Security
Security scanning and vulnerability detection
Uses and selection guide
Use these skills to examine correctness, security and runtime behavior. Prefer a workflow that explains its findings and produces reproducible checks; compare results against your project conventions and measured baselines.
open-kritt
by Sekolah76
Drive a locally-running open-kritt stack (github.com/Kritt-ai/open-kritt) from Hermes for bug-bounty code audits. open-kritt is a self-hosted Docker platform that orchestrates AI agents (Codex / Claude Code) to find real vulnerabilities in a target repo, de-duplicates, and severity-ranks the findings. Use this skill when the user asks to scan/audit a GitHub repo or a local codebase with kritt, wants AI-driven vulnerability discovery on a Solidity/ Rust/JS/Go project, or references "open-kritt" / "kritt scan". The skill talks to the kritt backend REST API at http://127.0.0.1:3002/api (override with KRITT_BACKEND_URL), so the Docker stack must be running first (./kritt start in the cloned repo). Capabilities: list workflows / post-scripts / local repos, launch a scan against a remote GitHub repo or a registered local folder, poll until complete, and pull ranked findings. Findings feed naturally into the bug-bounty / web3-audit workflows for PoC + reporting.
gws-modelarmor-create-template
by googleworkspace
"Google Model Armor: Create a new Model Armor template."
gws-modelarmor-sanitize-response
by googleworkspace
"Google Model Armor: Sanitize a model response through a Model Armor template."
gws-modelarmor-sanitize-prompt
by googleworkspace
"Google Model Armor: Sanitize a user prompt through a Model Armor template."
k8s-policy
by rohitg00
Kubernetes policy management with Kyverno and Gatekeeper. Use when enforcing security policies, validating resources, or auditing policy compliance.
k8s-certs
by rohitg00
Kubernetes certificate management with cert-manager. Use when managing TLS certificates, configuring issuers, or troubleshooting certificate issues.
k8s-security
by rohitg00
Audit Kubernetes RBAC, enforce policies, and manage secrets. Use for security reviews, permission audits, policy enforcement with Kyverno/Gatekeeper, and secret management.
蓝鲸代码安全三大红线
by TencentBlueKing
基于 IEG 安全规范，覆盖输入校验、鉴权、数据加密三大高危领域
Node.js 安全审查
by TencentBlueKing
检查 RCE、SSRF、SQL 注入、路径穿越等安全问题，支持 Express/Koa/NestJS
Web 安全漏洞学习指南
by TencentBlueKing
OWASP 十大漏洞原理、影响与修复方案，覆盖 Python/Java 场景
JavaScript 安全审查
by TencentBlueKing
检查 XSS、CSRF、原型污染等安全问题，支持 React/Vue/Angular
code-review
by markus41
Comprehensive code review knowledge including security, performance, accessibility, and quality standards across multiple languages and frameworks
cybersecurity-lab
by handnewb
Turnkey cybersecurity lab — 2,077 skills, 131+ tools, 28 frameworks, and evolving methodology for security research, pentesting, forensics, and threat intelligence. Includes one-step ecosystem cloner for 8 repositories.
security-checklist
by Leavesfly
OWASP 安全检查清单
audit-logging
by dadbodgeoff
Comprehensive audit logging for compliance and security. Track user actions, data changes, and system events with tamper-proof storage.
error-sanitization
by dadbodgeoff
Production-safe error handling that logs full details server-side while exposing only generic, safe messages to users. Prevents information leakage of database strings, file paths, stack traces, and API keys.
file-uploads
by dadbodgeoff
Production-grade secure file upload pipeline with multi-stage validation, malware scanning (ClamAV), hash-based duplicate detection, and race condition protection using distributed locks.
api-security
by williamzujkowski
Broken Object Level Authorization (BOLA) - API fails to validate user
Authorize
by OmniNode-ai
Grant work authorization for Edit/Write operations in this session
ctf-solver
by HacktronAI
Solve CTF (Capture The Flag) challenges by analyzing challenge descriptions, source code, and interacting with challenge environments to capture flags.
waf-bypass-hunter
by HacktronAI
Bypass a Coraza WAF protecting a vulnerable Next.js 16 backend. Analyze parser differentials between Go (WAF) and Node.js (backend) to find bypasses.
authentication-authorization-skill
by darellchua2
Implement authentication and authorization — OAuth2/OIDC, JWT, sessions, RBAC/ABAC, NextAuth/Auth.js, Passport.js, password hashing, CSRF.
auto-updates
by mikr13
Configure automatic security updates on Ubuntu/Debian VPS servers to patch vulnerabilities and prevent exploitation of known security flaws.
config-hardener
by UseAI-pro
"Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses."