Security

zebbern Skill

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.

gabrielmoreira Bundle

Use for authorized OSINT and cyber threat intelligence that enriches IOCs, campaigns, impersonation, scams, or threat actors from public sources. Includes bounded X/Twitter search through Xquik, source preservation, corroboration, and evidence handoff.

herdrdev Bundle

Audit herdr release readiness by comparing commits since the base release against next-release changelog and docs. Use when asked to run or apply the repo's pre-release audit, validate docs/next before release, inspect issue refs that release CI will close, or finalize release docs for herdr.

gabrielmoreira Skill

Fix a team's chat sprawl — the channel map with one purpose per channel, the naming scheme that makes purpose findable, the archive pass for the dead and duplicated, and the posting norms (threads, @-discipline, urgency signals) that keep signal findable. Use when asked clean up our Slack/Teams, we have 90 channels and nothing is findable, set channel norms, or where should things get posted. Produces the channel audit and map, the naming scheme, the norms card, and the archive pass.

gabrielmoreira Skill

Strips AI writing patterns from text and rewrites it to sound genuinely human — removing the statistical defaults, then adding earned voice calibrated to genre (opinion pieces get a person's voice; docs and summaries stay neutral) without ever faking humanity. Use when a draft reads as AI-generated, over-polished, or rhythmically uniform — including blog posts, emails, LinkedIn posts, or any prose that needs to sound like a real person wrote it. Produces a pattern audit, side-by-side comparison, itemised change log, and clean rewritten output ready to paste.

npc-live Skill

Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this token safe?", "check token security", "audit token", or before any swap.

posthog Skill

Use when adding or editing a GitHub Actions workflow, composite action, or reusable workflow under `.github/` — new CI jobs, triggers, matrices, checkout/clone tuning, action pinning, GitHub App token auth, concurrency groups, `timeout-minutes`, `paths` filters, caching, or runner choice. Covers PostHog's workflow-authoring conventions and the reasons behind them: the 500-runs/10s dispatch cap, shallow vs full clone, per-SHA push concurrency, dedicated App-token rate-limit buckets, and fork-safe secrets on a public repo. Points to the linters (`bin/hogli lint:workflows`, actionlint) that enforce the mechanical rules, and to the narrower skills for production deploys, secrets, and Depot runners. Not for debugging red CI (use debugging-ci-failures) or wiring a new secret end to end (use managing-github-actions-secrets).

ryo-ebata Skill

Rust coding best practices for cc-audit development. Use when writing new Rust code, reviewing code, or refactoring. Covers error handling, safety, performance, and idiomatic patterns.

suyoumo Skill

PR readiness dashboard — tracks which reviews have been completed per branch and gates merge decisions. Shows code review, tests, security, QA, and linting status.

thedivergentai Bundle

Godot Expert Analyst: Anara. Visionary project scoring and certification for Godot 4.7+ architecture. Use when evaluating project health, modernity, scalability, dependency graphs, or generating Visionary Certificates. Keywords: analyst, Anara, scoring, certification, architecture audit, ResourceLoader.get_dependencies, typed Dictionary, folder-by-feature, Visionary Certificate, Godot 4.7.

useai-pro Skill

Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.

xuzhougeng Bundle

Audit scientific figures for duplicated, reused, transformed, or uninformative image panels. Use for 图片查重, 论文图像重复, PDF figure 审核, when the user attaches a PDF, asks to review selected PDF pages, or tags a directory containing manuscript input images. For PDFs, extract large embedded figure images before splitting them into panels; for directories, preserve originals and split every composite image directly. Produces a reviewed panel manifest, all-pairs candidate table, visual evidence, coverage accounting, and a cautious integrity report.

chaitanyagiri Skill

Read-only code quality audit — scan the current working directory for common issues (bugs, dead code, security hotspots, missing error handling) and return a prioritised findings report. No files are edited. Use when asked to "audit the code", "quick audit", "find issues", "code scan", or "what's wrong with this codebase". (munder-difflin)

electron Skill

End-to-end Chrome security backport for an Electron release branch. Given a Chrome Releases blog URL and a branch (e.g. 41-x-y), determines which CVE fixes are missing from the *actual synced source*, writes the cherry-pick patches locally, validates them with `e sync --3` + `lint --patches`, then pushes a single PR. Use when asked to backport a Chrome security release to N-x-y, "is CVE-X already in N-x-y?", or to produce/validate the cherry-pick set for a release branch.

elementalsouls Skill

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

ghostsecurity Skill

Scans directory structure, detects projects, maps dependencies, and documents code organization into a repo.md file. Use when the user needs a codebase overview, project structure map, or repository context before security analysis.

home-assistant Skill

Audits the review comment threads on a Home Assistant GitHub pull request, flagging unaddressed comments and requests for clarification. Use when checking whether PR feedback has been handled, either standalone or as part of a full PR review.

minhnv0807 Skill

Dung khi da co winner va muon tang quy mo ma khong lam hong — 7 dieu kien du de scale, tang doc +20-30% moi lan, mo rong ngang bang tep va kenh moi, va rui ro reset learning phase. Kich hoat khi user nhac 'scale ads', 'tang budget', 'nhan doi ngan sach', 'ads dang tot muon day manh', 'horizontal scaling', 'tang chi tieu'. Quy tac cung: khong tang budget khi CPL dang xau. Khong dung cho — CPL dang xau thi chay skill 21-audit-ads-performance truoc; nhan tep warm thi dung skill 56-retargeting-plan.

gabrielmoreira Skill

Surface the hidden assumptions a plan or belief rests on, then test what happens when each one is wrong. Use when asked what am I assuming here, check my assumptions, what if I'm wrong about, or stress-test my thinking. Produces the unstated assumptions your conclusion depends on (ranked by how load-bearing they are), a flip of each to see which one breaking would change everything, and the cheapest way to check the riskiest ones — because the assumption you didn't know you were making is what sinks plans.

gabrielmoreira Skill

Keep citations honest in business documents — every load-bearing claim sourced, links that actually contain the claim, the as-of dates that keep numbers honest, and the internal-vs-external sourcing rules for decks and memos. Use when asked check the sourcing in this deck, add citations to this doc, our slide says 'studies show' — which studies, or set citation norms for the team. Produces the claim-by-claim audit, the fixes (source found, claim softened, or cut), the citation format for the venue, and the team norm card.

gabrielmoreira Skill

Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, check license compliance, assess dependency health, or produce a vulnerability report. Produces a vulnerability findings table, license compliance matrix, update priority matrix, dependency health score, and 30-day remediation plan.

nvidia Bundle

Run one NemoClaw daytime maintainer pass. Prioritize items for the release version. Select a merge, salvage, security, test, conflict, or sequencing workflow and report progress. Use during the workday to land PRs and close issues. Designed for /loop, for example /loop 10m /nemoclaw-maintainer-day. Trigger keywords - maintainer day, work on PRs, land PRs, make progress, what's next, keep going, maintainer loop.

ryo-ebata Skill

A complex but safe skill for project scaffolding

seanj1ang Bundle

Evaluate one design or a user-approved maturity-mapped batch through a transparent evidence-based rubric. Classify each work, score design quality and presentation, identify Critical risks, report evidence confidence, and optionally shortlist works within separate maturity tracks. Use when a user asks to judge, score, critique, review, diagnose, batch-evaluate, or rank designs by evidence-aligned evaluation score. Do not use this skill to retrieve winners, choose an award, produce a redesign, audit submission-file compliance, simulate an official jury, or predict winning probability.

gabrielmoreira Skill

Repurpose existing content into a native LinkedIn post. Take a tweet, thread, YouTube video, blog, or newsletter and rebuild it for LinkedIn: re-hook before the fold, expand to the 900 to 1300 char sweet spot, add whitespace and a CTA, move links to the first comment, run the humanizer, publish via Publora on approval. Not for writing from scratch (use linkedin-post-writer), not for auditing a draft (use linkedin-humanizer --mode audit).

zebbern Skill

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.

dazuck Skill

Scan files for sensitive content before sharing. Detects personal info, credentials, private URLs, local paths, and security risks. Use before publishing repos, sharing code, or exporting configs.

different-ai Skill

Publish test evidence, publish all test runs, update PR verification, audit red evidence, prove a PR, or declare a PR verdict. Use after @openwork/testkit runs.

fugazi Bundle

A guided interview to challenge and validate QA automation plans, test strategies, and framework designs before implementation. Use when the user wants to validate a test architecture, challenge a testing decision, prepare an AI-assisted testing rollout, or uses any "grill" trigger phrase (grill my test plan, audit my QA automation framework, challenge my QA strategy, review my test architecture).

jabrena Bundle

Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml; Configure Maven quality plugins in pom.xml; Add Maven build lifecycle plugins for Java verification; Review Maven plugin versions and executions. Part of Plinth Toolkit

jabrena Bundle

Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding; Find input validation risks in Java code; Review Java code for injection vulnerabilities; Improve secure error handling in Java services; Harden Java code against common security flaws. Part of Plinth Toolkit

luongnv89 Skill

Comprehensive code review with security, performance, and quality analysis. Use when users ask to review code, analyze code quality, evaluate pull requests, or mention code review, security analysis, or performance optimization.

microsoft Skill

OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks.

gabrielmoreira Bundle

Simulate the acquirer's diligence team hunting for reasons to cut your price — their internal red-flags memo with a price-chip estimate per finding. Use when asked to red-team my company before a sale, how will an acquirer attack our valuation, pre-diligence audit, or what will DD find. Produces the acquirer's internal memo (revenue quality, key-person, tech debt, concentration, legal) and a debrief on which flags are fixable before a process.

gabrielmoreira Skill

Audit the beneficiary designations that quietly override wills — the account-by-account sweep, the life-event triggers that make them stale, and the coordination check against actual intentions. Use when asked check my beneficiaries, does my 401k go to my ex, do beneficiary forms beat a will, or what should I update after marriage/divorce/a birth. Produces the account sweep list, the stale-designation red flags, the intent-vs-paperwork comparison table, and the update checklist with the verify-in-writing step.

gabrielmoreira Skill

Design slides where the data makes the argument — the takeaway-titled chart, the one-chart-per-slide rule, the annotation layer that guides the eye to the point, and the honesty pass on projected data. Use when asked make this data slide land, my chart slide confuses people, how do I present these numbers, or the audience missed the point of my graph. Produces the redesigned slide: takeaway title, the chart stripped and annotated, the eye-path check, and the honesty audit.