安全
安全扫描与漏洞检测
network-watcher
UseAI-pro
"Audit and monitor network requests made by OpenClaw skills. Detects data exfiltration, unauthorized API calls, and suspicious outbound connections."
openclaw-sec
PaoloRollo
AI Agent Security Suite - Real-time protection against prompt injection, command injection, SSRF, path traversal, secrets exposure, and content policy violations
deps-audit
dmonteroh
"Produces a local, best-effort dependency audit summary and remediation plan for repos with dependency manifests."
security-specialist
truongnat
Elite security engineering based on threat modeling, defensive coding, vulnerability management, and compliance standards. Focused on the "Security-by-Design" philosophy.
gdpr-data-handling
dmonteroh
"Implement practical GDPR-compliant data handling (privacy by design, lawful basis, DSARs, retention, vendor/transfer controls, breach readiness). Use when building or reviewing systems that process EU personal data."
secrets-management
dmonteroh
"Secure secrets handling for CI/CD and runtime: secret inventory, access boundaries, short-lived identity (OIDC/workload identity), rotation, auditing, and leak response. Works across Vault and cloud-native secret managers."
auto-updates
mikr13
Configure automatic security updates on Ubuntu/Debian VPS servers to patch vulnerabilities and prevent exploitation of known security flaws.
auth-implementation-patterns
dmonteroh
"Provides authentication and authorization implementation patterns (JWT, OAuth2/OIDC, sessions, RBAC) for designing, implementing, or reviewing secure access control in applications and APIs."
penetration-testing
timsonner
Comprehensive penetration testing workflow using Kali Linux tools via MCP. Guides agents through reconnaissance, vulnerability assessment, exploitation, privilege escalation, and reporting. Use when conducting security assessments, CTF challenges, vulnerability testing, or red team exercises.
accessibility-compliance-accessibility-audit
ncdevshiv
"You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance."
anti-reversing-techniques
ncdevshiv
"Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or u..."
active-directory-attacks
ncdevshiv
"This skill should be used when the user asks to "attack Active Directory", "exploit AD", "Kerberoasting", "DCSync", "pass-the-hash", "BloodHound enumeration", "Golden Ticket", ..."
arc-shield
arc-claw-bot
Output sanitization for agent responses - prevents accidental secret leaks
gws-modelarmor-create-template
googleworkspace
"Google Model Armor: Create a new Model Armor template."
slowmist-security-cc
Leontynestirredup43
SlowMist AI Agent Security Review — comprehensive security framework for skills, repositories, URLs, on-chain addresses, and products (Claude Code version)
gws-modelarmor-sanitize-response
googleworkspace
"Google Model Armor: Sanitize a model response through a Model Armor template."
Provenance Guard
smouj
Supply chain security and integrity verification for software artifacts
agentic-zero-trust-security
curiositech
Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).
gws-modelarmor-sanitize-prompt
googleworkspace
"Google Model Armor: Sanitize a user prompt through a Model Armor template."
analyzing-outlook-pst-for-email-forensics
mukul975
Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments,
analyzing-malicious-url-with-urlscan
mukul975
URLScan.io is a free service for scanning and analyzing suspicious URLs. It captures screenshots, DOM content,
analyzing-packed-malware-with-upx-unpacker
mukul975
'Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for
analyzing-certificate-transparency-for-phishing
mukul975
Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,
analyzing-ios-app-security-with-objection
mukul975
'Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that