安全
安全扫描与漏洞检测
domain-review
Semprini
Use this skill when the user asks to review, audit, validate, or quality-check an existing MD-DDL domain and its detail files. Also use before declaring a domain “complete” or production-ready. This skill performs both structural conformance checks and decision-quality checks for relationship granularity, temporal tracking, existence, mutability, conceptual-to-logical realization, standards alignment, and regulatory posture.
compliance-audit
Semprini
Systematically evaluate MD-DDL domain and entity files for governance metadata completeness and correctness against loaded gulatory frameworks. Use when auditing a domain file or corpus for compliance gaps, when the user asks "is this compliant" or "what's missing", when preparing a gap report, or after a regulatory monitoring pass identifies a potential impact. Always load the regulatory-compliance skill and relevant regulator files before running an audit — this skill defines how to audit, not what the requirements are.
security-audit
Prismas33
"Security auditing and pentesting skill. Use when asked 'analyze security', 'how would you attack', 'vulnerabilities', 'pentester mode', or 'security audit'."
ask-owasp-security-review
NavanithanS
Static security analysis for code, auditing for OWASP Top 10 risks. Triggers: "security audit", "is this secure", "check for vulnerabilities". Capabilities: - Static analysis of code snippets. - Mapping findings to OWASP Top 10 (2021). - Providing remediation code patterns.
dependency-track
rezkam
Query and audit Dependency-Track SCA findings. Use when working with software composition analysis, reviewing vulnerability findings, auditing CVEs, checking project dependency health, uploading SBOMs, or managing policy violations in Dependency-Track.
ask-security-sentinel
NavanithanS
Pre-flight security checker. Scan for secrets and vulnerabilities.
moai-alfred-code-reviewer
AJBcoding
Enterprise systematic code review orchestrator with TRUST 5 principles, multi-language support, Context7 integration, AI-powered quality checks, SOLID principle validation, security vulnerability detection, and maintainability analysis across 25+ programming languages; activates for code reviews, quality standard validation, TRUST 5 enforcement, architectural audits, and automated review automation
gitlab-vulnerability
grandcamel
"GitLab vulnerability operations via API. ALWAYS use this skill when user wants to: (1) list security vulnerabilities, (2) view vulnerability details, (3) confirm/dismiss/resolve vulnerabilities, (4) view vulnerability findings."
senseguard
fermionoid
Semantic security scanner for OpenClaw skills. Detects prompt injection, data exfiltration, and hidden instructions that traditional code scanners miss. Use when user asks to scan skills, check skill safety, or run a security audit.
scanning-for-accessibility-issues
atalovesyou
This skill enables Claude to perform comprehensive accessibility audits. It uses the accessibility-test-scanner plugin to identify WCAG 2.1/2.2 compliance issues, validate ARIA attributes, check keyboard navigation, and assess screen reader compatibility. Use this skill when the user requests an accessibility scan, audit, or compliance check, or when terms like "WCAG", "ARIA", "screen reader", "accessibility testing", or "a11y" are mentioned. It provides actionable insights for improving web application accessibility.
SkillSync MCP — Security-Gated Skill Manager
adityasugandhi
Critical threats (prompt injection, RCE, credential theft) permanently block installation. Medium/high risk requires explicit force: true. All output is sanitized against prompt injection.
code-security-audit
chaigon
对代码项目进行全面安全审计，支持 Python、Node.js、Go、Java 四种语言。 包含依赖漏洞扫描（结合原生工具 + Claude 分析）、代码安全模式检查（OWASP Top 10、注入、反序列化、 敏感信息泄露、认证授权、加密问题等）、业务逻辑审计、攻击链构建、配置审计、以及结构化报告输出。 触发场景：(1) 用户要求对项目进行安全审计/安全检查/代码审计 (2) 用户要求检查代码中的安全漏洞 (3) 用户要求进行依赖漏洞扫描 (4) 用户提到 security audit、vulnerability scan、代码审计、安全扫描、渗透测试前的代码审查 (5) 用户要求检查 OWASP Top 10 相关问题
qa-tester
ajianaz
Comprehensive quality assurance and testing workflow that orchestrates test strategy design, automated testing implementation, performance testing, and quality metrics. Handles everything from unit testing and integration testing to end-to-end testing, performance testing, and quality assurance automation.
review-simplicity
doodledood
"Audit code for over-engineering, premature optimization, and cognitive complexity. Identifies unnecessary abstractions, YAGNI violations, and overly complex solutions. Read-only analysis. Triggers: review simplicity, over-engineering, complexity check, YAGNI."
nda-review
jamietso
Reviews incoming one-way (unilateral) commercial NDAs in a jurisdiction-agnostic way, from either a Recipient or Discloser perspective (user-selected), producing a clause-by-clause issue log with preferred redlines, fallbacks, rationales, owners, and deadlines.
adversarial-reasoning
kimasplund
Red-team thinking for robustness testing and edge case discovery. Use when you need to stress-test solutions, find vulnerabilities, anticipate failures, or challenge assumptions. Ideal for security review, system design validation, decision stress-testing, and pre-mortem analysis. Example: "We've designed an auth system" → Attack it from 10 angles before shipping.
avail
hairyf
Avail Node—run chains, Kate RPC for data availability, block authoring, and runtime APIs for DA tooling.
compliance-automation
vivekgana
Automated compliance checks, continuous monitoring, reporting frameworks for GDPR, HIPAA, SOC2, and CCPA compliance.
moai-alfred-spec-authoring
AJBcoding
Complete SPEC document authoring guide with YAML metadata structure (7 required + 9 optional fields), EARS requirement syntax (5 patterns including Unwanted Behaviors), version lifecycle management, TAG integration, pre-submission validation checklist, and real-world SPEC examples.
Cognitive Governance
AmnadTaowsoam
Cognitive Governance is the God-Mode protocol that implements deep, unblockable
solidity-security
EngineerWithAI
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
moai-alfred-issue-labels
AJBcoding
Enterprise GitHub issue labeling orchestrator with semantic label taxonomy, AI-powered auto-labeling, label hierarchy system, workflow automation, issue triage acceleration, and stakeholder communication; activates for issue classification, label management, workflow automation, priority assignment, and team communication
decision-auditor
rohanpatriot
Audits decisions for cognitive biases, runs premortems on plans, and reframes choices to reveal hidden assumptions. Use when evaluating decisions under uncertainty, reviewing plans for bias, assessing probability and risk, running premortems, checking for anchoring or availability bias, or analyzing why a judgment might be wrong.
python-security-hardening
melvinmt
Harden Python projects with security-first development practices. Enforces 100% test coverage, static analysis, secret scanning, mutation testing, pre-commit hooks, and SOC 2 compliance. Use when setting up security tooling, writing security tests, or hardening a Python codebase.