Seguretat
Anàlisi de seguretat i detecció de vulnerabilitats
ctct-security-patrol
CTCT-CT2
OpenClaw 安全巡检工具，一键执行系统安全扫描并生成通俗易懂的报告。 使用场景：用户说"安全巡检"、"安全检查"、"安全审计"、"巡检"、"security audit"、"检查安全"、"系统安全"等。 触发条件：任何与 OpenClaw 安全检测、审计、巡检相关的请求。
secureclaw
adversa-ai
Security skill for OpenClaw agents (7-framework aligned). 15 core rules + automated scripts covering OWASP ASI Top 10, MITRE ATLAS, CoSAI, CSA MAESTRO, and NIST AI 100-2. Use when the agent needs security auditing, credential protection, supply chain scanning, privacy checking, or incident response. By Adversa AI (https://adversa.ai). v2.2.0.
secureclaw
adversa-ai
Security hardening toolkit for OpenClaw. Run audits, apply fixes, scan skills, monitor costs and memory integrity.
adversarial-code-review
third774
Review code through hostile perspectives to find bugs, security issues, and unintended consequences the author missed. Use when reviewing PRs, auditing codebases, or before critical deployments.
evaluator
mickeyyaya
Use when the user invokes /evo:evaluator or asks to evaluate, assess, score, or independently audit code quality, project health, or improvement priorities with multi-dimensional scoring and anti-gaming defenses
spec-to-code-compliance
lv416e
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
workleap-chromatic-best-practices
workleap
Workleap's Chromatic best practices for snapshot cost control and CI optimization. Use this skill when: (1) Auditing or implementing Chromatic cost optimizations in a repository (2) Fixing Chromatic TurboSnap-disabling patterns (barrel imports, large preview dependencies, local scripts) (3) Setting up or updating chromatic.config.json and GitHub Actions CI workflows for Chromatic (4) Reviewing PRs for Chromatic snapshot cost impact (5) Configuring Chromatic in Turborepo/monorepo projects
differential-review
lv416e
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
sharp-edges
lv416e
"Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration."
minimalism
mickeyyaya
Use in any coding session when writing or changing code — enforces the laziest solution that actually works (YAGNI, stdlib-first, shortest diff) while never trimming validation, error handling, security, accessibility, or the pipeline's tests/gates. Also triggers on "minimalism", "be lazy", "simplest/minimal solution", "yagni", "do less", "shortest path", or complaints about over-engineering, bloat, boilerplate, or unnecessary dependencies.
skill-issue
build000r
Create, update, and package skills for AI coding agents. Use when asked to "create a skill", "make a skill", "new skill", "skill template", "design a skill", "build a skill", or when working with SKILL.md files, frontmatter, bundled resources (scripts/, references/, assets/), or .skill packaging. Also triggers on "how do I make a skill", "skill best practices", "skill structure", or requests to extend an agent's capabilities with reusable workflows.
audit-context-building
lv416e
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
firebase-apk-scanner
lv416e
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
code-review-simplify
mickeyyaya
Use when reviewing code changes for quality, security, performance, or maintainability issues and identifying simplification opportunities in a single token-efficient pass
code-review
PaulRBerg
This skill should be used when the user asks to "review code", "review PR", "code review", "audit code", "check for bugs", "security review", "review my changes", "find issues in this code", "review the diff", or asks for pull request review or code audit.
lampson-system-design
copyleftdev
Design systems using Butler Lampson's principles of abstraction, interfaces, and practical wisdom. Emphasizes clean abstractions, security foundations, and time-tested design hints. Use when making architectural decisions, designing APIs, or building systems that must evolve over decades.
mem-weekly
zephyrwang6
AI个人记忆系统的周复盘功能。分析本周L1情境层记录，识别重复模式，提炼到L2行为层。使用场景：(1) 用户说"周复盘"时；(2) 每周定期回顾时；(3) 需要从日常记录中提炼行为模式时。该skill会自动统计重复出现的行为（3次+），生成候选列表，等待用户确认后更新L2行为层。
mem-file-scan
zephyrwang6
AI个人记忆系统的文件扫描回顾功能。扫描Obsidian仓库中本周修改的文件（排除AI_MEMORY目录），识别潜在的重要事件和决策。使用场景：(1) 用户说"文件扫描"、"查看本周文件"、"扫描文件变化"时；(2) 周复盘时补充L1记录前；(3) 用户想回顾本周在Obsidian中的活动时。该skill会列出修改的文件，询问用户哪些需要记录到L1，并辅助记录。
security-audit
srstomp
Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.
servicenow-server-security
DanielMadsenDK
Secure data and credentials using cryptographic operations, encryption, and authentication primitives. Covers GlideDigest (hashing), GlideCertificateEncryption, KMFCryptoOperation, OAuth credential lifecycle, and request signing. Use when encrypting sensitive data, managing cryptographic keys, signing requests, verifying certificates, performing hash operations, or managing stored credentials. For setting up outbound HTTP API connections to external systems, use the servicenow-http-integrations skill.
pdf-look-scanned
vladmdgolam
Make PDF documents look like they were scanned on a physical scanner. Applies realistic effects: grayscale conversion, Gaussian noise, slight rotation, blur, edge shadows, and random offset. Optionally extract real handwritten signatures from a source PDF (or user-provided images) and replace digital signatures on specific pages. Use when the user asks to: make a PDF look scanned, give a PDF a scanned appearance, replace digital signatures with real/handwritten ones, fake a scan, add scan effects to a document, or make a document look printed and scanned.
feature-audit
srstomp
Use when verifying feature completeness against PRD requirements, identifying gaps between backend implementation and user-facing accessibility, generating remediation tasks, or auditing across frameworks (Next.js, React Router, TanStack, React Native, Expo).
api-design
srstomp
Use when designing new REST APIs, reviewing API designs, establishing API standards, designing request/response formats, pagination, versioning, authentication flows, or creating OpenAPI specifications.
security-first-2025
JosiahSiegel
Security-first bash scripting patterns for 2025 (mandatory validation, zero-trust)