Security
Security scanning and vulnerability detection
setup-auditor
by UseAI-pro
"Audit your OpenClaw environment for credential leaks, unsafe defaults, and missing sandbox configuration. Wizard-style: answers questions about your setup and produces a fix checklist."
credential-scanner
by UseAI-pro
"Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration."
skill-auditor
by UseAI-pro
"Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything."
skill-guard
by UseAI-pro
"Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries."
prompt-guard
by UseAI-pro
"Detect and neutralize prompt injection attacks in OpenClaw skill content, user inputs, and external data sources. Prevents instruction hijacking and context manipulation."
permission-auditor
by UseAI-pro
"Analyze OpenClaw skill permissions and explain exactly what each permission allows. Identifies over-privileged skills and suggests minimal permission sets."
incident-responder
by UseAI-pro
"Step-by-step incident response for OpenClaw security breaches. Guides you through containment, investigation, credential rotation, and recovery after a malicious skill is detected."
network-watcher
by UseAI-pro
"Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections."
agentic-zero-trust-security
by curiositech
Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).
openclaw-sec
by PaoloRollo
AI Agent Security Suite - Real-time protection against prompt injection, command injection, SSRF, path traversal, secrets exposure, and content policy violations
sakthai-security-privacy
by beer-sakthai
Protect user data; treat external sync as publication.
sakthai-security-hardening
by beer-sakthai
Harden the code and runtime; keep privilege least.
security-specialist
by truongnat
Elite security engineering based on threat modeling, defensive coding, vulnerability management, and compliance standards. Focused on the "Security-by-Design" philosophy.
sakthai-security-red-teaming
by beer-sakthai
Audit system inputs, API sandboxes, and file capabilities to identify security vulnerabilities.
atlas-guest-mode
by kaecer68
"Canonical pattern for atlas-go's user authentication bypass in pre-commercialisation deploys. Use when touching /api/auth/, /api/user/, internal/subscription/*, frontend auth.js, or any task involving login, SSO, OAuth, tier gate, user signup, JWT, session, cookie, commercialize auth, or 'add login wall'. Prevents agents from re-implementing parallel user-auth middleware."
sherlock
by magnetoid
OSINT username search across 400+ social networks. Hunt down social media accounts by username.
oss-forensics
by magnetoid
Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.
web-pentest
by magnetoid
Authorized web application penetration testing — reconnaissance, vulnerability analysis, proof-based exploitation, and professional reporting. Adapts Shannon's "No Exploit, No Report" methodology with hard guardrails for scope, authorization, and aux-client leakage. Active testing against running applications you own or have written authorization to test.
1password
by magnetoid
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.
accessibility-compliance-accessibility-audit
by ncdevshiv
"You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance."
auth-implementation-patterns
by dmonteroh
"Provides authentication and authorization implementation patterns (JWT, OAuth2/OIDC, sessions, RBAC) for designing, implementing, or reviewing secure access control in applications and APIs."
anti-reversing-techniques
by ncdevshiv
"Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or u..."
active-directory-attacks
by ncdevshiv
"This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ..."
deps-audit
by dmonteroh
"Produces a local, best-effort dependency audit summary and remediation plan for repos with dependency manifests."