Security
Security scanning and vulnerability detection
Security Skill
by nth5693
```
security-review
by joaquimscosta
Security-focused code review identifying high-confidence exploitable vulnerabilities with two-axis severity/confidence scoring, OWASP 2025 alignment, and false positive filtering. Use when user runs /security-review, /review:security-review, requests a "security review", "security audit", "vulnerability scan", or mentions "find vulnerabilities", "check for exploits".
spring-boot-scanner
by joaquimscosta
Smart code scanner that detects Spring Boot patterns and routes to appropriate skills. Use when editing Java or Kotlin files in Spring Boot projects, working with pom.xml/build.gradle containing spring-boot-starter, or when context suggests Spring Boot development. Detects annotations (@RestController, @Entity, @EnableWebSecurity, @SpringBootTest) to determine relevant skills and provides contextual guidance. Uses progressive automation - auto-invokes for low-risk patterns (web-api, data, DDD), confirms before loading high-risk skills (security, testing, verify).
spring-boot-security
by joaquimscosta
Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.
react-doctor
by brianlovin
Diagnose and fix React codebase health issues. Use when reviewing React code, fixing performance problems, auditing security, or improving code quality.
check-cors-security
by dykyi-roman
Audits CORS configuration security. Detects wildcard origins, credentials with wildcards, dynamic origin reflection, missing preflight handling, and overly permissive policies.
owasp-security-check
by sergiodxa
Security audit guidelines for web applications and REST APIs based on OWASP Top 10 and web security best practices. Use when checking code for vulnerabilities, reviewing auth/authz, auditing APIs, or before production deployment.
secureclaw
by adversa-ai
Security skill for OpenClaw agents (7-framework aligned). 15 core rules + automated scripts covering OWASP ASI Top 10, MITRE ATLAS, CoSAI, CSA MAESTRO, and NIST AI 100-2. Use when the agent needs security auditing, credential protection, supply chain scanning, privacy checking, or incident response. By Adversa AI (https://adversa.ai). v2.2.0.
secureclaw
by adversa-ai
Security hardening toolkit for OpenClaw. Run audits, apply fixes, scan skills, monitor costs and memory integrity.
java25-springboot4-reviewer
by a-pavithraa
Comprehensive code review for Java 25 and Spring Boot 4 apps. Use when reviewing, checking, auditing, or analyzing Java/Spring Boot code (files, modules, PRs, or full codebases) for migration risks, Spring Boot 4 best practices, JSpecify null-safety, security vulnerabilities, performance bottlenecks, data access pitfalls, architecture boundaries (DDD/Hexagonal/Spring Modulith), or modern Java 25 usage.
mem-weekly
by zephyrwang6
AI个人记忆系统的周复盘功能。分析本周L1情境层记录，识别重复模式，提炼到L2行为层。使用场景：(1) 用户说"周复盘"时；(2) 每周定期回顾时；(3) 需要从日常记录中提炼行为模式时。该skill会自动统计重复出现的行为（3次+），生成候选列表，等待用户确认后更新L2行为层。
mem-file-scan
by zephyrwang6
AI个人记忆系统的文件扫描回顾功能。扫描Obsidian仓库中本周修改的文件（排除AI_MEMORY目录），识别潜在的重要事件和决策。使用场景：(1) 用户说"文件扫描"、"查看本周文件"、"扫描文件变化"时；(2) 周复盘时补充L1记录前；(3) 用户想回顾本周在Obsidian中的活动时。该skill会列出修改的文件，询问用户哪些需要记录到L1，并辅助记录。
web-performance-seo
by ZhanlinCui
Fix PageSpeed Insights/Lighthouse accessibility "!" errors caused by contrast audit failures (CSS filters, OKLCH/OKLAB, low opacity, gradient text, image backgrounds). Use for accessibility-driven SEO/performance debugging and remediation.
security-audit-owasp-top-10
by WalletConnect
"Performs comprehensive security audit of any codebase against OWASP Top 10 2025. Use when user asks for OWASP audit, OWASP Top 10 review, OWASP security check, or wants to audit code against OWASP categories. Do not trigger for PR review, npm/pip audit, SOC2 compliance, general security questions, or threat modeling."
operational-readiness
by WalletConnect
Operational Readiness Checklist for Reown services. Use when service owners ask to: check production readiness, validate a service before launch, run operational readiness review, audit service compliance, check if service is ready for production, or validate infrastructure/security posture. Triggers: "operational readiness", "production readiness", "launch checklist", "service review", "pre-launch audit", "ORC", "is my service ready", "check my service", "readiness review"
git
by tao3k
Use when committing code, managing branches, pushing to remote, creating pull requests, or performing version control operations. Conforms to docs/reference/skill-routing-value-standard.md.
devops-platform-patterns
by majesticlabs-dev
Platform-specific IaC checklists for DigitalOcean, Hetzner, AWS, and Cloudflare.
discover-collaboration
by rand
Automatically discover collaboration and teamwork skills when working with code review, pair programming, GitHub, pull requests, team workflows, or documentation. Activates for collaboration development tasks.
springboot-security
by x-cmd
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
code-security-audit
by ssrsec
AI 驱动的生产级代码安全审计协议。面向企业内部授权审计，默认使用结构化 harness：项目画像、攻击面枚举、Sink/Control 双轨候选发现、验证队列、能力链、质量门、报告渲染和完整证据交付。支持 PHP、Java、C# / ASP.NET、Go、Python、JavaScript / TypeScript Node.js、Ruby、Rust、Kotlin、Deno/Bun，以及 JVM/.NET 编译产物反编译计划。用户说「开始审计 / 对 XXX 做安全审计 / 代码审计 / 安全扫描 / 找漏洞 / security audit / 红队审计」时触发。
audit-logging
by BagelHole
Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when implementing audit trail requirements.
AWS Penetration Testing
by hainamchung
This skill should be used when the user asks to "pentest AWS", "test AWS security", "enumerate IAM", "exploit cloud infrastructure", "AWS privilege escalation", "S3 bucket testing", "metadata SSRF", "Lambda exploitation", or needs guidance on Amazon Web Services security assessment.
aws-cost-operations
by hainamchung
This skill provides AWS cost optimization, monitoring, and operational best practices with integrated MCP servers for billing analysis, cost estimation, observability, and security assessment.
Burp Suite Web Application Testing
by hainamchung
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.