability…

Inspect one SkillRadar skill for purpose, provenance, quality signals, security grade, maintenance, and suitability before installation or use.

Design privacy-aware observability for AI agents using traces, spans, structured events, metrics, cost attribution, dashboards, alerts, and investigation workflows. Use when instrumenting an agent,…

Run CodeRabbit CLI reviews, retrieve saved local or GitHub PR fix prompts, and interpret CodeRabbit authentication and review output. Use for CodeRabbit review commands, committed/uncommitted or…

Run an iterative code-improvement hill-climb against real Datadog LLM-Obs data, locally, with Claude Code as the agent. Establishes a baseline eval, makes one focused change, re-scores with the same…

Autonomous multi-agent crypto trading skill for Robinhood Chain EVM DEX tokens and NFTs using 3-layer Swarm Consensus, Discord Command Center, and Position Management.

Measures test coverage and code quality in a repository with the supercov CLI, and turns what it finds into small, focused tests or fixes. Use when the user asks to add or improve tests, find untested…

Use when working with Payload projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries,…

Operar Hermes Agent em produção no VPS — update, restart de gateway, health-check, profiles múltiplos e ambientes sem systemd user bus.

Quantified code review: 12 questions (design, bugs, security, tests, error handling, observability), severity scoring, a four-axis composite score and a deployment verdict (SHIP IT / FIX FIRST / RISKY…

Integrate projects with TabzChrome terminals via Markdown links, HTML attributes, WebSocket, JS API, or Spawn API

Linux 用户态安全入侵检测与取证工具，专为 AI Agent 设计。自动判断服务器是否被入侵， 提供完整证据链和可执行修复建议。51 个安全分析器覆盖进程/网络/认证/持久化/Rootkit/ 恶意软件/内存取证/容器逃逸等 12 类检测维度，10 个数据采集器全面采集系统状态， 映射 103+ MITRE ATT&CK 技术，支持 standalone/docker/k8s 三种部署模式。…

Reverse engineer .NET assemblies and executables with dnSpyEx, ILSpy, and de4dot — identifying and unwrapping obfuscators and packers, deobfuscating control flow and string encryption, handling…

Read-only activity card for a named contributor on `<upstream>` across code-host and tracker surfaces. Code-host and tracker activity only; use `contributor-nomination` for a full brief.

Blue-team release-gate analysis for smart contract deployment and upgrade readiness. Classifies repositories, checks deploy/upgrade execution paths, CI/CD trust boundaries, config drift,…

Complete Tier 2 investigation workflow. Orchestrates deep investigation of escalated cases: deep-dive-ioc, correlate-ioc, specialized triage (malware/login), pivot-on-ioc, and generate comprehensive…

当目标为 Android APK / 预装应用 / 厂商系统应用（HyperOS/MIUI/工程模式/OTA/诊断工具），或需要组件安全深度挖掘（导出组件/Intent 重定向/WebView/JSBridge/ContentProvider/Binder/Deep Link）、密钥追踪→未授权接口（DEX/SO/H5 提取 appId/appKey/签名密钥还原）、无 Root 无 Frida…

Living Architecture Map — auto-generate Mermaid diagrams of your codebase. Use when user wants to visualize architecture, understand code structure, generate diagrams, or document system design.

Create production-ready FastAPI projects with async patterns, dependency injection, and comprehensive error handling. Use when building new FastAPI applications or setting up backend API projects.

Optimize for search engine visibility and ranking. Use when asked to "improve SEO", "optimize for search", "fix meta tags", "add structured data", "sitemap optimization", or "search engine…

Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches.

Usar antes de aceptar una dependencia nueva. También: auditar paquete, licencia, CVEs, transitivas, bundle, npm install, pip, cargo add.

Manages Neo4j Aura Agents via the v2beta1 REST API — create, list, get, update, delete, and invoke Aura agents backed by an AuraDB instance. Use when configuring Aura Agent tools (CypherTemplate,…

Install and configure Open Index as the read/write context layer for a domain-specialized agent. Use when setting up a legal, marketing, customer support, sales, infrastructure, or other domain agent…

Prepare and check trusted macOS hosts for physical Android and iPhone tests with agent-device, ADB, and Xcode, or set up iPhone Mirroring separately.

Design and implement immutable, hash-chained audit logging for accountability (LGPD Art. 6, X) and incident registration (Res. 15/2024 Art. 10, 5-year retention). Use when user asks 'audit log', 'log…

Auto-apply security basics and block deploys that would leak secrets. Never ask the user about security choices — just do it, and run a real secret scan before going live.

Orchestrate dozens-to-hundreds of subagents from a script Claude writes (Claude Code Dynamic Workflows, trigger `ultracode`). Use when a task exceeds a single agent's context or needs more than ~4…

squirrelscan audits websites for SEO, performance, security, accessibility, content, and structured data issues (300+ rules) and scores site health, via the squirrel CLI. Use when the user wants to…

Diagnose and fix MCP configuration/runtime issues across supported integrations using agents CLI checks.

Designs or reviews HTTP, REST, GraphQL, RPC, CLI, webhook, event, and service interfaces with explicit inputs, outputs, errors, compatibility, idempotency, pagination, authentication, versioning, and…

Cloud Security Engineer role bundle for cloud security posture management, IaC review, container security, and identity governance across AWS, Azure, and GCP. Orchestrates cloud-specific posture…

Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks OpenClaw to add a note, list notes, search notes, or manage note…

Run the idea-to-ship pipeline AUTONOMOUSLY, in character as a grounded founder-persona — composing ideate → deep-dive → prompt-pack → build-loop to take a real, grounded niche to a…

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

Design clean, scalable, and maintainable REST and GraphQL APIs following industry best practices. Use when designing public or internal APIs, planning endpoint structures, defining request/response…

Cloud-native SaaS architecture methodology extending Twelve-Factor with three additional factors (API First, Telemetry, Security). Use when planning SaaS tools, product software architecture,…

Comprehensive project audit — security, dependencies, code quality, architecture, performance, infra, docs, and mesh analytics. Use when needing a full 8-dimension health-score snapshot before a major…

Fact-check public docs, verify a README against a repo, audit release notes, or find stale/overstated claims using supplied evidence. Advisory findings only. Not for standalone code/security review,…