Security

jiayaoqijia Bundle

KuCoin Assets management using the KuCoin API. Account information, balances, deposits, withdrawals, sub-accounts, and fee rates. Authentication requires API Key, API Secret, and Passphrase.

jiayaoqijia Bundle

KuCoin Broker and Affiliate using the KuCoin API. Affiliate invite management, commission queries, Broker Pro user management, and ND (Exchange) Broker queries. Authentication requires API Key, API Secret, and Passphrase.

jiayaoqijia Bundle

Use this skill when the user asks to export audit logs, find audit log location, view command history, 导出日志, 查看日志, 日志路径, 操作记录, 调用记录, 命令历史. Do NOT use for wallet balance, token search, swap, or any other on-chain operation — use the corresponding skill instead.

jiayaoqijia Bundle

KuCoin Convert using the KuCoin API. Get conversion quotes, query convert order details and history. Authentication requires API Key, API Secret, and Passphrase.

jiayaoqijia Bundle

This skill should be used when the user encounters an HTTP 402 Payment Required response, wants to pay for a payment-gated API or resource, or mentions 'x402', 'pay for access', '402 payment', 'payment-gated URL', or 'sign x402 payment'. Primary path signs via TEE with a wallet session (JWT); fallback path guides local EIP-3009 signing with the user's own private key if they have no wallet. Returns the payment proof (signature + authorization) that the caller can attach as a payment header to access the resource. Do NOT use for swap or token transfers — use okx-dex-swap instead. Do NOT use for wallet balance or portfolio queries — use okx-agentic-wallet or okx-wallet-portfolio. Do NOT use for security scanning — use okx-security. Do NOT use for transaction broadcasting — use okx-onchain-gateway. Do NOT use for general programming questions.

comeonoliver Bundle

Guides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript. Use when building, configuring, or debugging a Fastify application — including defining routes, implementing plugins, setting up JSON Schema validation, handling errors, optimising performance, managing authentication, configuring CORS and security headers, integrating databases, working with WebSockets, and deploying to production. Covers the full Fastify request lifecycle (hooks, serialization, logging with Pino) and TypeScript integration via strip types. Trigger terms: Fastify, Node.js server, REST API, API routes, backend framework, fastify.config, server.ts, app.ts.

comeonoliver Skill

Security Ownership Map

comeonoliver Skill

Security Best Practices

comeonoliver Bundle

XSS Prevention

jiayaoqijia Bundle

Onchain randomness on Sui. Use when generating random values in Move smart contracts, working with the Random object (0x8) or RandomGenerator, securing randomness-consuming functions against composition attacks, PTB attacks, or state leakage, implementing commit-reveal patterns, balancing gas across execution paths, or integrating randomness from TypeScript. For general Move security patterns, see the `move-security` skill. For Move language fundamentals, see the `sui-move` skill. For TypeScript SDK patterns, see the `sui-sdks` skill.

jiayaoqijia Bundle

Scan code and dependencies for security vulnerabilities. Check npm audit, pip safety, and common security issues.

jiayaoqijia Bundle

Persist canister state across upgrades. Covers StableBTreeMap and MemoryManager in Rust, persistent actor in Motoko, and upgrade hook patterns. Use when dealing with canister upgrades, data persistence, data lost after upgrade, stable storage, StableBTreeMap, pre_upgrade traps, or heap vs stable memory. Do NOT use for inter-canister calls or access control — use multi-canister or canister-security instead.

jiayaoqijia Bundle

Motoko language pitfalls, modern syntax, and architecture patterns for the Internet Computer. Covers persistent actors, stable types, mo:core standard library, dot notation, mixins, and common compilation errors. Use when writing Motoko canister code, fixing Motoko compiler errors, or generating Motoko actors. Do NOT use for deployment, icp.yaml, or CLI commands; for design review or audit of existing Motoko code, load reviewing-motoko instead.

jiayaoqijia Bundle

Use when pre-reviewing, peer reviewing, stress-testing, or assessing submission readiness of a cryptography, ZKP, lattice, or security paper for a leading research venue.

jiayaoqijia Bundle

Use when auditing an interactive or non-interactive zero-knowledge proof/argument, proof of knowledge, Fiat-Shamir transform, SNARK/STARK, polynomial commitment, aggregation, recursion, folding, or IVC system.

jiayaoqijia Bundle

Smart Contract Security Scanner

jiayaoqijia Bundle

Use when outlining, drafting, restructuring, or completing a cryptography, ZKP, lattice, or security paper from verified claims, proofs, literature, parameters, experiments, artifacts, and venue requirements.

jiayaoqijia Bundle

Secret Guard

jiayaoqijia Bundle

Improve an existing skill in the IC Skills repo (skills.internetcomputer.org). Load this skill whenever asked to improve, fix, update, enhance, review, or add content to an existing skill at skills/<skill-name>/SKILL.md — including adding pitfalls, updating canister IDs, fixing code examples, strengthening the description, or updating evals. Do NOT use for creating a brand-new skill (use skill-creator for that). Trigger examples: "the motoko skill is missing a pitfall", "update icp-cli for the new recipe format", "the ckbtc description is weak", "add an eval for the canister-security skill".

jiayaoqijia Bundle

Use when auditing a cryptographic theorem, lemma, proof, game hop, reduction, ZKP security property, lattice assumption, or claimed protocol-security implication.

jiayaoqijia Bundle

KuCoin Margin trading using the KuCoin API. Cross margin and isolated margin market data, order queries, borrowing/repaying queries, lending queries, and risk limits. Authentication requires API Key, API Secret, and Passphrase.

jiayaoqijia Bundle

Description

jiayaoqijia Bundle

Security review for Cardano smart contracts written in Aiken, Plutus, or OpShin. Trigger: "review contract", "audit validator", "check security", "find vulnerabilities", "security review", "smart contract audit", "check for exploits".

jiayaoqijia Bundle

Guide writing a Cardano validator from a specification. Covers datum/redeemer design, validator logic, security checks, and test planning. Default language is Aiken. Trigger: "write validator", "create contract", "build smart contract", "new validator", "implement spending validator", "write minting policy".

jiayaoqijia Bundle

IC-specific security patterns for canister development in Motoko and Rust. Covers access control, anonymous principal rejection, reentrancy prevention (CallerGuard pattern), async safety (saga pattern), callback trap handling, cycle drain protection, and safe upgrade patterns. Use when writing or modifying any canister that modifies state, handles tokens, makes inter-canister calls, or implements access control.

jiayaoqijia Bundle

Solidity Security Analyzer

jiayaoqijia Bundle

KuCoin Futures trading using the KuCoin API. Futures market data, orders, positions, and funding fees. Authentication requires API Key, API Secret, and Passphrase.

jiayaoqijia Bundle

Use when auditing LWE, Ring-LWE, Module-LWE, SIS-family, lattice KEM/signature/FHE/ZKP parameters, reductions, correctness failures, concrete attacks, estimator outputs, or implementation compatibility.

matevip Skill

Pre-commit review: security scan, quality gates, auto-fix.

davidtoby Skill

Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.

shengdabai Bundle

DTC 数据仪表盘与体检引擎——全链路数据分析、KPI 追踪、行业基准对标、数据健康度评估、市场趋势监控。Use when user mentions: 数据体检, data audit, KPI, 仪表盘, dashboard, 指标追踪, metrics, 基准线, benchmark, 数据分析, data analysis, 营收报表, revenue report, 渠道数据, 广告数据, ROAS跟踪.

jiayaoqijia Bundle

Audit Raydium liquidity positions before capital is deployed. Analyze pool depth, concentration, liquidity quality, structural risks, and parameter changes so users can make cleaner LP decisions.

om-scogo Bundle

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

om-scogo Bundle

Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.

peteedoo Bundle

Enumerate and exploit Active Directory Certificate Services ESC1 through ESC16 misconfigurations with Certipy, including SAN abuse, NTLM relay to web enrollment (ESC8), and golden certificate forgery.

peteedoo Bundle

Build and run a third-party / vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM and NIST CSF 2.0 GV.SC: inventory and tier vendors by risk, send the right due-diligence questionnaire (SIG, CAIQ), review evidence (SOC 2, ISO 27001, pen-test reports), set contractual security and right-to-audit clauses, monitor vendors continuously, manage Nth-party / subcontractor risk, and offboard securely. Use when an organization needs to assess a new vendor before onboarding, when standing up or maturing a vendor-risk program, when tiering a vendor portfolio, when reviewing a SOC 2 or CAIQ, when writing security requirements into a contract or DPA, when a vendor suffers a breach, or when managing supply-chain / software supply-chain risk. Keywords: third-party risk, vendor risk management, TPRM, supply chain risk, C-SCRM, NIST 800-161, vendor tiering, SIG questionnaire, CAIQ, SOC 2, ISO 27001, right to audit, continuous monitoring, security ratings, fourth-party risk, Nth-party, vendor offboarding, d