Security

sitaggart Bundle

Refresh stale .ai/solutions learnings against current code. Use for "refresh my learnings", audit stale learnings, or consolidate overlapping docs.

allanninal Skill

Comprehensive code review following Sentry guidelines and OWASP best practices. Use when reviewing PRs, checking code quality, or performing security reviews.

allanninal Bundle

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

dolsoon Bundle

Comprehensive API security for REST, GraphQL, and gRPC services with OAuth 2.1 authentication, JWT validation, rate limiting, and enterprise protection patterns.

dolsoon Bundle

Enterprise Skill for advanced development

kesslerio Bundle

Triage, redact, clean up, and resolve OpenClaw GitHub Secret Scanning alerts in issues or PRs.

sitaggart Bundle

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".

willoscar Bundle

Audit-style editing pass for `output/DRAFT.md`: remove template boilerplate, improve coherence, and enforce citation anchoring.

jasoncolapietro Bundle

Suede Labs workflow for turning a website, PWA, dashboard, or marketplace into an iOS app. Use when the user has a live site or web app and asks to put it on the App Store, wrap it in an app, ship an iOS version, or convert a PWA to native — covers URL audit, shell-vs-native strategy, App Store 4.2 wrapper risk, native value requirements, screenshots, metadata, privacy answers, and the release gate. NOT FOR: building a native iOS app with no existing site (private Suede Labs companion, not in this pack: ios-swiftui-product); repairing or releasing an existing Capacitor shell (private Suede Labs companion, not in this pack: ios-capacitor-shell); Android conversions (use android-app-factory); live listing and keyword audits on a shipped app (use suede-aso).

kagenti Bundle

CVE awareness — scan dependencies and code for vulnerabilities, audit docs for CVE leaks, plan responsible disclosure, block public leaks

kagenti Skill

Enhance any repository with CI, tests, skills, and security through phased PRs - self-replicating

wpank Bundle

Meta-skill that orchestrates a comprehensive security review by coordinating auth, input validation, secrets management, API security, and infrastructure hardening skills. Use before releases, after auth changes, during audits, or when adding new API endpoints.

wpank Bundle

Structured logging, distributed tracing, and metrics collection patterns for building observable systems. Use when implementing logging infrastructure, setting up distributed tracing with OpenTelemetry, designing metrics collection (RED/USE methods), configuring alerting and dashboards, or reviewing observability practices. Covers structured JSON logging, context propagation, trace sampling, Prometheus/Grafana stack, alert design, and PII/secret scrubbing.

taewook486 Skill

Run dependency security audit using pip-audit. Use when checking for known vulnerabilities in project dependencies.

taewook486 Skill

Check code quality without making changes — lint, format, type, and security checks. Use when you want to inspect issues before fixing them.

taewook486 Skill

Auto-fix lint and formatting issues in Python code using ruff. Use when you want to apply automatic code fixes. Does not fix type errors or security issues.

jasoncolapietro Bundle

Suede Labs skill that finds and organizes the rights gaps in a creator project before packaging: ownership, contributors, splits, samples, licenses, provenance, metadata, licensing readiness, and royalty-routing readiness, each marked confirmed or unknown against an evidence trail. Use when a song, release, or creative project needs a rights check before registry, licensing, sync, or payout discussion; when splits, sample clearance, or chain of title are unclear; or when someone asks whether they have the rights to release, license, or get paid for a work. Organizes evidence only: clears no rights, confirms no ownership, moves no money, writes to no registry. NOT FOR: building the transfer package itself (use suede-rights-passport); linting a release folder's files and metadata (use suede-release-linter); a sync one-sheet or pitch (use suede-sync-packaging).

jasoncolapietro Bundle

Suede Labs skill that lints a local music or media release folder and scores it for release readiness: missing files, weak or malformed metadata, artwork and stem problems, split gaps, rights blockers, and platform-delivery issues, produced by a bundled offline script as a scored markdown and JSON report. Use when a creator has one or more release folders of tracks, artwork, and stems and wants to know what is missing before distributing, delivering, or handing it off; when metadata quality or a delivery rejection is the question; or when a release-readiness score is asked for. Reports what is present, missing, or unknown; never upgrades unknown to confirmed and never means legal clearance. NOT FOR: organizing the evidence behind a rights or split gap the report surfaces (use suede-rights-audit); building the transfer package (use suede-rights-passport); a sync one-sheet (use suede-sync-packaging).

jasoncolapietro Bundle

Suede-owned recovery discipline for recurring charges billed outside Amazon: App Store, Google Play, PayPal, direct-bill streaming, gyms, news, and SaaS. Use when the user wants to find, audit, cancel, or dispute a subscription they may have forgotten, is being charged for twice, or no longer uses. Every cancellation and dispute requires the user to name the service first. Never enters payment credentials and never promises a refund. Requires Claude in Chrome for browser actions. NOT FOR: Amazon returns, restocking fees, or Amazon-billed Prime Video Channels, Audible, Kindle Unlimited, or Prime (use amazon-returns-recovery); merchant-side dunning and cancel-flow design (use suede-churn-prevention).

jasoncolapietro Bundle

Suede Labs skill that turns messy creator materials into a local, offline rights-and-provenance transfer package: inventoried and hashed assets, a normalized suede-intake.json manifest, credits and splits, license notes, provenance, and a missing-information report, validated by a bundled stdlib script. Use when a creator needs to hand a song, release, or project to a collaborator, advisor, registry, marketplace, or label; when someone asks for a rights package, intake package, or handoff folder; or when a validated manifest is needed before licensing or royalty-routing review. Carries questions, not answers: building the package clears nothing and uploads nothing. NOT FOR: finding or investigating the rights gaps in the first place (use suede-rights-audit); linting a release folder's files and metadata (use suede-release-linter); a sync one-sheet (use suede-sync-packaging).

bradtaylorsf Skill

Conduct comprehensive pull request reviews with security, architecture, and quality checks. Use when user wants to review a PR.

bradtaylorsf Skill

Security vulnerability scanning and OWASP Top 10 compliance checking. Use when reviewing code for security issues, validating authentication/authorization, or ensuring security best practices.

brite-nites Bundle

Audits and auto-fixes a project's CLAUDE.md against Anthropic best practices. Activates during ship phase — checks conciseness, enforces @import structure for detailed docs, auto-excludes bloat, identifies hook candidates, and auto-fixes structural issues. Flags content questions for developer review.

bradtaylorsf Skill

Secure IPC patterns, credential storage, and API key management for Electron apps

openshift-eng Skill

Patch a Go dependency to fix a CVE using the appropriate strategy based on Go version compatibility. Use when the user wants to fix a CVE by updating a Go module, replacing it with a patched fork, or applying a security patch across all go.mod files in a Go project. Triggers on: 'patch CVE', 'fix CVE', 'replace grpc', 'update vulnerable dependency', 'security patch go module', or any mention of CVE + Go dependency replacement.

openshift-eng Bundle

Analyze and compare disruption across one or more Prow CI job runs by examining interval data, audit logs, pod logs, and CPU metrics

chatandbuild Bundle

Use this skill when checking token security before swaps or trades, including honeypot risk, scam indicators, malicious contract functions, dangerous ownership settings, unusual taxes, and supported-chain audit data.

chatandbuild Bundle

Use this skill when designing or reviewing Infrastructure as Code for reliability, security, drift control, modularity, environment promotion, and operational maintainability.

sawrus Skill

Design and implement REST APIs with consistent conventions, versioning, error contracts, and security.

sawrus Skill

Detect secrets in code, git history, and running containers — pre-commit hooks, CI scanning, and incident response for exposed credentials.

sawrus Skill

Apply STRIDE threat modeling to system designs, identify IDOR and authorization vulnerabilities, and build threat matrices for security reviews. Use when the user designs a new system, reviews an architecture, prepares for a security audit, or asks about common API vulnerabilities like IDOR or broken access control.

simplefarmer69 Skill

Guides users through auditing certification study with step-by-step checklists, Q&A explanations, and CISA domain mapping. Use when the user mentions auditing, certification, CISA, exam prep, or asks for audit process steps.

simplefarmer69 Skill

Search, evaluate security, and install OpenClaw skills. Helps your human find the right skills safely.

chatandbuild Bundle

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

chatandbuild Bundle

Use this skill when building or reviewing browser extensions that need extension-specific guidance for runtime boundaries, permissions, content scripts, background scripts, messaging, storage, security, or distribution.

simplefarmer69 Skill

Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase.