Security
Security scanning and vulnerability detection
SkillSync MCP — Security-Gated Skill Manager
by adityasugandhi
Critical threats (prompt injection, RCE, credential theft) permanently block installation. Medium/high risk requires explicit force: true. All output is sanitized against prompt injection.
ast-grep-rule-crafter
by hylarucoder
Write AST-based code search and rewrite rules using ast-grep YAML. Create linting rules, code modernizations, and API migrations with auto-fix. Use when the user mentions ast-grep, tree-sitter patterns, code search rules, lint rules with YAML, AST matching, or code refactoring patterns.
kali-tools
by tzf1003
Comprehensive reference for Kali Linux tools. Use this skill to find, understand, and use security tools in Kali Linux. It provides a categorized index of all available tools.
clawpilot
by kcchien
Expert skill for OpenClaw (v2026.2.19) — self-hosted AI gateway connecting chat apps (WhatsApp, Telegram, Discord, Slack, iMessage, Signal, LINE, Matrix, Teams, Google Chat, BlueBubbles) to AI agents. Use when user asks about: (1) Installing, configuring, or updating OpenClaw, (2) Setting up or troubleshooting chat channels (e.g. "my WhatsApp bot isn't responding"), (3) Security hardening, auditing, or checking a local OpenClaw installation, (4) Inspecting openclaw.json config, prompts (SOUL.md/AGENTS.md), or session transcripts, (5) Multi-agent routing, session management, agent isolation, (6) Cloud deployment (AWS/GCP/Fly.io/Docker) and remote access (Tailscale/SSH), (7) Upgrading or migrating OpenClaw versions, (8) Discovering or installing OpenClaw skills from ClawHub, (9) Any mention of "openclaw", "openclaw.json", "~/.openclaw", or gateway config. Includes bundled scripts for security audit (CVE detection, OWASP/NIST mapping, supply chain scan), config inspection, prompt checking, and session scanning. Do NOT use for: general chatbot frameworks (Botpress, Rasa, etc.), non-OpenClaw AI gateways, or generic Docker/cloud questions unrelated to OpenClaw deployment.
utility-tools
by vikiboss
提供实用工具功能，包括IP地址查询、文本翻译、二维码生成、哈希计算、网页元数据提取、域名WHOIS查询和密码生成。Use when users need translation, IP lookup, QR codes, hashing, domain info, or password generation.
security-engineering
by mujez
Application security and infrastructure security expert. Use when reviewing code for vulnerabilities, implementing authentication/authorization, securing APIs, hardening infrastructure, threat modeling, implementing encryption, or conducting security audits. Covers OWASP Top 10, secure coding, DevSecOps, and compliance.
security-audit
by mgd34msu
"Load PROACTIVELY when task involves security review, vulnerability assessment, or hardening. Use when user says \"check for security issues\", \"audit for vulnerabilities\", \"scan for secrets\", \"review auth security\", or \"check OWASP compliance\". Covers authentication and session security, authorization and access control, input validation and injection prevention, data protection and encryption, dependency vulnerability scanning, API security (CORS, rate limiting, headers), and infrastructure hardening. Produces structured reports with severity ratings."
cross-evolution
by llblab
Horizontal Gene Transfer protocol for skills. Synchronizes best practices and architectural patterns across the skill library.
codex-code-review
by tyrchen
Perform comprehensive code reviews using OpenAI Codex CLI. This skill should be used when users request code reviews, want to analyze diffs/PRs, need security audits, performance analysis, or want automated code quality feedback. Supports reviewing staged changes, specific files, entire directories, or git diffs.
security-stride-methodology
by vinnie357
Activate when conducting security analysis using STRIDE threat modeling, vulnerability assessment, and security architecture evaluation
claude-code-command-patterns
by vinnie357
Activate when creating or modifying Claude Code slash commands with proper frontmatter, Task invocation patterns, and TodoWrite integration
vcp-config
by Z-M-Huang
View and modify VCP configuration. Add or remove ignore entries, toggle scopes, manage compliance frameworks, change severity threshold, and manage exclude patterns. Supports both project config (.vcp/config.json) and global config (~/.vcp/config.json).
vcp-audit
by Z-M-Huang
Run a comprehensive audit against all applicable VCP standards. Supports full audit, compliance-specific audit, and quick release readiness check.
aws_architect
by vuralserhat86
Expert AWS solution architecture for startups focusing on serverless, scalable, and cost-effective cloud infrastructure with modern DevOps practices and infrastructure-as-code
deps_npm
by vuralserhat86
npm/yarn dependency management, package.json best practices ve version control.
secure-server
by aviflombaum
This skill should be used when the user asks to "secure server", "harden server", "server hardening", "setup server security", or needs to configure fail2ban, UFW, auditd, rkhunter, unattended-upgrades, or security alerting on Ubuntu servers.
gc-review-security
by dougkeefe
"Use when reviewing code changes for Protected B security compliance. Triggers: security review, ITSG-33 compliance, GoC security, Protected B data handling, access control review, PII protection check, or requests to audit security-sensitive code."
quality-auditor
by daffy0208
Comprehensive quality auditing and evaluation of tools, frameworks, and systems against industry best practices with detailed scoring across 12 critical dimensions
Framework Orchestrator
by daffy0208
Meta-skill that coordinates all frameworks and skills throughout the project lifecycle, providing intelligent sequencing based on project patterns
Dark Matter Analyzer
by daffy0208
Analyze repositories to reveal unseen patterns, strategic drift, and organizational health. Use when assessing repository coherence, diagnosing project issues, identifying documentation inflation, or understanding why a codebase feels misaligned with its stated goals.
understanding-tauri-architecture
by dchuk
Teaches Claude about Tauri's core architecture, including the Rust backend, webview integration, Core-Shell design pattern, IPC mechanisms, and security model fundamentals.
understanding-tauri-ecosystem-security
by dchuk
Guides developers through Tauri ecosystem security practices including security auditing, dependency management, vulnerability reporting, and organizational security measures for building secure desktop applications.
blogwatcher
by malue-ai
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.
configuring-tauri-http-headers
by dchuk
Guides developers through configuring HTTP headers security in Tauri v2 applications, covering security headers, custom headers, and CORS configuration for secure cross-origin resource handling.