Security
Security scanning and vulnerability detection
security-analyst
by paixaop
"Use when the user wants a security audit, penetration test, threat model, vulnerability hunt, security fix plan, SBOM, compliance mapping, privacy assessment, or security posture comparison between runs."
typescript-security-review
by bromanko
This skill should be used when the user asks for "security review", "vulnerability scan", "audit TypeScript security", "security audit", "find vulnerabilities", "check for security issues", or wants a deep security analysis of TypeScript code including input validation, auth boundaries, and dependency risks.
clawguard
by jugaad-lab
Security blacklist protecting AI agents from malicious skills, scams, and prompt injection. Use before executing external commands, visiting unknown URLs, or installing new skills. Triggers on "security check", "is this safe", "check this URL", or suspicious command patterns.
SKILL.md
by miabascacal
Xolgadas no esta confirmado como nombre final solido. Mantener validacion de marca como workstream paralelo, sin desplazar seguridad.
nchan-expert
by tailuge
Expert guidance for Nchan, a scalable pub/sub server for Nginx. Use this skill when you need to configure Nchan endpoints (publisher/subscriber), set up horizontal scaling with Redis, implement security patterns (authorization, X-Accel-Redirect), or troubleshoot Nchan performance and metrics.
fortify-scdast
by crance
ScanCentral DAST guide for MCP tools. Run dynamic application security testing (DAST) scans, list and filter scan results, discover scan settings and policies, and manage web application security scanning using Fortify ScanCentral DAST. Triggers include any mention of 'SC-DAST', 'ScanCentral DAST', 'DAST scan', 'web scan', 'dynamic scan', 'run DAST scan', 'list scans', and similar requests indicating interaction with SC-DAST for dynamic application security scanning.
apple-platform-versions
by antgly
Use ONLY to resolve Apple OS baselines for code and documentation for minimum deployment target, API/SDK availability, #available/@available, “latest/current” docs, or Sequoia (macOS 15) vs Tahoe (macOS 26.x) baseline corrections.
skill-auditor
by DevGuyRash
Perform structured, reproducible audits of agent skills — testing mechanical correctness, agent usability, output quality, context efficiency, EARS compliance, prompt complexity, multi-agent coordination, audit convergence (reproducibility across runs), finding divergence (specificity and tailoring), AGENTS.md adherence (rule absorption verification), documentation/runtime staleness drift detection, CLI discoverability helper coverage, idempotency, error recovery, and credential safety. Covers 25 audit domains (D1–D25) with confidence-scored findings at every level. Use when (1) auditing or health-checking a skill end-to-end, (2) verifying AGENTS.md adherence, audit convergence, or finding divergence, or (3) validating scripts, CLIs, context/token footprint, EARS requirement syntax, prompt complexity, name consistency, dispatch prompt quality, or structured confidence-scored audit reports.
go-developer
by wizact
Go development best practices - clean architecture, testing, security, and idiomatic patterns for production-ready code
quality-manager-qms-iso13485
by nimeshgurung
ISO 13485 Quality Management System specialist for medical device companies. Provides QMS implementation, maintenance, process optimization, and compliance expertise. Use for QMS design, documentation control, management review, internal auditing, corrective actions, and ISO 13485 certification activities.
Security Scanner
by BizShuk
Scan workspace for potential security risks including exposed passwords, API keys, tokens, and other sensitive data
subscription-audit
by Andy160675
Audit IT, AI, and SaaS subscription fees by searching Gmail and Slack for receipts, invoices, and billing notifications. Use when asked to find subscriptions, audit recurring charges, identify software costs, review SaaS spending, or compile a subscription fee report.
seo-audit
by alexwelcing
Conduct comprehensive SEO audits and provide actionable recommendations
homescout-ingest
by nick-neely
Analyze Homescout output directories (current.json, history/.jsonl(.gz), speedtests.jsonl, speedtests/.jsonl(.gz)) with CLI tools like jq/rg/awk to answer questions about device presence, outages, scan stats, or speedtest trends. Use when an agent needs to ingest Homescout outputs, especially from remote/Tailscale/Taildrive output paths.
security-review
by htooayelwinict
Audit code for security vulnerabilities using OWASP Top 10 guidelines. Use for security audits, pre-deployment checks, authentication reviews, or when checking for XSS, SQL injection, CSRF, or authorization issues. EXCLUSIVE to security-expert agent.
security-agent-efficiency
by aleister1102
Use when running a full security audit of an arbitrary source code repository. Orchestrates a 9-phase workflow combining advisory intelligence, patch bypass analysis, knowledge base construction, SAST, spec gap analysis, deep bug hunting, false positive elimination, and variant analysis. Triggers on "audit this repo", "run a full security audit", "find vulnerabilities in this codebase", "check for security issues", "is this secure?", "run the security agents", or any request combining advisory regression, SAST, and manual review.
skill-evaluator
by alterxyz
Evaluate Agent Skills against agentskills.io specification with three progressive modes and smart visual reports. (1) Static Analysis - SKILL.md-only review for quality and spec compliance, outputs score /60. (2) Semi-Static Analysis - adds environment and user fit assessment without execution, outputs score /100. (3) Full Analysis - complete evaluation with security scanning, trigger testing, and dynamic verification, outputs score /130. Supports Bento-ready JSON report output for visual dashboards with auto-scaling blocks based on issue severity. Trigger phrases include "evaluate skill", "review skill", "audit skill", "is this skill good", "should I use/install this skill", "skill quality check", "rate this skill", "score this skill", "bento report", "visual report", "技能评估", "评测 skill", "审核 skill", "可视化报告".
interview
by takuan-osho
Conduct structured interviews to gather requirements, clarify specifications, or understand context. This skill should be used when starting a new task that requires understanding user intent, requirements, technical specifications, or context. It supports various interview types including requirements definition, debugging investigation, architecture review, and general information gathering.
clawhub-scanner
by elvatis
"Scan installed ClawHub skills for malware, credential theft, prompt injection, and security risks. Detects known C2 infrastructure, obfuscated payloads, and data exfiltration patterns from the ClawHavoc campaign."
everclaw
by profbernardoj
Open-source first AI inference — GLM-5 as default, Claude as fallback only. Own your inference forever via the Morpheus decentralized network. Stake MOR tokens, access GLM-5, GLM-4.7 Flash, Kimi K2.5, and 30+ models with persistent inference by recycling staked MOR. Open-source first model router routes all tiers to Morpheus by default — Claude only kicks in as an escape hatch when needed. Includes Morpheus API Gateway bootstrap for zero-config startup, OpenAI-compatible proxy with auto-session management, automatic retry with fresh sessions, OpenAI-compatible error classification to prevent cooldown cascades, multi-key auth rotation v2 with proactive DIEM balance monitoring and reactive 402 watchdog, Gateway Guardian v5 with direct curl inference probes (eliminates Signal spam), proactive Venice DIEM credit monitoring, circuit breaker for stuck sub-agents, nuclear self-healing restart, always-on proxy-router with launchd auto-restart, smart session archiver, three-shift cyclic execution engine (v2 with 15-minute execution loops), 24/7 always-on power configuration for macOS, bundled security skills, zero-dependency wallet management via macOS Keychain, x402 payment client for agent-to-agent USDC payments, ERC-8004 agent registry reader for discovering trustless agents on Base, and hardware-aware local Ollama fallback with auto model selection (Qwen3.5 family, 1.5B–72B based on available RAM/GPU).
helmet-config-generator
by ehtbanton
Generate Helmet.js security middleware configuration for Express applications. Triggers on "create helmet config", "generate helmet configuration", "express security headers", "helmet setup".
codex-autoresearch
by luizgustavo22
"Autonomous long-running iteration for Codex CLI. Use when the user wants Codex to plan or run an unattended improve-verify loop toward a measurable or verifiable outcome, especially for overnight runs; it also covers repeated debugging, fixing, security auditing, and ship-readiness workflows. Do not use for ordinary one-shot coding help or casual Q&A."
lampson-system-design
by copyleftdev
Design systems using Butler Lampson's principles of abstraction, interfaces, and practical wisdom. Emphasizes clean abstractions, security foundations, and time-tested design hints. Use when making architectural decisions, designing APIs, or building systems that must evolve over decades.
ogt-docs-audit
by OpenDNDApps
Run audits on documentation and project health. Routes to specialized audit sub-skills for tasks, definitions, rules, and codebase consistency. Use when reviewing project health, validating documentation, or checking for drift.