安全
安全扫描与漏洞检测
malware-scan-yara
vchirrav
Run YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
dependency-confusion-detect
vchirrav
Run Confused and GuardDog to detect dependency confusion and typosquatting risks. Checks if internal package names exist on public registries and identifies malicious packages.
security
mrsknetwork
Applies OWASP Top 10 mitigations, secure authentication, authorization, secret management, and data protection practices to FastAPI backends and Next.js frontends. Use for any feature involving auth, user data, payments, file uploads, or system access. Always invoke security review before shipping any user-facing API endpoint.
license-scan-scancode
vchirrav
Run ScanCode Toolkit for comprehensive license and copyright detection. Identifies license types, copyright holders, and compliance obligations across codebases.
secret-scan-trufflehog
vchirrav
Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.
rtos-analysis
tangjunyi23
Real-Time Operating System vulnerability analysis for embedded devices running FreeRTOS, VxWorks, ThreadX, eCos, and other RTOS platforms
frontend-security-basics
SanctifiedOps
Secure Solana frontends against phishing, bad prompts, and unsafe signing requests. Use for audits of wallet UX and dApp sites.
wordpress-pro
paulund
Use when developing WordPress themes, plugins, customizing Gutenberg blocks, implementing WooCommerce features, or optimizing WordPress performance and security.
responsible-disclosure
pluginagentmarketplace
Ethical vulnerability reporting, coordinated disclosure, and bug bounty participation for AI systems
rust-fintech
peixotorms
Use when building financial, trading, or payment systems in Rust. Covers money handling, financial calculations, rounding, decimal precision with rust_decimal and BigDecimal, currency newtypes, ledger, journal entry, reconciliation, idempotency, ACID transactions, regulatory compliance, immutable transaction records, audit trails, checked arithmetic, and double-entry patterns.
suggesting-improvements
C0ntr0lledCha0s
Expert at suggesting specific, actionable improvements to Claude's responses and work. Use when Claude's output needs enhancement, when quality issues are identified, or when iterating on solutions.
creative-writer
dgriffin831
Help agents write creative content
infrastructure-security
pluginagentmarketplace
Securing AI/ML infrastructure including model storage, API endpoints, and compute resources
context-audit
HJewkes
Audit context window composition and identify optimization targets.
skill-scan
dgriffin831
Security scanner for OpenClaw skill packages. Scans skills for malicious code, evasion techniques, prompt injection, and misaligned behavior BEFORE installation. Use to audit any skill from ClawHub or local directories.
code-review
amorriscode
Perform thorough code reviews on pull requests, diffs, or code changes. Use when asked to review code, check a PR, or provide feedback on changes.
epic-security
rubenpenap
Guide on security practices including CSP, rate limiting, and session security for Epic Stack
sox-compliance
peixotorms
Use when building financial reporting systems, accounting software, ERP integrations, payment reconciliation, ledger systems, audit trails, or any code handling financial data at publicly traded companies — SOX Section 302, Section 404, ITGC, IT General Controls, segregation of duties, SoD, change management, access review, audit trail, hash chain, WORM storage, 7-year retention, COSO framework, material weakness, internal controls, audit logging
auth-security-validator
hirefrank
Autonomous validation of authentication security. Checks password hashing, cookie configuration, CSRF protection, and session management for OWASP compliance.
compounder
vxcozy
Weekly review partner that compounds productivity gains over time. Tracks velocity, logs friction, sets next-week targets, recognizes patterns across weeks, and feeds insights back to the audit for the next loop. Use when you want a weekly review, need to identify friction, want to see patterns, or want to update your system map. Part of the architect-system loop. Outputs to system/compounder/week-{date}.md.
certifications-training
pluginagentmarketplace
Professional certifications, CTF competitions, and training resources for AI security practitioners
quality-gate
terraphim
Right-side-of-V verification/validation orchestration for a change or PR. Produces a single Quality Gate Report with evidence covering: code review, security audit, performance regression risk, requirements traceability, acceptance/UAT scenarios, and (when UI changes) visual regression testing. Use when preparing a PR for merge/release, doing a “ready?” check, or enforcing an engineering quality gate.
api-helper
dgriffin831
Helps configure API connections
cors-configuration-validator
hirefrank
Automatically validates Cloudflare Workers CORS configuration, ensuring proper headers, OPTIONS handling, and origin validation for cross-origin requests