Security
Security scanning and vulnerability detection
wooyun-legacy
by trailofbits
Provides web vulnerability testing methodology distilled from 88,636 real-world cases from the WooYun vulnerability database (2010-2016). Use when performing penetration testing, security audits, code reviews for security flaws, or vulnerability research. Covers SQL injection, XSS, command execution, file upload, path traversal, unauthorized access, information disclosure, and business logic flaws.
code-review
by kdcokenny
Comprehensive code review methodology with severity classification and confidence thresholds
ship-safe-score
by asamassekou10
Get your project's security health score (0-100, A-F grade). Use when the user wants a quick security check or asks "is my code safe to ship?"
blueagent-x402
by BankrBot
Security OS for autonomous agents and builders on Base. 31 pay-per-use tools across Quantum Security, Agent Safety, Research, Data, and Earn. Built for AI agents, Zero-Human Companies (ZHC), and Base ecosystem builders. Pay USDC per call via x402 protocol — no subscription, no API key needed.
trustlayer-sybil-scanner
by BankrBot
Feedback forensics for ERC-8004 agents. Detects Sybil rings, fake reviews, rating manipulation, and reputation laundering across 20 chains. No API key needed.
openclaw-audit-watchdog
by prompt-security
Automated daily security audits for OpenClaw agents with email reporting. Runs deep audits and sends formatted reports.
clawtributor
by prompt-security
Community incident reporting for AI agents. Contribute to collective security by reporting threats.
clawsec-suite
by prompt-security
ClawSec suite manager with embedded advisory-feed monitoring, cryptographic signature verification, approval-gated malicious-skill response, and guided setup for additional security skills.
release-checklist
by yonatangross
Walks through the OrchestKit release checklist — build, test, validate counts, changelog, version bump, commit, tag, push. Use when preparing a release, cutting a version tag, or verifying release readiness before pushing to main.
code-review-playbook
by yonatangross
Use this skill when conducting or improving code reviews. Provides structured review processes, conventional comments patterns, language-specific checklists, and feedback templates. Use when reviewing PRs or standardizing review practices.
audit-full
by yonatangross
"Full-codebase audit using 1M context window. Security, architecture, and dependency analysis in a single pass. Use when you need whole-project analysis."
audit-skills
by yonatangross
Audits all OrchestKit skills for quality, completeness, and compliance with authoring standards. Use when checking skill health, before releases, or after bulk skill edits to surface SKILL.md files that are too long, have missing frontmatter, lack rules/references, or are unregistered in manifests.
security
by telagod
攻防秘典索引。渗透测试、代码审计、红队攻击、蓝队防御、威胁情报、漏洞研究。当魔尊提到安全、渗透、攻防、红队、蓝队、漏洞时路由到此。
risk-cycle
by jmagly
Escalation procedures: docs/risk-escalation.md
gap-analysis
by jmagly
Workspace health: plugins/utils/skills/workspace-health/SKILL.md
decision-support
by jmagly
Trade-off catalog: docs/common-tradeoffs.md
fullstack-guardian
by Jeffallan
Use when implementing features across frontend and backend, building APIs with UI, or creating end-to-end data flows. Invoke for feature implementation, API development, UI building, cross-stack work.
best-practices
by addyosmani
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
secure-code-guardian
by Jeffallan
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention.
supabase-report
by yoanbernabeu
Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.
ship-safe-scan
by asamassekou10
Quick scan for leaked secrets — API keys, passwords, tokens, database URLs. Use when the user wants to check for hardcoded secrets or exposed credentials.
code-reviewer
by Jeffallan
Use when reviewing pull requests, conducting code quality audits, or identifying security vulnerabilities. Invoke for PR reviews, code quality checks, refactoring suggestions.
security-suite
by boshu2
'Composable binary security suite for static analysis, dynamic tracing, contract capture, baseline drift, and policy gating. Triggers: "binary security", "reverse engineer binary", "black-box binary test", "behavioral trace", "baseline diff", "security suite".'
spring-boot-security-jwt
by giuseppe-trisciuoglio
Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based access control using Spring Security 6.x. Use when implementing authentication or authorization in Spring Boot applications.