安全
安全扫描与漏洞检测
testing-validation
vanman2024
Comprehensive testing and validation tools for Clerk authentication integrations. Includes E2E auth flow testing, security audits, configuration validation, unit testing patterns for sign-in/sign-up flows. Use when implementing Clerk tests, validating authentication setup, testing auth flows, running security audits, creating E2E tests for Clerk, or when user mentions Clerk testing, auth validation, E2E authentication tests, security audit, or test coverage.
fastapi-auth-patterns
vanman2024
Implement and validate FastAPI authentication strategies including JWT tokens, OAuth2 password flows, OAuth2 scopes for permissions, and Supabase integration. Use when implementing authentication, securing endpoints, handling user login/signup, managing permissions, integrating OAuth providers, or when user mentions JWT, OAuth2, Supabase auth, protected routes, access control, role-based permissions, or authentication errors.
agent-security-hardening
SeuPut0705
Security hardening guidance for AI agent frameworks that process untrusted content, invoke tools, write workspace files, manage runtime identifiers, or handle credentials. Use when building or reviewing an agent runtime, autonomous worker, tool gateway, memory service, or multi-tenant agent deployment. Do not use for general web application security or offensive testing.
audit-code
Swader
Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized report with concrete fixes. Use when the user asks to audit code, perform a deep review, stress-test a codebase, or produce a risk-ranked remediation plan across backend, frontend, APIs, infra scripts, and product flows. Keep the audit stack-agnostic first, then add runtime-specific checks as an overlay.
code-review
nth5693
Systematic multi-perspective code review with consistent quality gates.
Security Skill
nth5693
```
ctct-security-patrol
CTCT-CT2
OpenClaw 安全巡检工具，一键执行系统安全扫描并生成通俗易懂的报告。 使用场景：用户说"安全巡检"、"安全检查"、"安全审计"、"巡检"、"security audit"、"检查安全"、"系统安全"等。 触发条件：任何与 OpenClaw 安全检测、审计、巡检相关的请求。
secureclaw
adversa-ai
Security skill for OpenClaw agents (7-framework aligned). 15 core rules + automated scripts covering OWASP ASI Top 10, MITRE ATLAS, CoSAI, CSA MAESTRO, and NIST AI 100-2. Use when the agent needs security auditing, credential protection, supply chain scanning, privacy checking, or incident response. By Adversa AI (https://adversa.ai). v2.2.0.
secureclaw
adversa-ai
Security hardening toolkit for OpenClaw. Run audits, apply fixes, scan skills, monitor costs and memory integrity.
adversarial-code-review
third774
Review code through hostile perspectives to find bugs, security issues, and unintended consequences the author missed. Use when reviewing PRs, auditing codebases, or before critical deployments.
evaluator
mickeyyaya
Use when the user invokes /evo:evaluator or asks to evaluate, assess, score, or independently audit code quality, project health, or improvement priorities with multi-dimensional scoring and anti-gaming defenses
spec-to-code-compliance
lv416e
Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.
workleap-chromatic-best-practices
workleap
Workleap's Chromatic best practices for snapshot cost control and CI optimization. Use this skill when: (1) Auditing or implementing Chromatic cost optimizations in a repository (2) Fixing Chromatic TurboSnap-disabling patterns (barrel imports, large preview dependencies, local scripts) (3) Setting up or updating chromatic.config.json and GitHub Actions CI workflows for Chromatic (4) Reviewing PRs for Chromatic snapshot cost impact (5) Configuring Chromatic in Turborepo/monorepo projects
differential-review
lv416e
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
sharp-edges
lv416e
"Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by default' and 'pit of success' principles. Triggers: footgun, misuse-resistant, secure defaults, API usability, dangerous configuration."
minimalism
mickeyyaya
Use in any coding session when writing or changing code — enforces the laziest solution that actually works (YAGNI, stdlib-first, shortest diff) while never trimming validation, error handling, security, accessibility, or the pipeline's tests/gates. Also triggers on "minimalism", "be lazy", "simplest/minimal solution", "yagni", "do less", "shortest path", or complaints about over-engineering, bloat, boilerplate, or unnecessary dependencies.
skill-issue
build000r
Create, update, and package skills for AI coding agents. Use when asked to "create a skill", "make a skill", "new skill", "skill template", "design a skill", "build a skill", or when working with SKILL.md files, frontmatter, bundled resources (scripts/, references/, assets/), or .skill packaging. Also triggers on "how do I make a skill", "skill best practices", "skill structure", or requests to extend an agent's capabilities with reusable workflows.
audit-context-building
lv416e
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
firebase-apk-scanner
lv416e
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app security audits, or testing Firebase endpoint security. For authorized security research only.
code-review-simplify
mickeyyaya
Use when reviewing code changes for quality, security, performance, or maintainability issues and identifying simplification opportunities in a single token-efficient pass
code-review
PaulRBerg
This skill should be used when the user asks to "review code", "review PR", "code review", "audit code", "check for bugs", "security review", "review my changes", "find issues in this code", "review the diff", or asks for pull request review or code audit.
lampson-system-design
copyleftdev
Design systems using Butler Lampson's principles of abstraction, interfaces, and practical wisdom. Emphasizes clean abstractions, security foundations, and time-tested design hints. Use when making architectural decisions, designing APIs, or building systems that must evolve over decades.
mem-weekly
zephyrwang6
AI个人记忆系统的周复盘功能。分析本周L1情境层记录，识别重复模式，提炼到L2行为层。使用场景：(1) 用户说"周复盘"时；(2) 每周定期回顾时；(3) 需要从日常记录中提炼行为模式时。该skill会自动统计重复出现的行为（3次+），生成候选列表，等待用户确认后更新L2行为层。
mem-file-scan
zephyrwang6
AI个人记忆系统的文件扫描回顾功能。扫描Obsidian仓库中本周修改的文件（排除AI_MEMORY目录），识别潜在的重要事件和决策。使用场景：(1) 用户说"文件扫描"、"查看本周文件"、"扫描文件变化"时；(2) 周复盘时补充L1记录前；(3) 用户想回顾本周在Obsidian中的活动时。该skill会列出修改的文件，询问用户哪些需要记录到L1，并辅助记录。