Security

pjt222 Skill

Prepare an organisation for regulatory inspection by assessing readiness against agency-specific focus areas (FDA, EMA, MHRA). Covers warning letter and 483 theme analysis, mock inspection protocols, document bundle preparation, inspection logistics, and response template creation. Use when a regulatory inspection has been announced or is anticipated, when a periodic self-assessment is due, when new systems have been implemented since the last inspection, or after a significant audit finding that may attract regulatory attention.

pjt222 Skill

Review software architecture for coupling, cohesion, SOLID principles, API design, scalability, and technical debt. Covers system-level evaluation, architecture decision record review, and improvement recommendations. Use when evaluating a proposed architecture before implementation, assessing an existing system for scalability or security, reviewing ADRs, performing a technical debt assessment, or evaluating readiness for significant scale-up.

pjt222 Skill

Write IQ/OQ/PQ validation documentation for computerized systems in regulated environments. Covers protocols, reports, test scripts, deviation handling, and approval workflows. Use when validating R or other software for regulated use, preparing for a regulatory audit, documenting qualification of computing environments, or creating and updating validation protocols and reports for new or re-qualified systems.

pjt222 Skill

Write a GxP-compliant Standard Operating Procedure (SOP). Covers regulatory SOP template structure (purpose, scope, definitions, responsibilities, procedure, references, revision history), approval workflow design, periodic review scheduling, and operational procedures for system use. Use when a new validated system requires operational procedures, when existing informal procedures need formalisation, when an audit finding cites missing procedures, when a change control triggers SOP updates, or when periodic review identifies outdated procedural content.

leoyeai-openclaw-master-skills Bundle

飞书群聊安全隔离 Skill，提供主人身份三重保障、技能安装确认、权限分级、防注入攻击、敏感路径保护等完整安全机制，保护机器人在群聊环境中的安全。

aplaceforallmystuff Skill

Detect and fix AI-generated writing patterns (slop). Comprehensive detection with 50+ patterns across 3 severity tiers, structure weighted above lexical tells, scoring system, and editor mode that directly fixes problems. Use when scanning any content for AI tells, auditing drafts before publishing, checking if writing "sounds like AI", humanizing AI-generated text, or verifying content authenticity. Trigger on "check for slop", "does this sound like AI", "humanize this", "AI audit", "slop check", "clean up AI writing", or any request to detect/remove artificial-sounding patterns. Also use proactively before publishing any AI-assisted content.

leoyeai-openclaw-master-skills Bundle

Static ReDoS (Regular Expression Denial of Service) vulnerability scanner and regex quality auditor for codebases. Walks all source files to extract regex literals, detects catastrophic backtracking patterns (nested quantifiers, overlapping alternation, unbounded repetition on complex groups), severity-ranks each finding as CRITICAL/HIGH/MEDIUM, reports file and line number with the dangerous sub-pattern highlighted, identifies high-risk call sites (HTTP request handlers, form validators, URL parsers), and suggests safe rewrites using atomic groups or simplified alternatives. Also detects hardcoded locale assumptions (character classes assuming ASCII), overly permissive patterns, and regexes missing anchors. Supports JS/TS, Python, Go, Java, Ruby, PHP, Rust. Zero external API — pure static analysis. Triggers on "regex security", "ReDoS", "catastrophic backtracking", "regex audit", "slow regex", "regex vulnerability", "/regex-audit".

cleydson Bundle

Comprehensive Flutter development patterns covering widgets, testing, performance, security, and animations. Use when you need quick reference for Flutter best practices, common UI patterns, performance optimization techniques, security guidelines, or animation implementations.

leoyeai-openclaw-master-skills Bundle

Opinionated AI code reviewer — not a yes-machine. 6-layer deep review (logic, edge cases, performance, security, maintainability, architecture) with Devil's Advocate mode and standardized MUST FIX / SHOULD FIX / SUGGESTION output. Supports GitHub PR URL, local diff, commit hash. Languages: TypeScript/JavaScript, Python, Go, Rust. (中文) 有立场的智能代码审查：6 层审查维度、主动反对机制、标准化输出，支持 5 种语言。

thrashr888 Skill

Execute commands in isolated sandboxes for security. Use when running untrusted code, system commands, or operations that could affect the host system. Automatically detects the right runtime (Python, Node, Rust, Go, Ruby, etc.) from the command.

leoyeai-openclaw-master-skills Bundle

Audit and rewrite content to remove AI writing patterns ("AI-isms"). Use this skill when asked to "remove AI-isms," "clean up AI writing," "edit writing for AI patterns," "audit writing for AI tells," or "make this sound less like AI."

leoyeai-openclaw-master-skills Bundle

Dropbox Business API integration with managed OAuth. Manage team members, groups, team folders, devices, and audit logs for Dropbox Business teams. Use this skill when users want to administer Dropbox Business teams, manage members, create groups, handle team folders, or access audit logs. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key.

leoyeai-openclaw-master-skills Bundle

Audit and build entity presence across Google Knowledge Graph, Wikidata, and AI systems for brand recognition and AI citations. Use when the user asks to "optimize entity presence", "build knowledge graph", "improve knowledge panel", "entity audit", "establish brand entity", "Google doesn't know my brand", "no knowledge panel", "establish my brand as an entity". For structured data implementation, see schema-markup-generator. For content-level AI optimization, see geo-content-optimizer.

autosecdev Bundle

perform first-pass security checks for openclaw deployments by registering the client, checking whether the installed clawscan package is outdated, checking whether the current openclaw version matches known vulnerable versions, checking whether installed skills match known malicious hashes, and checking whether openclaw or related services are listening on 0.0.0.0 or other non-local interfaces. use this skill when a user asks to assess whether openclaw is safe, run a clawscan check, verify openclaw version risk, verify skills hashes, or review listening ports and exposure risk.

colinhacks Bundle

Investigate a GitHub issue or pull request in colinhacks/zod and write up a durable verdict. Use whenever asked to triage, investigate, review, evaluate, or form an opinion on an issue or PR (by number, URL, or "the open PR queue"), and when sweeping many of them in bulk. For a draft SECURITY ADVISORY (a GHSA id, the Security tab, a private vulnerability report) use the `security-advisory` skill instead — it shares this file's conventions but its workflow lands the fix before drafting any comment. Covers where write-ups live on disk (.triage/issues/NNNN/, .triage/prs/NNNN/), the cheap-disqualifier pass that avoids spinning up a worktree for stale PRs, the worktree checkout procedure for PRs, the results.md format that keeps a 250-PR sweep greppable and resumable, how to report back in chat — the final message is all the user sees, so it leads with a code block showing the problem and a short outline of the fix — and the maintainer-voice comment it drafts whenever the verdict is to close.

undeadlist Skill

Run all 11 audit agents in parallel, then consolidate findings with fix-planner

8dionysus Bundle

Turn one stable technical truth into bounded evidence through contract, coverage-audit, or property mode. Use to define a named consumer seam, audit what existing checks really constrain, or express a broad invariant after manual cases establish meaning. Compose with aoa-eval when an evaluation surface must first be found or applied. Do not use for undefined behavior, generic test plans, or green checks as whole-system proof.

vultuk Bundle

Perform comprehensive code audits on repositories or directories. Use when asked to audit code, review a codebase, analyze code quality, find bugs, check for security issues, review architecture, check SOLID/DRY compliance, or generate a code audit report. Produces well-formatted markdown reports with prioritized recommendations.

rsdouglas Bundle

Secure API proxy that stores credentials encrypted and injects auth server-side. Use when: (1) making any external API call — "call the Stripe API", "enrich my data [from PeopleDataLabs]", "create an image [using Nano Banana API]", "use a [RapidAPI service]", (2) the user shares an API key, token, or secret — "here's my API key", "I have a token for..." — store it in Janee instead of handling it directly, (3) you see API keys in env vars, .env files, or config files — offer to migrate them into Janee, (4) you're about to put a key in a curl command or Authorization header — use execute() instead. Do NOT use for: general coding questions, local file operations, or tasks that don't involve external API calls.

dbt-labs Bundle

Use when annotating fs adapter implementations with upstream dbt-adapters Python reference links. Triggers whenever you need to add or audit GitHub permalink comments in adapter_impl.rs, trace an fs adapter method back to its Python origin in dbt-adapters, or when working on adapter divergence and want to know where a method came from. Also use when asked to "annotate references", "add upstream links", or "link adapter methods".

critesjosh Bundle

Aztec smart contract development, Noir programming, testing, deployment, and TypeScript integration. Use when working with Aztec contracts, notes, private state, or any Aztec SDK code. Use review-contract for security reviews.

critesjosh Skill

Review Aztec smart contracts for correctness, security, and best practices. Use proactively after writing or modifying Aztec contracts.

dimonier Bundle

First Principles Framework core patterns. Use when doing engineering, research, management, or mixed human/AI work. ALWAYS use as governing patterns for any DPF or LPF work. Load individual patterns from references/ as needed — never read the full spec unless doing deep audit.

kousen Skill

Identify security vulnerabilities and suggest secure coding practices

robansuini Bundle

Read, search, export, create, update, monitor, query, inspect, batch-edit, and explicitly archive Notion pages and databases. Use when the user requests Notion content or database operations and a host secret manager can supply NOTION_API_KEY.

openai Skill

Audit openai-go during scheduled or repeated maintainer runs for correctness bugs, security weaknesses, performance problems, rough edges, non-idiomatic Go, test gaps, code organization, and architecture, then report one prioritized recommendation with evidence. Use for recurring proactive repository maintenance and rotating whole-codebase review; do not use for feature work, code changes, autonomous publishing, or pull-request stewardship.

openai Bundle

Exhaustively review committed openai-go pull requests, branches, and commit ranges, or provide best-effort review of uncommitted local changes, for Go correctness, SDK compatibility, generated-code ownership, provider security, and repository-specific gotchas.

macaugh Skill

Methodical approach to finding security vulnerabilities through source code review and static analysis

rivalsee Skill

Audit and optimize a website's AI search visibility using BotSee analysis data. Use when the user wants to: (1) check how visible their brand is across AI search engines (ChatGPT, Claude, Perplexity, Gemini), (2) find keyword and terminology gaps between what AI engines search for and what their site says, (3) make landing page copy changes to improve AI visibility, or (4) run a full AI visibility audit on any domain. Triggered by requests like "audit my AI visibility", "check how AI sees my site", "optimize my landing page for AI search", or "run an AI visibility audit on <site>".

sunt23310-ops Skill

Run OpenClaw security audit — check gateway, credentials, channels, tools, network, and system security

justin-delano Skill

Periodic beads graph health checks and maintenance procedures.

tomas-u Bundle

Expert security architect providing comprehensive security guidance, architecture assessments, threat modeling, and compliance verification. Follows OWASP, NIS2, ISO 27001, NIST, and industry best practices. Use for security architecture design and review, threat modeling, security strategy, compliance assessment (OWASP, NIS2, GDPR, PCI DSS, SOC 2), infrastructure security, API security patterns, and incident response planning. For code-level security reviews, use the code-review skill.

tomas-u Bundle

Comprehensive code review for pull requests and commits. Reviews code against associated stories/tasks, checks naming conventions, linting, clean code practices, readability, maintainability, and security vulnerabilities (OWASP). Provides constructive feedback with explanations. Use when reviewing code, analyzing PRs, checking commits, or validating implementations against requirements.

datahub-project-datahub-skills Bundle

Use this skill when the user wants to search the DataHub catalog, discover entities, answer ad-hoc questions about their data, find datasets, or browse by platform or domain. Triggers on: "search DataHub", "find datasets", "who owns X", "what tables contain PII", "what columns does X have", or any request to search, discover, browse, or answer one-off questions about DataHub metadata. For lineage questions ("what feeds into X"), use `/datahub-lineage`. For systematic audits ("how complete is our metadata"), use `/datahub-audit`.

vultisig Bundle

MPC wallet CLI for secure multi-chain crypto operations across 36+ blockchains. Use when the user wants to create MPC wallets, send crypto, swap tokens cross-chain, check balances, sign transactions, or manage multi-signature vaults. Supports Bitcoin, Ethereum, Solana, and 33+ other chains with threshold signing security.

vultisig Bundle

TypeScript SDK for MPC wallet integration across 36+ blockchains. Create wallets, import from seedphrase, sign transactions, execute swaps, scan for security threats, and more. Supports Bitcoin, Ethereum, Solana, and 33+ other chains with threshold signing security.