Seguretat

port-scanner

AIDotNet

扫描网络端口以检查可用性和检测运行的服务。

code-reviewer

nahisaho

Copilot agent that assists with comprehensive code review focusing on code quality, SOLID principles, security, performance, and best practices Trigger terms: code review, review code, code quality, best practices, SOLID principles, code smells, refactoring suggestions, code analysis, static analysis Use when: User requests involve code reviewer tasks.

security-auditor

nahisaho

security-auditor skill Trigger terms: security audit, vulnerability scan, OWASP, security analysis, penetration testing, security review, threat modeling, security best practices, CVE Use when: User requests involve security auditor tasks.

design-reviewer

nahisaho

Copilot agent that assists with systematic design review using ATAM (Architecture Tradeoff Analysis Method), SOLID principles, design patterns, coupling/cohesion analysis, error handling, and security requirements Trigger terms: design review, architecture review, ATAM, SOLID principles, design patterns, coupling, cohesion, ADR review, C4 review, architecture analysis, design quality Use when: User requests involve design document review, architecture evaluation, or design quality assessment tasks.

search-aptos-examples

iskysun96

"Searches aptos-core and daily-move for reference implementations before writing contracts. Triggers on:

planner-rt-ica

Jamie-BitFlight

Identify required inputs, dependencies, and uncertainty during planning. Use when generating plans or task graphs under incomplete information. Does not block plan generation; instead localizes gaps and creates unblock dependencies.

Security review

itzikiusa

A focused, single-lens security review of a change. The one specialist a user runs alone when they care about exploitability — not a general sweep. Core method is taint tracing - follow untrusted input from its source, across the trust boundary, to a dangerous sink - and prove the path is reachable before calling it a finding. Covers injection (SQL/NoSQL/command/LDAP), XSS, SSRF, path traversal, insecure deserialization, authn/authz gaps (missing permission checks, IDOR), secret handling, sensitive-data exposure in logs/errors/URLs, crypto misuse, and unsafe defaults. Every finding cites file:line, a severity (a real exploit path is a blocker), the concrete attack, and a fix.

skeptic-security

data219

Use when changes affect secrets, authentication or authorization boundaries, dependency vulnerabilities, threat exposure, or secure rollout decisions under delivery pressure.

always-on-agent-safety

curiositech

Safety, privacy, cost management, and frank advice for building always-on AI agents with episodic memory. Covers data hygiene, privacy risk surfaces, runaway cost prevention, scope creep, psychological effects of persistent AI companions, and responsible deployment patterns. This is the skill that tells you what can go wrong and how to prevent it. Activate on: "agent safety", "always-on agent privacy", "agent cost control", "persistent agent risks", "AI companion safety", "agent data hygiene", "runaway agent costs", "parasocial AI risk", "/always-on-agent-safety". NOT for: architecture design (use always-on-agent-architecture), input design (use always-on-agent-inputs), application brainstorming (use always-on-agent-applications), healthcare compliance specifically (use hipaa-compliance).

validate-implementation-plan

b-mendoza

Audit and annotate an AI-generated implementation plan for requirements traceability, YAGNI compliance, and assumption risks. Use when reviewing, validating, or auditing an implementation plan or design proposal produced by an AI agent.

auth-module-builder

patricio0312rev

Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection. Provides auth routes, middleware, security configurations, and threat model documentation. Use when building "authentication", "login system", "JWT auth", or "session management".

product-management

ProjAnvil

Expertise in product management lifecycle, from ideation to launch. Covers requirements gathering, user story creation, prioritization, and product strategy. Use this skill for product planning, writing PRDs, defining MVPs, or competitive analysis.

Available Skills in AgentOS (br3ezeclaw)

br3eze-code

security-audit

data219

"Agent Skill: Security audit patterns for PHP/OWASP. Use when conducting security assessments, identifying vulnerabilities (XXE, SQL injection, XSS), or CVSS scoring. By Netresearch."

clawdbot-self-security-audit

TheSethRose

Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities and generate reports. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities do I have". This skill only READS configuration and generates reports—it never modifies settings or executes fixes automatically. Designed to be extensible—new checks can be added by updating this skill's knowledge.

code-review

yarlson

This skill should be used when the user asks to "review my changes", "review this code", "check my work", "what's wrong with my changes", "review before I push", "security review", "do a code review", or mentions reviewing, auditing, or analyzing local code changes before committing or opening a PR.

Available Skills in AgentOS (br3ezeclaw)

br3eze-code

cryptoeconomic-protocol-security

curiositech

Analyze bonded agent systems, escrow workflows, slashing rules, oracle trust, Sybil cost, and front-running risk in protocols where agents post bonds or stake reputation. Use for collateral sizing, griefing analysis, dispute design, and bonded-agent security reviews. NOT for smart contract auditing, DeFi tokenomics, blockchain consensus design, or trading strategy.

content-security-policy-headers

curiositech

'Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.'

infra-code-review

yarlson

This skill should be used when the user asks to "review my infra changes", "review my IaC", "check my infrastructure code", "review this deploy config", "review my cloud config", "review infra before I push", or mentions reviewing, auditing, or analyzing infrastructure-as-code changes — any tool, any cloud, any format.

security-pattern-check

kjgarza

Identify security vulnerabilities and anti-patterns providing feedback on security issues a senior developer would catch. Use when user mentions security/vulnerability/safety concerns, code involves user input/authentication/data access, working with sensitive data (passwords/PII/financial), code includes SQL queries/file operations/external API calls, user asks about security best practices, or security-sensitive files are being modified (auth, payment, data access).

django-security

peopleforrester

Django security best practices. Covers CSRF, XSS, SQL injection prevention, authentication hardening, Content Security Policy, secrets management, and Django-specific security middleware configuration.

skeptic-argument-quality

data219

Use when evaluating claim- or hypothesis-driven prompts where hidden assumptions, evidence quality, or reasoning validity may distort engineering or delivery decisions.

django-verification

peopleforrester

Pre-deployment verification workflow for Django projects. Covers migration checks, security audit, performance profiling, dependency scanning, deployment readiness, and production configuration validation.