安全
安全扫描与漏洞检测
skill-security-checker
fyniujin
'Skill Security — 安全审计扫描器，审一下这个 skill、装之前帮我查查、这个 skill 安全吗？一键快扫 30 秒出三档裁定（✅干净/⚠️可疑/🚫恶意）+ Top3 风险 + 一句话理由；全量模式覆盖轻量 SAST 污点追踪（Python AST + JS 词法近似，source→sink 证据链降误报）、规则引擎（YAML 规则包热插拔扩展）、社区规则（schema 校验 + 来源记录 + 签名验证）、提示注入 ML 语义检测（ONNX + 正则降级）、系统级行为捕获（eBPF Linux / ETW Windows）、动态沙箱执行扫描、供应链风险分析、OSV.dev 离线数据包（全生态 CVE 覆盖，零密钥）+ 锁文件深度解析（requirements.txt / package-lock.json / poetry.lock，版本区间级精确匹配）、恶意 Skill 指纹库、健康度与合规检查（质量+结构+权限合并）、全局排除配置、CI/CD 集成、JSON/HTML/SARIF 报告生成。'
managing-npm
Git-Fg
"Manages npm, pnpm, and bun dependencies following strict protocols. Use when installing, updating, or auditing packages. Do not use for TypeScript configuration or build tooling."
macos-distribution
makgunay
macOS app distribution covering code signing (Developer ID, App Store certificates), notarization (notarytool), DMG/pkg creation, App Store submission workflow, sandboxing entitlements, StoreKit for in-app purchases and subscriptions (SubscriptionOfferView, appTransactionID, Transaction.currentEntitlements, subscriptionStatusTask), StoreKit testing with local configuration files, PrivacyInfo.xcprivacy manifest, and dual distribution strategies (App Store + direct). Use when preparing an app for distribution, implementing purchases/subscriptions, configuring signing, or troubleshooting App Store rejection.
claude-md-bp-context
getskillsdev
Audit CLAUDE.md for best practices. 18-point checklist.
refine
meetdave3
Audit, score, and improve any project's Claude Code configuration. Analyzes CLAUDE.md, skills, agents, hooks, MCP servers, and settings. Trigger: /refine, /refine audit, /refine quick
security-audit
elliottrjacobs
Deep security audit of codebase with parallel domain-focused agents. Use when the user says "security audit", "check for vulnerabilities", "security review", or before a launch/deployment. More thorough than the security reviewer in /engineer-review.
reflect
jainabhishek
Self-improving skill that analyzes conversations for corrections and preferences, then persists them to skill files with optional Git versioning. Use when: (1) User runs "/reflect" or "/reflect [skill-name]" to manually extract learnings, (2) User says "reflect on" or "reflect off" to toggle automatic reflection, (3) User says "reflect status" to check mode, (4) User wants Claude to remember corrections for future sessions. Supports manual and automatic (hook-based) modes.
security-practices
pluginagentmarketplace
Master secure development, OWASP top 10, testing, and compliance. Use when building secure systems, conducting security reviews, or implementing best practices.
audit-methodology
leobrival
Comprehensive audit methodology for web applications covering accessibility (RGAA 4.1), security (OWASP Top 10), performance (Core Web Vitals), and eco-design. Use when users need guidance on audit processes, testing methodologies, compliance standards, or audit best practices. Includes detailed reference documentation for each audit domain.
ai-code-reviewer
physics91
WHEN: Deep AI-powered code analysis, multi-model code review, security scanning with Codex and Gemini WHAT: Comprehensive code review using external AI models with severity-based findings, deduplication, and secret detection WHEN NOT: Simple lint checks -> code-reviewer, Quick security only -> security-scanner, Style formatting -> code-quality-checker
google-cloud
BankkRoll
"Scraped from https://cloud.google.com/docs/ Source: https://cloud.google.com/docs. Use when questions involve: ai ml, authentication, buildpacks, enterprise, generative ai, security, terraform."
agent-safety
pluginagentmarketplace
Ensure agent safety - guardrails, content filtering, monitoring, and compliance
skillvet
oakencore
"Security scanner for ClawHub/community skills — detects malware, credential theft, exfiltration, prompt injection, obfuscation, homograph attacks, ANSI injection, campaign-specific attack patterns, and more before you install. Use when installing skills from ClawHub or any public marketplace, reviewing third-party agent skills for safety, or vetting untrusted code before giving it to your AI agent. Triggers: install skill, audit skill, check skill, vet skill, skill security, safe install, is this skill safe."
supabase-postgres-best-practices
Jackiexiao
"Postgres performance optimization and best practices from Supabase for schema, indexing, query tuning, security, and operations."
sql-optimizer
physics91
WHEN: SQL query review, query optimization, index usage, N+1 detection, performance analysis WHAT: Query plan analysis + Index recommendations + N+1 detection + Join optimization + Performance tuning WHEN NOT: Schema design → schema-reviewer, ORM code → orm-reviewer
disciplined-verification
terraphim
Phase 4 of disciplined development. Verifies implementation against design through unit and integration testing. Builds traceability matrices, tracks coverage, and loops defects back to originating left-side phases.
clawdefender
arc-claw-bot
Security scanner and input sanitizer for AI agents. Detects prompt injection, command injection, SSRF, credential exfiltration, and path traversal attacks. Use when (1) installing new skills from ClawHub, (2) processing external input like emails, calendar events, Trello cards, or API responses, (3) validating URLs before fetching, (4) running security audits on your workspace. Protects agents from malicious content in untrusted data sources.
cloud-resources
SerendipityOneInc
Cloud resource management and monitoring for GCP (云资源管理与监控 - GCP)
security-audit
chrysos
Run comprehensive security audit on any project. Detects package manager (npm, pnpm, yarn, bun, pip, composer, cargo, go), runs native audit commands, and searches the web for CVEs and security advisories for ALL dependencies — even those that pass the audit. Generates a detailed security report.
clawdbot-self-security-audit
Nep-Cheat
Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities and generate reports. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities do I have". This skill only READS configuration and generates reports—it never modifies settings or executes fixes automatically. Designed to be extensible—new checks can be added by updating this skill's knowledge.
audit-reports
fethallaheth
Generate formatted security audit findings for Web3 platforms (Sherlock, Code4rena, Cantina). Use when user needs to report vulnerabilities, format findings, or create audit reports for smart contract security contests.
opencode-audit
IdoKendo
Audit OpenCode configuration quality, safety, and operability with a 100-point rubric and concrete remediations.
security-scanner
physics91
WHEN: Security scan, vulnerability detection, XSS/CSRF analysis, secret exposure, OWASP Top 10 WHAT: XSS/injection detection + hardcoded secrets + auth/authz issues + severity-based vulnerability list WHEN NOT: Performance → perf-analyzer, Cloud security → cloud-security-expert
auditing-plugins
Git-Fg
"Comprehensive plugin auditing for compliance with marketplace best practices. MUST Use when validating, refactoring, or improving plugin quality. Do not use for creating new plugins, scaffolding components, or development tasks."