Security

dasblueyeddevil Skill

Use when coordinating Claude Code CLI planning with Codex CLI implementation and dual adversarial audit.

sigmalabs-ai Bundle

Session continuity and context management for OpenClaw agents. Handles cold start recovery, context monitoring, structured wraps, and session handoffs. On first run: extracts the buffer-optimizer audit skill. No external dependencies.

hkall Bundle

Security guard for OpenClaw users. Audit configs, scan secrets, manage access, and generate security reports.

eonik-ai Bundle

Identifies creative fatigue, budget leaks, and scaling opportunities by running the eonik creative audit engine.

ttttstc Bundle

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns. Provides risk assessment and safety recommendations.

alessiovep Bundle

Security audit en vulnerability scan skill (SAST/SCA). Voert geautomatiseerde security checks en code reviews uit op codebases. Scant broncode, configuraties en dependencies op kwetsbaarheden met Semgrep, Trivy en Gitleaks. Categoriseert findings per OWASP Top 10 met genormaliseerde severity levels. Gebruik bij security scans, PR reviews, of compliance checks.

lfnovo Bundle

Orchestrate an Open Notebook release — changelog audit, risk-based A/B/C test matrix, Docker image gate (fresh + upgrade), fix loop via PRs, cut, publication with credits, retro. Use when preparing, testing, cutting or publishing a release.

getsentry Skill

Analyze and propose fixes for Dependabot security alerts

deeqyaqub1-cmd Bundle

Runtime security monitor for OpenClaw skills. Watches what your installed skills actually DO — network calls, file access, credential reads, process activity. Not a scanner. A watchdog.

aporthq Skill

Check APort guardrail status — passport validity, evaluation mode, and recent audit log entries. Works for all frameworks.

apollographql Skill

Review a GitHub pull request for a Rust codebase. Focuses on security, performance, test coverage, and Rust idioms. Runs in GitHub Actions and posts comments directly to the PR.

arun-mosai Skill

Expand a one-line feature description into a complete production-quality vertical slice — all 11 filled docs (persona, journey, UI, API, DB, security, observability, AI, seed, tests, index) plus migrations, seed TypeScript, Gherkin features, and OpenAPI fragment. Use when the user invokes /slice <description>, or says "build a full slice", "create a vertical slice", or wants a shippable persona→journey→UI→backend→DB→tests bundle from one sentence.

uxuiprinciples Skill

Audit AI-powered interfaces against the uxuiprinciples Part V taxonomy — 44 principles covering transparency, trust calibration, human override, consent, agentic workflows, and conversational design. Returns structured findings with severity and remediation. API key optional — enriched output requires uxuiprinciples.com API Access.

microsoft Bundle

Audit a vcpkg port locally. Reads the port metadata and build recipe, installs the port, inspects extracted sources and installed files, and produces a report covering license risks, vendored code, optional dependencies, and other port review suggestions.

megaeth-labs Skill

Evaluates documentation readability, structure, and compliance with docs/spec/AGENTS.md conventions. Use when reviewing doc quality, auditing formatting compliance, checking a page before publishing, or running a readability audit across the specification.

bengweeks Skill

Expert pull request reviewer. Use when asked to review a PR, examine code changes, validate modifications, or provide feedback on proposed changes. Applies best practices for code review including security, quality, and documentation checks.

rfxlamia Bundle

Toolkit for creating and validating skills and subagents. Use when: creating a new skill (fast or full mode), validating an existing skill, deciding Skills vs Subagents, migrating docs to skills, estimating token cost, or running a security scan. Triggers: "create skill", "build skill", "validate skill", "new subagent", "skills vs subagents", "estimate tokens", "security scan".

jcdoll Skill

Reviews code for quality, security, and maintainability. Use after implementing features, completing significant work, or when user asks for code review.

cyberstrategyinstitute Skill

Enforce AI SAFE² v3.0 sovereign governance constraints for every session. Apply this skill automatically at session start and before any tool execution that involves file writes, network access, shell commands, or subagent spawning. Covers identity lock, hard security limits, context isolation, tool authorization, memory governance, and human-in-the-loop controls.

224-industries Bundle

Webflow Enterprise API endpoints for workspace management, audit logs, site activity, 301 redirects, robots.txt, and well-known files. Use when working with Enterprise-only Webflow API endpoints that require an Enterprise workspace.

tuanductran Bundle

NextDNS Web UI configuration and management best practices. This skill should be used when configuring NextDNS profiles via the web interface (my.nextdns.io), including security features, privacy lists, parental controls, and monitoring logs.

mikr13 Bundle

Configure automatic security updates on Ubuntu/Debian VPS servers to patch vulnerabilities and prevent exploitation of known security flaws.

autohandai Skill

Staff-engineer-level code review delivering 10 prioritized actionable findings across architecture, security, performance, and maintainability

gl0bal01 Bundle

Rapid static assessment, classification, and prioritization of malware samples. Use for the first look at any unknown file — hashes, file type, packing, imports, strings, initial IOCs, threat level, and the decision on which deep-analysis phase comes next. Claude runs the static tooling on the host itself; the sample is never executed.

gl0bal01 Skill

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.

gl0bal01 Bundle

Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.

factory-ai-skills Skill

Scan code changes for security vulnerabilities using STRIDE threat modeling, validate findings for exploitability, and output structured results for downstream patch generation. Supports PR review, scheduled scans, and full repository audits.

extremeclarity Skill

Checks whether a set of options is well-constructed.

arize-ai-openinference Skill

Review Java OpenInference instrumentation code for correctness and completeness. Use this skill when reviewing a Java instrumentor package — whether it's a new instrumentor, a PR that modifies one, or when the user asks to audit/review/check an existing instrumentor's code quality. Trigger on phrases like "review the instrumentor", "check the Java code", "audit the package", "is this instrumentor correct", or any request to validate an OpenInference Java instrumentation package against project standards.

arize-ai-openinference Skill

Review Python OpenInference instrumentation code for correctness and completeness. Use this skill when reviewing a Python instrumentor package — whether it's a new instrumentor, a PR that modifies one, or when the user asks to audit/review/check an existing instrumentor's code quality. Trigger on phrases like "review the instrumentor", "check the code", "audit the package", "is this instrumentor correct", or any request to validate an OpenInference Python instrumentation package against project standards.

blackbearhq Skill

Scans staged or committed changes for leaked secrets (Stripe keys, .env files, API tokens, private keys). Auto-invoke before commit, before PR creation, or when user mentions secret, leak, credential, or API key.

blackbearhq Skill

Enforces Stripe integration best practices for webhook handling, idempotency, signature verification, and test vs live mode safety. Auto-invoke on any file touching Stripe webhooks, subscriptions, payments, checkout, or when user mentions Stripe, webhooks, webhook secret, idempotency, or subscription lifecycle.

rubencr14 Skill

Production-ready Python backend development with FastAPI. Use this skill whenever the user is building a backend API, structuring a Python service, designing domain layers, creating repositories, setting up dependency injection, writing Dockerfiles, configuring CI pipelines, implementing tests, or making any architectural decision about a Python backend. Covers light DDD, SOLID principles, FastAPI patterns, Pydantic validation, structured logging, container security, and testing strategy. Every feature must include its corresponding tests.

azat-io Bundle

Evaluate technical options with evidence and choose an approach. Use when requirements are fuzzy, multiple technical approaches exist, or change affects architecture, API, data, or security

noahjenkins Skill

Automate Dependabot PR merging safely, align branch protection to current CI jobs, and remediate stored-XSS output sinks. Use when asked to set up Dependabot auto-merge, harden branch protection for CI, or fix output-encoding vulnerabilities in URL composition, templated script output (e.g. JSON-LD), or RSS/XML interpolation. Works with any GitHub-hosted repository.

pluginagentmarketplace Bundle

Retrofit, OkHttp, REST APIs, JSON serialization, network security.