Security
Security scanning and vulnerability detection
aws-security-architecture
by Hack23
AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment
seo-audit
by ferdiboxman
Audit any landing page for SEO issues like a senior growth operator
wallet-compliance-scanner
by tawf-labs
Scan crypto wallets and tokens for Sharia (Islamic finance) compliance. Checks tokens against halal/haram criteria including riba (interest), gharar (uncertainty), maysir (gambling), and prohibited protocol types. Outputs per-token verdicts and overall wallet health score.
rafter
by Raftersecurity
"Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs rafter run (remote SAST+SCA), rafter secrets (local secrets-only), rafter audit, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of that, a quick surface check is enough. When such surface IS present and no rafter skill or CLI call has been made, invoke this before handing the task off — an un-evaluated \"done\" on genuine security surface is not done."
compliance-checklist
by Hack23
Unified compliance verification across ISO 27001, NIST CSF, CIS Controls, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, and HIPAA for cybersecurity consulting
ciso-coach
by campbellmcgregor
Expert CISO coaching and mentorship for security leaders in training. Use when the user asks for CISO coach guidance, executive communication advice, security leadership strategies, or needs help translating technical security issues for non-technical audiences. Also activates for discussions about current security events, threat landscape analysis, board-level security topics, risk communication, or security program development from a CISO perspective.
security
by dottiedreamworks-dot
Comprehensive AI agent security and privacy guidelines. Covers prompt injection defense, data protection, access controls, system integrity, and safe system integration practices. Complements the healthcheck skill (which handles host-level hardening).
SKILL.md — Security Audit
by iamthetonyb
Correlate with external threat intelligence if available
tech-debt-report
by IHKREDDY
Find TODOs, deprecated APIs, and outdated patterns in codebase
convex
by MichaelFisher1997
Umbrella skill for all Convex development patterns. Routes to specific skills like convex-functions, convex-realtime, convex-agents, etc.
hipaa-compliance
by affaan-m
HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.
dependency-updater
by VisualxIntelligence
Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.
code-review
by IHKREDDY
Performs comprehensive code reviews following industry best practices. Use when reviewing pull requests, code changes, or when asked to analyze code quality, security, performance, or maintainability. Checks for common bugs, security vulnerabilities, code smells, and adherence to coding standards.
data-protection
by Hack23
Data classification (CIA triad), GDPR privacy by design, encryption standards, data lifecycle management
spec-to-code-compliance
by aleister1102
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
red-team-mastercourse
by Albashmohandes
Free, up-to-date, full-spectrum red-team curriculum (fundamentals → AD → evasion → web → AI/LLM red teaming → AI-in-your-workflow). Consolidates Microsoft AI Red Team 101, Zero-Point Security RTO structure, OWASP GenAI/LLM Top 10, MITRE ATT&CK/ATLAS, and the free lab ecosystem. Every module has real commands/code and a mapped free lab. Includes a hard ethical boundary (authorized-only, no attribution evasion).
OWASP Top 10 Security Reviewer
by nguyenhuy158
```
SkillSync MCP — Security-Gated Skill Manager
by Glowboth
Critical threats (prompt injection, RCE, credential theft) permanently block installation. Medium/high risk requires explicit force: true. All output is sanitized against prompt injection.
tool-gdelt-news
by captaindpt
Use the gdelt_news tool to fetch recent headlines via GDELT (free) with shared caching, rate limiting, and basic query normalization.
advanced-skill-creator
by YPYT1
Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards.
immunis
by greatnorthernfishguy-hub
security-review
by HerbHall
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing sensitive features. Provides comprehensive security checklist and patterns.
codex-security
by Dreamstick9
Automate security vulnerability discovery, code auditing, deep multi-worker scans, PR/commit diff reviews, finding validation with evidence/PoCs, automated patching, patch risk assessments, false positive triage, GitHub Code Scanning alert imports, and SARIF/JSON/CSV report exports using OpenAI Codex Security CLI and SDK. Use when conducting codebase security audits, investigating security findings, reviewing diffs for vulnerabilities, validating alerts, or hardening software security boundaries.
laravel-best-practices
by jcastillotx
Laravel development standards. Triggers when working with Laravel applications, Eloquent ORM, Blade templates, or Livewire components.