Security
Security scanning and vulnerability detection
security-review
by xu-xiang
当添加身份认证（authentication）、处理用户输入、使用凭据（secrets）、创建 API 端点或实现支付/敏感功能时，请使用此技能。提供全面的安全检查清单和模式。
django-verification
by xu-xiang
Django 项目的验证循环（Verification loop）：包含数据库迁移、代码检查、带覆盖率的测试、安全扫描，以及在发布或 PR 前的部署就绪检查。
springboot-security
by xu-xiang
Spring Boot 服务中关于身份认证/授权（authn/authz）、校验、CSRF、密钥管理、响应头、限流及依赖安全的 Spring Security 最佳实践。
django-security
by xu-xiang
Django 安全最佳实践，涵盖身份认证、授权、CSRF 防护、SQL 注入预防、XSS 预防以及安全的部署配置。
goodvibesonly
by JDDoesDev
Security scanner for vibe-coded projects. AUTO-INVOKE this skill before any git commit, git push, or when user says "commit", "push", "ship it", "deploy", "is this safe?", "check for security issues", or "goodvibesonly". Also invoke after generating code that handles user input, authentication, database queries, or file operations.
godpowers
by aihxp
AI-powered development system that takes a project from raw idea to hardened production. Fuses artifact discipline, execution engine, quality enforcement, and team intelligence into one unified workflow. Triggers on: "god mode", "god init", "god prd", "god arch", "god roadmap", "god stack", "god repo", "god build", "god deploy", "god observe", "god launch", "god harden", "god status", "god audit", "god debug", "god review", "god smite", "godpowers", "start a project", "build this", "ship this", "take this from idea to production", "one-shot the whole thing", "autonomous build", "full arc", "idea to deploy"
iso-27001-evidence-collection
by open-agreements
Collect, organize, and validate evidence for ISO 27001 and SOC 2 audits. API-first approach with CLI commands for major cloud platforms. Produces timestamped, auditor-ready evidence packages. Use when user says "collect audit evidence," "prepare evidence package," "evidence for the auditor," "refresh evidence," or "evidence gap analysis."
meta-audit
by laurigates
Audit Claude subagent configurations for completeness, security, and best practices
ast-grep-search
by laurigates
Find and replace code patterns structurally using ast-grep. Use when you need to match code by its AST structure (not just text), such as finding all functions with specific signatures, replacing API patterns across files, or detecting code anti-patterns that regex cannot reliably match.
founder-productivity
by mfwarren
Production-ready entrepreneurship skills for Claude Code — marketing, sales, operations, finance, and leadership. 24 skills built by a founder, for founders.
oracle-family-scan
by Soul-Brews-Studio
Manage Oracle family - scan, track, welcome new Oracles. Use when user says "family scan", "oracle registry", "welcome new oracles", or needs to check Oracle population.
vue-frontend
by williamzujkowski
Composition API vs Options API
infrastructure-as-code
by williamzujkowski
'Basic Resource:'
nist-compliance
by williamzujkowski
NIST 800-53r5 control implementation, tagging, evidence collection, and compliance automation for security frameworks
fintech-compliance
by williamzujkowski
Payment card security, SOC2 compliance, and financial services regulatory requirements
security-practices
by williamzujkowski
Modern security standards including Zero Trust Architecture, supply chain security, DevSecOps integration, and cloud-native protection
kubernetes
by williamzujkowski
Kubernetes standards for container orchestration, deployments, services, ingress, ConfigMaps, Secrets, and security policies. Covers production-ready configurations, monitoring, and best practices for cloud-native applications.
nestjs-best-practices
by koolamusic
NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for modules, dependency injection, security, and performance.
service-mesh
by williamzujkowski
A service mesh is an infrastructure layer that provides transparent service-to-service
containers
by williamzujkowski
'Core Principles:'
healthtech-hipaa
by williamzujkowski
HIPAA establishes national standards for protecting patient health information
ai-code-review
by sundial-org
Top OpenClaw skills, with the most popular and useful ones.
a11y-checker
by sundial-org
Scan HTML and JSX for accessibility issues with AI-powered fix suggestions
sec
by 8-Sync-Dev
Quét bảo mật diff hoặc repo hiện tại — secret (không in giá trị), file nhạy cảm đang track/trong history, dependency audit, guard/hook/deny rule của kit, rồi review code đổi theo OWASP. Dùng khi user gõ /sec, trước commit/PR/release, hoặc sau khi diff đụng auth, input, file credential, dependency.