Security

davidtoby Skill

Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.

davidtoby Skill

Download a YouTube video, convert to MP4 if needed, build bilingual English/Chinese subtitles, audit completeness, and export softsub + hardcode MP4 deliverables. Includes fallback paths when YouTube auto-captions are partial or Chinese caption download is rate-limited, and notes a hardcode duration drift fix.

dragoon0x Skill

Audit visual density and whitespace balance. Checks that spacing from your system creates appropriate rhythm between sections.

dragoon0x Skill

Audit elevation consistency. Checks that shadow usage follows a logical hierarchy — cards < dropdowns < modals.

dragoon0x Skill

Find every font-size in the codebase that doesn't match your type scale. Lists violations with suggested scale values.

dragoon0x Skill

Find every color in the codebase that isn't in your palette or token system. Lists orphan colors with suggested replacements.

dragoon0x Skill

Find every spacing value in the codebase that doesn't match your scale. Lists violations by file and line.

dragoon0x Skill

Check background color hierarchy. Verifies that surfaces, cards, and modals use the correct token from your system.

emaraschio Bundle

Scoped, plan-first workflow for large "check-N-things" tasks (audits, inventories, catalogs, large migrations, cross-checks). Decomposes the surface, fans out capped parallel subagents, verifies findings before reporting, and gates any change behind explicit approval. Use for "audit X for Y", "find all", "catalog every", "inventory", "migrate across", or any repeatable workflow that has quietly become "check 400 things".

emaraschio Bundle

Security audit of codebase or change

emaraschio Bundle

Act as an AI operations consultant: interview how a business function's workflows actually run, label each step Human-only / AI-assisted / AI-owned, pick the highest-ROI automation tied to money, margin, or output, warn on AI theater and distraction traps, and recommend one narrow one-week test. Use for automation ROI, workflow AI map, ops consultant, or "where should AI help".

angelburgosrosado Skill

OSINT username search across 400+ social networks. Hunt down social media accounts by username.

angelburgosrosado Bundle

Supply chain investigation, evidence recovery, and forensic analysis for GitHub repositories. Covers deleted commit recovery, force-push detection, IOC extraction, multi-source evidence collection, hypothesis formation/validation, and structured forensic reporting. Inspired by RAPTOR's 1800+ line OSS Forensics system.

binfen1 Bundle

Python backend development expertise for FastAPI, security patterns, database operations, Upstash integrations, and code quality. Use when: (1) Building REST APIs with FastAPI, (2) Implementing JWT/OAuth2 authentication, (3) Setting up SQLAlchemy/async databases, (4) Integrating Redis/Upstash caching, (5) Refactoring AI-generated Python code (deslopification), (6) Designing API patterns, or (7) Optimizing backend performance.

binfen1 Bundle

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8). Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding". Proactively suggest after shipping a developer-facing feature. (gstack)

binfen1 Bundle

Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them. Iteratively fixes issues in source code, committing each fix atomically and re-verifying with before/after screenshots. For plan-mode design review (before implementation), use /plan-design-review. Use when asked to "audit the design", "visual QA", "check if it looks good", or "design polish". Proactively suggest when the user mentions visual inconsistencies or wants to polish the look of a live site. (gstack)

binfen1 Bundle

Interactive developer experience plan review. Explores developer personas, benchmarks against competitors, designs magical moments, and traces friction points before scoring. Three modes: DX EXPANSION (competitive advantage), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only). Use when asked to "DX review", "developer experience audit", "devex review", or "API design review". Proactively suggest when the user has a plan for developer-facing products (APIs, CLIs, SDKs, libraries, platforms, docs). (gstack)

first-fluke Bundle

SCM (software configuration management) and Git: branching, merges, conflicts, worktrees, baselines, audit readiness, plus Conventional Commits and safe staging.

first-fluke Bundle

Academic writing capability for publication-grade English prose. Drafts, revises, and audits essays, reports, analysis sections, executive summaries, conclusions, and literature reviews while enforcing sentence-structure variation, precise verb choice, calibrated hedging, and anti-AI stylistic compliance. USE for academic writing, essay polish, paragraph rewrite, prose revision against any rubric tier (HD/D/C, A/B/C, top-band/mid-band, etc.), anti-AI audit, reverse outlining, claim-evidence mapping, and rubric enforcement on assignments.

latestaiagents Skill

OWASP A02 - Broken Authentication Detection. Use this skill when reviewing login systems, session management, password handling, or authentication flows. Activate when: login, authentication, password, session, token, JWT, OAuth, credentials, sign in, logout, remember me, forgot password, password reset, MFA, 2FA.

latestaiagents Skill

Comprehensive API security for REST and GraphQL APIs. Use this skill when building or reviewing API endpoints, implementing authentication, or securing data transfer. Activate when: API security, REST security, GraphQL security, API authentication, API rate limiting, API versioning, secure endpoint, API design.

latestaiagents Skill

JSON Web Token security best practices. Use this skill when implementing JWT authentication, validating tokens, or reviewing JWT usage. Activate when: JWT, JSON Web Token, token authentication, bearer token, refresh token, token validation, JWT secret, token expiry.

latestaiagents Skill

OWASP A05 - Broken Access Control Detection. Use this skill when implementing authorization, checking permissions, or auditing who can access what resources. Activate when: authorization, permissions, access control, RBAC, ABAC, admin access, privilege escalation, IDOR, direct object reference, role check, can user access.

latestaiagents Skill

Find and prevent leaked secrets, API keys, and credentials in code. Use this skill when reviewing code for exposed secrets, setting up pre-commit hooks, or auditing repositories. Activate when: leaked secret, API key exposed, credentials in code, hardcoded password, secret scanning, git secrets, pre-commit hook.

mphinance Bundle

Meta-skill that forges, audits, and refines other skills. Three modes – forge a new skill from a brief, audit recent chat transcripts for new-skill candidates and pain points, or refine an existing skill with additive-only changes. Triggers on "skill-forge a thing that does X", "forge a skill", "skill-forge audit", "skill audit", "refine my skills", "skill-forge refine <name>", or "/skill-forge". Auto-opens a PR against mphinance/alpha-skills (never auto-merges).

mphinance Skill

ML-powered single-ticker analysis — Random Forest price-range prediction (5-day horizon) plus emoji-annotated technical insights for the Single Ticker Audit view. Use when Michael wants a price prediction, a read on one ticker's technicals, or to explain the audit view's prediction card and confidence.

ww-w-ai Skill

View audit logs, decision traces, and session history for AI transparency. ACTION_TYPES (19 entries) include PDCA events (phase_transition, gate_passed/failed, agent_spawned/completed/failed, rollback_executed, destructive_blocked) and Sprint events (sprint_paused, sprint_resumed, master_plan_created — v2.1.13). Triggers: audit, log, decision trace, history

ww-w-ai Skill

Manage PDCA checkpoints and rollback — create, list, restore for safe recovery. Rollback events are recorded via lib/audit/audit-logger ACTION_TYPES.rollback_executed. For sprint-level recovery, individual feature rollbacks may be triggered from within sprint phases (sprint itself is forward-only — terminal state is `archived`, not rolled back; v2.1.13). Triggers: rollback, checkpoint, restore, undo

az9713 Skill

Infringement triage across trademark, copyright, patent, and trade secret — a flag list with the factors cutting each way, not a finding. Use when assessing whether someone is infringing your IP or whether you might be infringing theirs, when a knockoff or copycat surfaces, or when deciding whether a matter is worth pursuing and how.

manusco Skill

<!-- Generated by Resonance Forge. -->

latestaiagents Skill

Systematic security code review methodology. Use this skill when reviewing pull requests for security issues, auditing critical code paths, or performing security assessments. Activate when: security review, code audit, secure code, review PR for security, find vulnerabilities, security assessment.

latestaiagents Skill

OWASP A09 - Using Components with Known Vulnerabilities. Use this skill when auditing dependencies, updating packages, or reviewing security advisories. Activate when: npm audit, dependency check, vulnerable package, CVE, security advisory, outdated packages, supply chain, package vulnerability, Dependabot, Snyk.

ravnhq Bundle

Generate, evaluate, audit, and normalize QA test cases to RAVN standards. Trigger on "generate/write/create test cases", "evaluate/score my test cases", "audit my test suite", "review test coverage", "normalize/reformat test cases", or when a user wants test design help. Also triggered by /testcases.

ravnhq Bundle

Adversarial QA tester that systematically tries to break an application's API. Tests security boundaries, input validation, race conditions, deduplication, and malformed requests. Reports bugs with full reproduction details. Trigger on "break the API", "chaos monkey", "adversarial testing", "security test the endpoints", "test edge cases", or when a test plan defines API endpoints.

ravnhq Bundle

Server-side architecture and security — API design, error handling, validation, logging. Use when building APIs, server logic, or reviewing backend security.

ravnhq Bundle

Audit a repository for type-system weaknesses using recent bug-fix commits as hard evidence. Produces prioritized findings tied to specific commits showing which types allowed real bugs. Use when: reviewing type safety, auditing types, analyzing type bugs. Triggers on: type audit, type system review, audit types, type safety audit.