Security

robomotionio Bundle

Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C/C++/Rust code handling secrets, keys, passwords, or other sensitive data.

robomotionio Bundle

Augments Trailmark code graphs with external audit findings from SARIF static analysis results and weAudit annotation files. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, cross-referencing Semgrep or CodeQL findings with call graph data, or visualizing audit findings in the context of code structure.

aws Bundle

Amazon Bedrock production readiness assessment covering IAM governance, data retention (ZDR), quota and capacity headroom, and operational observability across Standard Bedrock and Mantle surfaces. Use this skill when a user asks to review Bedrock readiness, assess Bedrock security posture, evaluate quota headroom, check ZDR configuration, validate Bedrock operational setup, or prepare for Bedrock production deployment. Triggers on "Bedrock readiness review", "am I ready for Bedrock production", "Bedrock security assessment", "check my Bedrock quotas", "Bedrock adoption audit", "Bedrock operational review", or "assess my Bedrock environment".

2233admin Bundle

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

2233admin Bundle

API 安全测试

2233admin Bundle

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

2233admin Bundle

N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。

2233admin Bundle

# Supply Chain Security Testing

2233admin Bundle

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse engineering, malware, DFIR, firmware, pwnable, and native exploit challenges. Use when the user asks to reverse a binary, unpack a sample, inspect a memory dump or PCAP, recover malware behavior, debug a crash, or build or verify an exploit chain under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

arthjean Skill

Configure TOTP authenticator apps, send OTP codes via email/SMS, manage backup codes, handle trusted devices, and implement 2FA sign-in flows using Better Auth's twoFactor plugin. Use when users need MFA, multi-factor authentication, authenticator setup, or login security with Better Auth.

shawnpang Skill

When the user needs to design, improve, or audit a post-signup activation flow to get new users to their first value moment. Activate when activation is lagging, time-to-value feels excessive, or first sessions lack impact.

juspay Skill

Audit code for correctness and rigor — logic errors, silent error swallowing, wishful thinking, and unjustified fallbacks. This is not a style review; it's a logic review. Use when you want a focused correctness audit separate from the full code-police pass.

jsmastery-pro Bundle

Run /audit on a greenfield project, an existing codebase with missing docs, or one area (/audit src/auth) to bootstrap the project's AI context — the AGENTS.md files every later skill reads. Writes tool-agnostic AGENTS.md plus thin CLAUDE.md pointers, adding only what is missing; never overwrites curated content.

the-utopia-studio Skill

Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants. Use when analyzing industry dynamics, assessing competitive forces, or evaluating market attractiveness.

open-gsd Skill

Review code changes for security, performance, bugs, and quality. Reviews staged changes, unstaged changes, specific commits, or PR-ready diffs.

haifai-ai Skill

Use when writing, moving, reviewing, or auditing documentation in the deepseek-harness repo — choosing hierarchy and detail, separating tutorials from references, checking tutorial progression, trimming doc slop, responding to a verify-doc-budgets failure, or requests like "improve the docs", "audit the docs", "where should this be documented", or "this doc is too long".

vril-labs Skill

Expert guidance for Spring Boot application development with best practices for RESTful APIs, testing, security, and deployment

vril-labs Skill

WordPress and WooCommerce development guidelines with PHP best practices, security standards, and extensibility patterns

theneoai Bundle

Expert Coinbase Engineer mindset and methodology covering crypto exchange infrastructure, custody security (98% cold storage), compliance-first architecture, mission-driven development, Base L2 network leadership, and the Everything Exchange vision. Triggers: Coinbase, crypto...

theneoai Bundle

Senior intellectual property attorney with 12+ years experience in patent prosecution, trademark registration, copyright protection, trade secret management, and IP litigation

theneoai Bundle

Expert skill for Datadog Observability & Security Platform

theneoai Bundle

Security Guard

theneoai Bundle

Expert OpenClaw operations and configuration specialist with deep knowledge of gateway setup, daemon management, channel integrations, security policies, skill registry, and Tailscale remote access

theneoai Bundle

Expert emergency manager specializing in disaster preparedness, response coordination, hazard mitigation, and crisis communication. Use when developing emergency plans, coordinating multi-agency response, managing evacuation operations, or leading disaster recovery efforts. Covers all hazards including natural disasters, technological emergencies, and security incidents.

theneoai Bundle

Expert postal service professional specializing in mail processing, delivery operations, customer service, and postal logistics. Use when optimizing mail flow, managing delivery routes, handling customer inquiries, or ensuring postal security. Covers letter carriers, mail processing clerks, retail operations, and postal management.

theneoai Bundle

Expert-level Community Security skill with deep knowledge of access control systems, patrol protocols, surveillance technology, emergency response, and resident safety management

theneoai Bundle

Expert event security specialist specializing in crowd management, access control, threat assessment, and emergency response. Use when securing concerts, sporting events, corporate functions, or public gatherings. Covers venue security, patron screening, conflict de-escalation, and incident management.

theneoai Bundle

> **DISCLAIMER:** This skill provides general education about Square/Block's technology and engineering practices. It does NOT constitute professional financial or legal advice. Building payment and financial systems requires proper PCI compliance, security audits, and regulatory adherence. Always consult Square's official documentation and qualified professionals for production implementations.

theneoai Bundle

A senior macOS system administrator with 10+ years of Apple platform expertise covering enterprise MDM deployment, security hardening, performance tuning, shell automation, and fleet management. A senior macOS system administrator with 10+ years of Apple... Use when: macos, ap...

jsgforever Bundle

Read-only static security audit of Claude Code skills, commands, and plugins. Analyzes SKILL.md frontmatter, body content, supporting scripts, and hooks for security risks. Use this skill when the user asks to "audit a skill", "review skill security", "check SKILL.md for risks", "scan a plugin for dangerous patterns", "verify skill safety", "check skill permissions", "analyze skill hooks", "audit a skill from GitHub", "review a remote skill", "check a skill by URL", or needs a security assessment of any Claude Code skill, command, or plugin before enabling it.

jsgforever Bundle

Validate, lint, audit, or fix .gitlab-ci.yml pipelines, stages, and jobs.

jsgforever Bundle

Validate, lint, audit, or check Terragrunt .hcl/terragrunt.hcl files, stacks, modules, compliance.

jsgforever Bundle

botlearn-healthcheck — BotLearn autonomous health inspector for OpenClaw instances across 5 domains (hardware, config, security, skills, autonomy); triggers on system check, health report, diagnostics, or scheduled heartbeat inspection.

jsgforever Skill

API authentication patterns including JWT, OAuth 2.0, API keys, and session-based auth. Covers token generation, validation, refresh strategies, security best practices, and when to use each pattern. Use when implementing API authentication, choosing auth strategy, securing endpoints, or debugging auth issues. Prevents common vulnerabilities like token theft, replay attacks, and insecure storage.

plurigrid Bundle

Extract and audit claims for norvid tracking system

plurigrid Bundle

Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review, scheduled scans, and full repository audits.