安全
安全扫描与漏洞检测
agentic-structure
BackGwa
Collaborative programming framework for production-ready development. Use when starting features, writing code, handling security/errors, adding comments, discussing requirements, or encountering knowledge gaps. Applies to all development tasks for clear, safe, maintainable code.
convex-optimize
antaymard
"Audit and optimize an existing Convex app: security, scale, upgrades, observability."
skill-scan
dgriffin831
Security scanner for OpenClaw skill packages. Scans skills for malicious code, evasion techniques, prompt injection, and misaligned behavior BEFORE installation. Use to audit any skill from ClawHub or local directories.
code-review
amorriscode
Perform thorough code reviews on pull requests, diffs, or code changes. Use when asked to review code, check a PR, or provide feedback on changes.
epic-security
rubenpenap
Guide on security practices including CSP, rate limiting, and session security for Epic Stack
openclaw-doctor
AnthemFlynn
"Comprehensive OpenClaw diagnostic audit — an agent-on-agent health check. Use when asked to check system health, diagnose issues, or audit OpenClaw subsystems. Covers gateway, security, channels, models, memory, context, heartbeat, hooks, skills, workspace integrity, and network."
sox-compliance
peixotorms
Use when building financial reporting systems, accounting software, ERP integrations, payment reconciliation, ledger systems, audit trails, or any code handling financial data at publicly traded companies — SOX Section 302, Section 404, ITGC, IT General Controls, segregation of duties, SoD, change management, access review, audit trail, hash chain, WORM storage, 7-year retention, COSO framework, material weakness, internal controls, audit logging
system-architect
liauw-media
"Use when performing security audits or system hardening. Teaches security assessment principles and prioritization."
code-review
liauw-media
"Self-review before declaring work complete"
quality-gate
terraphim
Right-side-of-V verification/validation orchestration for a change or PR. Produces a single Quality Gate Report with evidence covering: code review, security audit, performance regression risk, requirements traceability, acceptance/UAT scenarios, and (when UI changes) visual regression testing. Use when preparing a PR for merge/release, doing a “ready?” check, or enforcing an engineering quality gate.
api-helper
dgriffin831
Helps configure API connections
solana-security-auditor
x4484
Audit Anchor programs for common vulnerabilities. Reentrancy, PDA collisions, missing signer checks, and pre-deploy security checklists.
cors-configuration-validator
hirefrank
Automatically validates Cloudflare Workers CORS configuration, ensuring proper headers, OPTIONS handling, and origin validation for cross-origin requests
Security Setup Skill
hitoshura25
Create runbook for handling vulnerabilities
transparency-and-disclosures
SanctifiedOps
Write clear disclosures for Solana projects: risks, unlocks, authority states, and data sources. Use for websites, docs, and announcements.
openclaw-admin
AnthemFlynn
"Fix, configure, tune, or troubleshoot OpenClaw. Use for config changes, security fixes, performance tuning, doctor --fix, or when openclaw-doctor flags issues that need remediation."
convex-reviewer
antaymard
"Convex code reviewer — security, auth, validators, performance, and pattern checks for code in a convex/ directory. Use to review or audit Convex functions before shipping."
php-security
peixotorms
Use when handling user input, database queries, file operations, authentication, sessions, or any security-sensitive PHP code. Covers SQL injection prevention with prepared statements, PDO parameterized queries, XSS with htmlspecialchars, CSRF tokens, input validation (filter_var, FILTER_VALIDATE_*, FILTER_SANITIZE_*), output escaping by context, password_hash, password_verify, bcrypt, Argon2, file upload security, session management, SameSite cookies, Content-Security-Policy headers, serialization security, process execution security, error exposure, php.ini hardening (open_basedir, disable_functions, allow_url_include), OWASP Top 10 for PHP, rate limiting, brute force protection, directory traversal, path traversal, and common vulnerability patterns.
pci-compliance
peixotorms
Use when building payment processing, handling credit card data, PAN, CVV, cardholder data environment (CDE), implementing checkout flows, tokenization, Stripe, Braintree, or any code that touches cardholder information — PCI DSS v4.0 coding patterns, SAQ selection, data classification, AES-256 encryption, TLS 1.2, audit log, data masking, Luhn validation, payment gateway integration, 3-D Secure, scope reduction, network segmentation
emerging-specialty-skills
pluginagentmarketplace
Master emerging technologies including blockchain, cybersecurity, QA testing, and specialized tech roles. Stay ahead with cutting-edge technologies.
code-reviewer
gaebalai
Copilot agent that assists with comprehensive code review focusing on code quality, SOLID principles, security, performance, and best practices Trigger terms: code review, review code, code quality, best practices, SOLID principles, code smells, refactoring suggestions, code analysis, static analysis Use when: User requests involve code reviewer tasks.
code-reviewer
icartsh
"보안 스캔, 품질 지표 및 모범 사례 분석을 포함한 자동화된 코드 리뷰입니다. 다음을 위한 코드 리뷰 시 사용합니다: (1) 보안 취약점 및 일반적인 공격 벡터, (2) 코드 품질 이슈 및 유지보수 문제, (3) 성능 병목 현상 및 최적화 기회, (4) 모범 사례 및 디자인 패턴, (5) 테스트 커버리지 및 테스트 전략, (6) 문서 품질 및 완전성"
cve-audit
Mearman
Scan project dependencies for known vulnerabilities. Automatically detect and parse package files (package.json, requirements.txt, Gemfile, go.mod, pom.xml) and check all dependencies against the CVE database. Use when you want to audit a project for security vulnerabilities, check if dependencies have known CVEs, or generate a vulnerability report for compliance.
code-review
dmonteroh
"Provides high-signal, fast code review with selectable modes (quality, security, performance, tooling). Includes an optional safe-by-default review script to summarize diffs, scan for risky patterns, and produce a deterministic report."