安全
安全扫描与漏洞检测
unity-review-quality
cuozg
Full Unity project audit — A-F graded HTML report covering architecture, performance, best practices, tech debt. Triggers — 'project audit', 'quality audit', 'project review', 'code quality report', 'tech debt audit'.
code-review-checklist
liuchiawei
"Comprehensive checklist for conducting thorough code reviews covering functionality, security, performance, and maintainability"
Ad Audit — Paid Advertising Analysis for OpenClaw
mmcmedia
â I'll provide Meta, Google, TikTok, LinkedIn benchmarks relevant to your business
pedagogical-code-grader
jorgealves
Evaluates student code submissions based on conceptual mastery rather than just correctness. Use to provide high-quality educational feedback on architectural patterns and programming logic.
sca-pip-audit
vchirrav
Run pip-audit for Python dependency vulnerability scanning. Checks installed packages and requirements files against the OSV and PyPI advisory databases.
sast-bandit
vchirrav
Run Bandit SAST scans on Python code. Detects common security issues like SQL injection, hardcoded passwords, exec usage, and insecure crypto.
owasp-serverless-top-10
yariv1025
"OWASP Serverless Top 10 - prevention, detection, and remediation for serverless (Lambda, Functions) security. Use when building or reviewing serverless apps - event injection, over-permissioned functions, insecure deps, secrets, config, and other serverless-specific interpretations of the Web Top 10."
kata-audit-milestone
gannonh
Verify milestone achievement against its definition of done, checking requirements coverage, cross-phase integration, and end-to-end flows. Triggers include "audit milestone", "verify milestone", "check milestone", and "milestone audit". This skill reads existing phase verification files, aggregates technical debt and gaps, and spawns an integration checker for cross-phase wiring.
mobile-security-mobsf
vchirrav
Run MobSF (Mobile Security Framework) for automated static and dynamic analysis of Android and iOS apps. Detects insecure storage, weak crypto, hardcoded secrets, and permission issues.
sast-cargo-audit
vchirrav
Run cargo-audit and cargo-geiger on Rust code. Audits dependencies for known vulnerabilities and detects unsafe code usage for memory safety review.
ciso-security
jforksy
IT security operations - access control reviews, vulnerability management, incident response, and security tool configuration
skills-audit
jforksy
Audit, validate, and maintain the skills ecosystem - structure checks, hierarchy mapping, lint, and health dashboard
code-audit
lukhanteanini21-glitch
Professional code security audit skill covering 55+ vulnerability types. Enhanced with WooYun 88,636 real-world vulnerability cases (2010-2016). This skill should be used when performing security audits, vulnerability scanning, penetration testing preparation, or code review for security issues. Supports 9 languages: Java, Python, Go, PHP, JavaScript/Node.js, C/C++, .NET/C#, Ruby, Rust. Includes 143 mandatory detection items across all languages with language-specific checklists. Covers SQL injection, XSS, RCE, deserialization, SSRF, JNDI injection, JDBC protocol injection, authentication bypass, business logic flaws, race conditions, and modern security domains (LLM, Serverless, Android). WooYun integration adds: statistical-driven parameter priority, bypass techniques library, logic vulnerability patterns, and real-case references. v1.0: Initial public release with Docker deployment verification framework.
Energy Audit and Zone of Genius
Coowoolf
Review your calendar, color-code activities by energy impact (Green/Red), and systematically delegate draining tasks to maximize time in your Zone of Genius.
secret-scan-gitleaks
vchirrav
Run Gitleaks to detect hardcoded secrets in git repositories. Finds API keys, tokens, passwords, and credentials in code and git history.
sca-grype
vchirrav
Run Anchore Grype for SCA vulnerability scanning on filesystems and container images. Matches dependencies against multiple vulnerability databases (NVD, GitHub, OS advisories).
cloud-security-prowler
vchirrav
Run Prowler for comprehensive cloud security posture assessment. Audits AWS, Azure, and GCP against CIS Benchmarks, PCI-DSS, HIPAA, GDPR, and other compliance frameworks.
cto
jforksy
CTO Co-Pilot - strategic technical leadership, architecture decisions, infrastructure optimization, and engineering team coordination
dependency-audit
fefogarcia
Comprehensive dependency health auditing for JavaScript/TypeScript projects. Run npm audit, detect outdated packages, check for security advisories, and verify license compliance. Prioritises vulnerabilities by severity and provides actionable fix recommendations. Use when: auditing project dependencies, checking for vulnerabilities, updating packages, preparing for release, or investigating "npm audit" warnings. Keywords: audit, vulnerabilities, outdated, security, npm audit, pnpm audit, CVE, GHSA, license.
owasp-top-10
yariv1025
"OWASP Top 10 web application security risks - prevention, detection, and remediation. Use when implementing or reviewing access control, authentication, crypto/sensitive data, input validation and injection, secure design, security configuration, dependency management, session/identity, deserialization or CI/CD integrity, logging and monitoring, or server-side requests (SSRF)."
x-content-optimizer
NewmanXBT
Audit and optimize tweets, X articles, and threads for X's recommendation algorithm. Use when user wants to review content before posting, improve engagement potential, or get algorithm-friendly suggestions. Triggers on /x-content-optimizer or requests to "review tweet", "optimize for X algorithm", "audit my post", or "improve engagement".
malware-scan-yara
vchirrav
Run YARA rules for pattern-based malware identification. Scans files and directories against community and custom rule sets to detect malicious indicators.
ciso-vendor-risk
jforksy
Third-party risk management - vendor security assessments, SaaS tool reviews, vendor risk scoring, and onboarding checklists
critical-thinking
plutowang
Always-on skill that enforces critical thinking during coding. Auto-apply on every coding task to prevent yes-man behavior, challenge assumptions, and ensure technical decisions are well-reasoned.