Security

tomevault-io Bundle

Security anti-pattern for Regular Expression Denial of Service (CWE-1333). Use when generating or reviewing code that uses regex for input validation, parsing, or pattern matching. Detects catastrophic backtracking patterns with nested quantifiers. Use when this capability is needed.

vincentchuwaichow Bundle

Use this skill when reviewing exported RPA workflow definitions for resilience and security defects that cause unattended bots to fail silently in production. Trigger when a user provides UiPath XAML files, Automation Anywhere bot exports, Power Automate Desktop flow definitions, Blue Prism process XML, or project dependency manifests, or asks why an unattended bot crashes silently, double-processes transactions, or times out under load. This skill reviews workflow definitions statically; it never connects to a live orchestrator, never runs a bot, and never requests runner credentials or orchestrator URLs.

vincentchuwaichow Bundle

Contabo Security Hardening

vincentchuwaichow Bundle

Use this skill to statically review Python application code for high-severity security defects: unsafe deserialization (pickle, yaml.load), dynamic execution (eval/exec), subprocess and shell injection, SSRF, path traversal and unsafe archive extraction, secrets exposure, cryptography misuse, and fail-open exception handling. Reads source only; it never runs code, writes an exploit, or opens a live connection.

vincentchuwaichow Bundle

Cross-functional escalation protocol governing handoffs between SAP Security, HR, and Legal when identity misuse, privileged-access anomalies, SoD violations, insider-risk signals, HR-sensitive system access, joiner/mover/leaver lifecycle events, or fraud-sensitive access patterns require coordinated response. Defines decision rights, evidence standards, redaction policy, approval gates, and audit packaging. Never mutates live systems and never bypasses any guarded-mutating gate.

vincentchuwaichow Bundle

SAP Security IAM GRC and SoD Review

vincentchuwaichow Bundle

Review Scaleway IAM policies, API key governance, service account bindings, and organization/project-level permission sets for least-privilege posture. Use when the user asks to audit API key scopes, review IAM policy breadth, assess service account access, or tighten Scaleway identity controls. Surfaces overly broad access, missing expiry, and key sprawl risks with actionable remediation paths.

vincentchuwaichow Bundle

Use this skill when statically reviewing .NET test suites for false confidence — assertion-free and tautological tests, over-mocking, coverage theater, weak test isolation, flaky patterns, and missing negative or security tests across xUnit, NUnit, and MSTest. Trigger when a user provides .NET test source (test classes, fixtures, mock setups, coverage configuration), asks why their green test suite still ships bugs, or wants to know whether their tests actually verify the system instead of inflating a coverage number. This skill reads test source only; it never runs the test suite, a coverage tool, or a test container.

vincentchuwaichow Bundle

OCI Security Compliance Reviewer

vincentchuwaichow Bundle

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

vincentchuwaichow Bundle

Review Dynamics 365 Finance & Operations security role design, duty and privilege assignments, segregation of duties (SoD) conflict rules, user-role assignments, and audit evidence for least-privilege compliance. Enforces SoD conflict detection, security reports review, role layering analysis, and privileged access controls. Refuses to approve role changes that introduce SoD conflicts or bypass audit controls. Production role changes are live-guard gated and require escalation.

vincentchuwaichow Bundle

Use this skill to review PHP Composer dependency supply-chain posture — whether composer audit is wired into CI with a failing exit-code gate on security advisories, whether config.policy.advisories.audit and config.policy.abandoned settings are configured to actually surface risk, whether abandoned packages have a tracked replacement plan, and whether composer.lock is present, current, and pins dependencies at security-sensitive boundaries. Use when a vulnerable or abandoned Packagist dependency could reach production because the audit gate is missing or non-blocking, an abandoned package has no owner, or the lock file is absent, drifted, or bypassed by unpinned constraints. Static review only; it never installs packages, runs Composer commands, or contacts Packagist.

vincentchuwaichow Bundle

Use this skill to review PHP runtime upgrade readiness — whether the target or running PHP version is past php.net's published four-year support window (active support, then security-only, then EOL) — and to review production OPcache (enable, validate_timestamps, memory sizing) and PHP-FPM (pm, max_children, max_requests) hardening. Use when production PHP could be running an EOL or soon-security-only-EOL version, or when OPcache/FPM configuration could serve stale code or let a traffic spike exhaust workers. An EOL runtime is always a blocking finding. Static review only; it never installs, upgrades, or restarts a PHP runtime.

vincentchuwaichow Bundle

Change SAP BTP entitlements, quotas, and service plan subscriptions using a mandatory 17-step guarded mutation sequence covering classification, target global account and subaccount confirmation, criticality, requester, approver (platform-owner plus FinOps required), ticket, scope, read-only current state, diff of entitlement changes, blast radius (cost and dependent applications), rollback, post-change verification, and audit evidence. Refuses if any step is missing, if FinOps approval is absent for entitlement increases, or if a cost-impact assessment has not been produced. Use when a confirmed and approved BTP entitlement, quota, or subscription change must be executed under traceable controls.

openclaw-commons Skill

Security Hardening

openclaw-commons Skill

Cryptography Security

vincentchuwaichow Bundle

Java Maestro routing skill. Classify the user's Java/JVM task, select the narrowest static-review specialist from the Java board (or the smallest team, max 4), and dispatch. Trigger when a user brings a Java, JVM, Spring, Jakarta EE, JDK-upgrade, JPA/Hibernate, or Java-security task and it is not yet clear which specialist should handle it. Routes only — never answers Java questions itself, never runs code, never requests secrets.

vincentchuwaichow Bundle

Router skill for classifying Contabo tasks and delegating to the narrowest specialist for cost analysis, capacity planning, security hardening, VPS/VDS lifecycle operations, or Object Storage management. Use when the user asks a Contabo question that spans multiple domains or needs triage before specialist engagement.

vincentchuwaichow Bundle

Use this skill when statically reviewing a Spring Security 6 service's authorization and endpoint-exposure posture — multiple SecurityFilterChain beans and securityMatcher disjointness/ordering, authorizeHttpRequests matcher sequencing (first-match-wins, permitAll before authenticated, anyRequest() last), request-level vs @PreAuthorize/@PostAuthorize/@Secured method-security precedence, AuthorizationManager delegation and fail-closed behavior, CSRF on state-changing endpoints, and Spring Boot Actuator exposure (management.endpoints.web.exposure.include, EndpointRequest, securing /actuator). Trigger when a user provides Spring Security configuration (HttpSecurity/SecurityFilterChain beans, method-security annotations, actuator properties) or asks whether an endpoint or actuator surface is safely secured. Reads source and sanitized configuration only; it never builds, runs, or contacts a live system.

vincentchuwaichow Skill

Delegate exploration sweeps to Haiku subagents and bulk writing to Sonnet subagents while the orchestrator keeps architecture, security-sensitive edits, and commits; use at the start of any multi-step task in this repo to minimize token spend by delegating to cheaper models.

vincentchuwaichow Bundle

OCI WAF Security Review

vincentchuwaichow Bundle

Assign or revoke SAP role collections and authorizations using a mandatory 17-step guarded mutation sequence covering classification, target tenant/system confirmation, criticality, requester, approver, ticket, scope, read-only current state, SoD pre-check, diff of effective permissions, blast radius, rollback plan, approval gate, execute approved changes only, verify, audit, and report. Refuses if any step is missing, if an SoD conflict is detected, or if self-approval is attempted. Use when a confirmed and approved role assignment or revocation in a non-development SAP system must be executed under traceable controls.

vincentchuwaichow Bundle

Package and structure audit evidence for SAP controls covering Segregation of Duties, change management, access management, and financial controls. Defines evidence taxonomy, maps controls to evidence artifacts, establishes chain-of-custody and redaction requirements, and aligns evidence packages to SOC 2, ISO 27001, SOX, and GxP frameworks. Does not touch live systems and never includes secrets, credentials, or personal identifiable information in evidence packages.

vincentchuwaichow Bundle

Execute SAP transport request imports using a mandatory 17-step guarded mutation sequence covering classification, target confirmation, criticality, requester, approver, ticket, scope, read-only current state, diff and dry-run, blast radius, rollback plan, segregation of duties, approval gate, execute approved imports only, verify, audit, and report. Refuse if any step is missing. Use when a confirmed and approved transport import into a non-development SAP system (quality, pre-production, or production) must be executed under traceable controls.

vincentchuwaichow Bundle

OCI Live Network Security Rule Guard

vincentchuwaichow Bundle

Use this skill to review WordPress plugin, theme, REST API, and block-editor code for missing or overly permissive REST permission_callback registration, unescaped dynamic block render_callback output, missing input validation/sanitization or output escaping, and missing nonce/capability checks on state-changing requests. Use when reviewing register_rest_route() calls, dynamic block render_callback/render.php files, form/admin-ajax handlers, or any code path that takes untrusted input and produces WordPress-rendered output. Static review only; it does not execute plugin/theme code and never contacts a live, sandbox, or staging WordPress install.

vincentchuwaichow Bundle

Use this skill to statically review Kotlin coroutine and Flow reliability — structured concurrency and cancellation cooperation, dispatcher selection and blocking-call confinement, cold Flow vs hot StateFlow/SharedFlow semantics and backpressure, and context propagation (transaction, trace, MDC, security) across suspension and dispatcher switches. Reads source only; it never runs coroutine code or profiles live timing.

vincentchuwaichow Bundle

Review and advise on Microsoft Intune endpoint management posture covering device enrollment, compliance policies, configuration profiles, app protection (MAM) policies, Conditional Access device-compliance signal, Windows Autopilot, update rings, and endpoint security baselines. Applies Zero Trust device-health-as-signal principles. Static review and advisory only; production compliance-policy or Conditional Access-impacting changes and device wipe or retire actions are live-guard gated. Refuses to weaken device compliance or Conditional Access requirements for convenience.

vincentchuwaichow Bundle

Executes read-only SOQL queries against a connected Salesforce org via the sf data query CLI under T1 least-privilege scope (api + refresh_token only, Run As service account with no ModifyAllData/ViewAllData/ViewEncryptedData). Returns sanitized JSON with a structured audit envelope. Live operational counterpart to the static-review skills. TRIGGER when: user asks to query records, run SOQL, fetch live data, inspect records by ID, count records, run aggregate queries, or check field values in a live org. Trigger phrases: query my org, run SOQL, show me records where, how many opportunities, what is the value of field X on record Y. DO NOT TRIGGER when: user pastes a metadata XML export for static review (use salesforce-metadata-review-skill); request requires DML — write, update, delete — those are T3 prohibited; bulk data operations needed (use salesforce-bulk-data-ops-skill); only schema metadata needed without data (use salesforce-metadata-fetcher-skill).

mouadja02 Skill

SwiftUI performance audit: render, scroll, CPU/memory, view updates, layout, Instruments.

mouadja02 Skill

1Password CLI (op): service-account first, targeted secret read/store/inject, tmux session.

mouadja02 Bundle

Technology stack evaluation and comparison with TCO analysis, security assessment, and ecosystem health scoring

openclaw-commons Skill

Aqua Security

openclaw-commons Skill

Security Test

openclaw-commons Skill

Gosec Security

killvxk Bundle

在安全测试活动中，评估 JSON Web Token（JWT）实现中的密码学弱点、算法混淆攻击和授权绕过漏洞。