Security
Security scanning and vulnerability detection
oracle-dba
by acedergren
"Oracle DBA and DevOps expertise for Autonomous Database (ADB) on OCI. This skill should be used when managing Oracle Autonomous Databases, writing optimized SQL/PLSQL, configuring security (TDE, Database Vault, Data Safe), implementing HA/DR (Data Guard, PITR), using OCI CLI for database operations, or integrating with Oracle MCP servers for AI-assisted database management. Covers Oracle Database versions 19c, 21c, 23ai, and 26ai."
network-engineering
by 89jobrien
Network architecture, troubleshooting, and infrastructure patterns. Use
security-hardening-checklist
by hopeoverture
This skill should be used when the user requests to audit, check, or improve application security by analyzing security headers, cookie configuration, RLS policies, input sanitization, rate limiting, and other security measures. It generates a comprehensive security audit report with actionable recommendations. Trigger terms include security audit, security check, harden security, security review, vulnerability check, security headers, secure cookies, input validation, rate limiting, security best practices.
safe-exec
by OTTTTTO
Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may be dangerous (rm -rf, dd, fork bombs, system directory modifications) or require human oversight. Provides multi-level risk assessment (CRITICAL/HIGH/MEDIUM/LOW), in-session notifications, pending request management, and non-interactive environment support for agent automation.
openclaw-security
by AtlasPA
"Unified security suite for agent workspaces. Installs, configures, and orchestrates all 11 OpenClaw security tools in one command — integrity, secrets, permissions, network, audit trail, signing, supply chain, credentials, injection defense, compliance, and incident response."
decision-auditor
by rohanpatriot
Audits decisions for cognitive biases, runs premortems on plans, and reframes choices to reveal hidden assumptions. Use when evaluating decisions under uncertainty, reviewing plans for bias, assessing probability and risk, running premortems, checking for anchoring or availability bias, or analyzing why a judgment might be wrong.
testing-methodologies
by pluginagentmarketplace
Structured approaches for AI security testing including threat modeling, penetration testing, and red team operations
tech-stack-evaluator
by chaorenex1
Comprehensive technology stack evaluation and comparison tool with TCO analysis, security assessment, and intelligent recommendations for engineering teams
security-testing
by pluginagentmarketplace
Comprehensive security testing automation for AI/ML systems with CI/CD integration
Security-First-Design Skill
by ilude
Apply this framework when security is a primary design concern. Work through phases sequentially, documenting findings and mitigations at each stage.
structured-analysis
by ilude
Apply structured analytical frameworks to any artifact (prompts, systems, documents, code). 12 frameworks in 3 tiers: Core (4 universal), Auto-Invoke (specialized), On-Demand (advanced). Includes adversarial-review for finding blind spots and post-plan validation workflow.
codereview-security
by xinbenlv
Zero-trust security analysis like Cursor BugBot. Focuses exclusively on finding exploitable vulnerabilities with high confidence (>95%). Use when reviewing files that handle input parsing, database queries, authentication, or external API calls.
code-review
by thechandanbhagat
Perform automated code reviews with best practices, security checks, and refactoring suggestions. Use when reviewing code, checking for vulnerabilities, or analyzing code quality.
git-workflow
by ilude
Git workflow and commit guidelines. Trigger keywords: git, commit, push, .git, version control. MUST be activated before ANY git commit, push, or version control operation. Includes security scanning for secrets (API keys, tokens, .env files), commit message formatting with HEREDOC, logical commit grouping (docs, test, feat, fix, refactor, chore, build, deps), push behavior rules, safety rules for hooks and force pushes, and CRITICAL safeguards for destructive operations (filter-branch, gc --prune, reset --hard). Activate when user requests committing changes, pushing code, creating commits, rewriting history, or performing any git operations including analyzing uncommitted changes.
web-security
by academind
Enforce web security and avoid security vulnerabilities
sast-brakeman
by vchirrav
Run Brakeman SAST scans on Ruby on Rails applications. Detects SQL injection, XSS, mass assignment, CSRF, command injection, and other Rails-specific vulnerabilities.
container-scan-trivy
by vchirrav
Run Trivy to scan container images for OS and library vulnerabilities, misconfigurations, and secrets. Comprehensive multi-target security scanner.
code-audit-readonly
by Jpkovas
Execute a complete, deterministic, read-only repository audit and produce a single improvements.md action plan with traceable findings (file + lines), severity, category, impact, and high-level fixes. Use when users ask for full code audits, security/performance/architecture reviews, file-by-file analysis, or technical debt mapping without modifying project files.
sca-npm-audit
by vchirrav
Run npm audit for Node.js dependency vulnerability scanning. Built-in SCA for npm projects with automatic fix suggestions.
design-auditor
by DUBSOpenHub
🔍 Design Auditor — paste a URL, get 5 ranked fixes to improve conversions. Analyzes layout, performance, accessibility, and CTA effectiveness. Say "audit <url>" to start, or "audit local" for a local dev server.
sast-eslint-security
by vchirrav
Run ESLint with security plugins on JavaScript/TypeScript code. Detects eval usage, non-literal RegExp, prototype pollution, and other JS/TS security anti-patterns.
container-scan-dockle
by vchirrav
Run Dockle to audit container images against CIS Docker Benchmark and best practices. Checks for running as root, sensitive files, HEALTHCHECK, and more.
dast-nuclei
by vchirrav
Run Nuclei template-based vulnerability scanner. Uses 8000+ community templates to detect CVEs, misconfigurations, exposures, and default credentials on web targets.
sast-spotbugs
by vchirrav
Run SpotBugs with Find Security Bugs plugin on Java code. Detects injection flaws, XXE, insecure crypto, SSRF, deserialization, and other JVM security bugs.