安全
安全扫描与漏洞检测
testing-methodologies
pluginagentmarketplace
Structured approaches for AI security testing including threat modeling, penetration testing, and red team operations
security-testing
pluginagentmarketplace
Comprehensive security testing automation for AI/ML systems with CI/CD integration
health-check
acedergren
"Run all quality gates across the entire codebase and report results. Headless — no analysis, just execute and print. Use for pre-PR validation, phase completion, or routine health monitoring."
security
kcns008
Security Agent (Shield) — handles Pod Security Standards, RBAC audits, NetworkPolicy enforcement, secrets management (Vault), image scanning (Trivy), policy enforcement (Kyverno/OPA), CIS benchmarks, and compliance for Kubernetes and OpenShift clusters.
api-audit
acedergren
"Audit API routes against shared types — scan routes, plugins, and types for mismatches. Read-only, no changes. Use before PRs, after adding routes, or for periodic API contract validation."
artifacts
kcns008
Artifact Agent (Cache) — handles container registry management, artifact promotion between environments, vulnerability scanning (Trivy/Grype), SBOM generation (Syft), image signing (Cosign), retention policies, and CI/CD integration for Kubernetes and OpenShift supply chain security.
prod-readiness
acedergren
Autonomous production readiness review pipeline — spawns 5 parallel specialist agents (security, testing, performance, observability, code quality) and synthesizes findings into a prioritized remediation plan. Use before major releases or milestone completions.
doc-sync
acedergren
"Audit project documentation against the codebase and fix drift. Run before PRs or after major changes. Compares documented architecture, test counts, and file paths against actual state."
prd
acedergren
"Create, validate, and evolve Product Requirements Documents with interactive discovery, technical architecture, phasing, TDD protocol, and dependency analysis. Use when: writing a PRD, planning a feature, defining requirements, or updating an existing PRD. Supports /prd (create), /prd --update (incremental update), /prd --validate (run checklist), /prd --audit-deps (dependency analysis only), /prd --to-plan (generate orchestrate-ready task plan)."
review-all
acedergren
"Pre-PR review pipeline — runs security, API audit, and scope check agents in parallel. Read-only, no changes. Use before creating PRs or after completing a phase of work."
ponytail-audit
Blockether
Whole-repo audit for over-engineering. Like ponytail-review, but scans the entire codebase instead of a diff: a ranked list of what to delete, simplify, or replace with stdlib/native equivalents. Use when the user says "audit this codebase", "audit for over-engineering", "what can I delete from this repo", "find bloat", "ponytail-audit", or "/ponytail-audit". One-shot report, does not apply fixes.
git
tao3k
Use when committing code, managing branches, pushing to remote, creating pull requests, or performing version control operations. Conforms to docs/reference/skill-routing-value-standard.md.
code-assistant
kriscard
"Development: Use when writing, debugging, or refactoring code. Orchestrates specialist agents (TypeScript, React, etc). NOT for architecture decisions."
vuln-research
tanweai
安全研究元思考方法论 - 从先知社区5600+篇安全文档中提炼的漏洞挖掘方法论框架。 Use this skill when: - 进行漏洞挖掘和安全研究时，需要系统化的思考框架 - 分析特定类型漏洞（Web注入、反序列化、二进制、域渗透等）的攻击路径 - 需要了解绕过防护措施（WAF、EDR、沙箱）的思维模式 - 进行代码审计需要Source-Sink分析方法论 - 红队攻防需要完整攻击链规划 - CTF竞赛需要快速解题思路 - 逆向分析恶意软件需要方法论指导 Triggers: 漏洞挖掘、安全研究、渗透测试、代码审计、红队攻防、CTF、逆向分析、 WAF绕过、免杀、提权、横向移动、域渗透、反序列化、二进制安全、Fuzzing
compliance-automation
vivekgana
Automated compliance checks, continuous monitoring, reporting frameworks for GDPR, HIPAA, SOC2, and CCPA compliance.
code-review
odyssey4me
Review PRs, MRs, and Gerrit changes with focus on security, maintainability, and architectural fit. Leverages github, gitlab, or gerrit skills based on repository context.
discover-containers
rand
Automatically discover container skills when working with Docker, Dockerfile optimization, docker-compose, container networking, container security, container registries, or Kubernetes. Activates for containerization and orchestration tasks.
credential-manager
openclaw
MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.
Moltbook Trust Engine ð§
openclaw
All versions of all skills that are on clawhub.com archived
aegis-shield
openclaw
Prompt-injection and data-exfiltration screening for untrusted text. Use before summarizing web/email/social content, before replying, and especially before writing anything to memory. Provides a safe memory append workflow (scan → lint → accept or quarantine).
apple-media
openclaw
Control Apple TV, HomePod, and AirPlay devices via pyatv (scan, stream, playback, volume, navigation).
security-audit
openclaw
Minimal helper to audit skill.md-style instructions for supply-chain risks.
skill-vetter
openclaw
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
bounty-hunter
openclaw
Automated smart contract bug bounty hunting. Scans Immunefi/Code4rena targets with Slither static analysis, triages findings with local LLMs, and generates PoC templates. Zero API cost for scanning phase.