安全

aws-security-architecture

Hack23

AWS security best practices, VPC security, IAM, KMS, CloudTrail, GuardDuty for CIA platform deployment

seo-audit

ferdiboxman

Audit any landing page for SEO issues like a senior growth operator

wallet-compliance-scanner

tawf-labs

Scan crypto wallets and tokens for Sharia (Islamic finance) compliance. Checks tokens against halal/haram criteria including riba (interest), gharar (uncertainty), maysir (gambling), and prohibited protocol types. Outputs per-token verdicts and overall wallet health score.

rafter

Raftersecurity

"Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs rafter run (remote SAST+SCA), rafter secrets (local secrets-only), rafter audit, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of that, a quick surface check is enough. When such surface IS present and no rafter skill or CLI call has been made, invoke this before handing the task off — an un-evaluated \"done\" on genuine security surface is not done."

compliance-checklist

Hack23

Unified compliance verification across ISO 27001, NIST CSF, CIS Controls, NIS2, EU CRA, GDPR, SOC 2, PCI DSS, and HIPAA for cybersecurity consulting

ciso-coach

campbellmcgregor

Expert CISO coaching and mentorship for security leaders in training. Use when the user asks for CISO coach guidance, executive communication advice, security leadership strategies, or needs help translating technical security issues for non-technical audiences. Also activates for discussions about current security events, threat landscape analysis, board-level security topics, risk communication, or security program development from a CISO perspective.

security

dottiedreamworks-dot

Comprehensive AI agent security and privacy guidelines. Covers prompt injection defense, data protection, access controls, system integrity, and safe system integration practices. Complements the healthcheck skill (which handles host-level hardening).

SKILL.md — Security Audit

iamthetonyb

Correlate with external threat intelligence if available

tech-debt-report

IHKREDDY

Find TODOs, deprecated APIs, and outdated patterns in codebase

convex

MichaelFisher1997

Umbrella skill for all Convex development patterns. Routes to specific skills like convex-functions, convex-realtime, convex-agents, etc.

hipaa-compliance

affaan-m

HIPAA-specific entrypoint for healthcare privacy and security work. Use when a task is explicitly framed around HIPAA, PHI handling, covered entities, BAAs, breach posture, or US healthcare compliance requirements.

dependency-updater

VisualxIntelligence

Smart dependency management for any language. Auto-detects project type, applies safe updates automatically, prompts for major versions, diagnoses and fixes dependency issues.

code-review

IHKREDDY

Performs comprehensive code reviews following industry best practices. Use when reviewing pull requests, code changes, or when asked to analyze code quality, security, performance, or maintainability. Checks for common bugs, security vulnerabilities, code smells, and adherence to coding standards.

data-protection

Hack23

Data classification (CIA triad), GDPR privacy by design, encryption standards, data lifecycle management

spec-to-code-compliance

aleister1102

Verifies code implements exactly what documentation specifies for blockchain audits. Use when comparing code against whitepapers, finding gaps between specs and implementation, or performing compliance checks for protocol implementations.

red-team-mastercourse

Albashmohandes

Free, up-to-date, full-spectrum red-team curriculum (fundamentals → AD → evasion → web → AI/LLM red teaming → AI-in-your-workflow). Consolidates Microsoft AI Red Team 101, Zero-Point Security RTO structure, OWASP GenAI/LLM Top 10, MITRE ATT&CK/ATLAS, and the free lab ecosystem. Every module has real commands/code and a mapped free lab. Includes a hard ethical boundary (authorized-only, no attribution evasion).

OWASP Top 10 Security Reviewer

nguyenhuy158

```

SkillSync MCP — Security-Gated Skill Manager

Glowboth

Critical threats (prompt injection, RCE, credential theft) permanently block installation. Medium/high risk requires explicit force: true. All output is sanitized against prompt injection.

tool-gdelt-news

captaindpt

Use the gdelt_news tool to fetch recent headlines via GDELT (free) with shared caching, rate limiting, and basic query normalization.

advanced-skill-creator

YPYT1

Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards.

immunis

greatnorthernfishguy-hub

security-review

HerbHall

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing sensitive features. Provides comprehensive security checklist and patterns.

codex-security

Dreamstick9

Automate security vulnerability discovery, code auditing, deep multi-worker scans, PR/commit diff reviews, finding validation with evidence/PoCs, automated patching, patch risk assessments, false positive triage, GitHub Code Scanning alert imports, and SARIF/JSON/CSV report exports using OpenAI Codex Security CLI and SDK. Use when conducting codebase security audits, investigating security findings, reviewing diffs for vulnerabilities, validating alerts, or hardening software security boundaries.

laravel-best-practices

jcastillotx

Laravel development standards. Triggers when working with Laravel applications, Eloquent ORM, Blade templates, or Livewire components.