Security

Guides Stripe integration decisions: API selection, Connect platform setup, billing, Treasury, and security best practices for building or reviewing Stripe integrations.

Provides a pre-deployment security checklist for OAuth-connected apps and external client apps, covering configuration, token policies, access control, and compliance.

Provides German data protection compliance guidance covering DSGVO, BDSG, and TDDDG, including legal bases, retention periods, cookie rules, and standard wording templates.

Provides French data protection compliance guidance covering RGPD, Loi Informatique et Libertés, and LCEN, including retention periods, cookie rules, and standard wording templates.

Guides data protection impact assessments under GDPR Article 35, covering mandatory triggers, risk evaluation, and mitigation steps.

Enforces GDPR-compliant deployment practices for Google Cloud Run, including Frankfurt region verification, PII-safe logging, data anonymization, retention policies, and CSP configuration.

Manage Bitwarden vaults, items, folders, collections, organizations, and Sends through the bw CLI, including authentication, password generation, and import/export.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Refreshes the local OWASP Cheat Sheet Series cache for the current project's language, checking GitHub for updates and fetching changed sheets.

Manages environment variables and secrets in Claude Code sessions without exposing values, using Varlock for validation, masking, and secure command execution.

Covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Storage, and Hosting, with patterns for security rules, data modeling, and real-time listeners.

Manage environment variables securely by validating schemas, masking sensitive values, and preventing secret exposure in logs or agent context.

Federal Organizational Conflict of Interest (OCI) sweeper backed by FAR Subpart 9.5 (9.501-9.508) and the active Theseus workspace knowledge graph. USE WHEN the user asks about OCI risk on a bid, organizational conflicts, incumbent conflicts, biased ground rules, unequal access to information, impaired objectivity, or any pre-bid OCI due diligence. Pulls `company`, `incumbent`, `subcontractor`, `customer`, `program_office`, and prior-contract relationships from the workspace KG, classifies each potential conflict into one of the three FAR 9.505 classes (biased ground rules, unequal access, impaired objectivity), and emits a structured findings envelope with mitigation recommendations (firewall, NDA, recusal, novation). DO NOT USE FOR FAR clause coverage audit (use `compliance-auditor`), proposal prose (use `proposal-generator`), competitor research (use `competitive-intel`), or pricing (use `price-to-win`).

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Federal Other Transaction (OT) prototype bid strategist for 10 USC 4021 research and 10 USC 4022 prototype/4022(f) production-follow-on agreements. USE WHEN the user asks to "build an OT bid", "respond to this OT solicitation", "estimate should-cost for an OT prototype", "is this milestone price reasonable", "compare 4022(d) cost-share paths", "team with an NDC to avoid 1/3 cost share", "OT price-to-win", or "TRL milestone phasing" — any milestone-based prototype scoping, OT cost stack, or 4022(d) cost-share strategy question. Reconstructs the AO's TRL phasing from the active workspace KG, picks the 4022(d) path that minimizes our exposure, builds a per-milestone cost stack from BLS OEWS + GSA CALC+ + GSA Per Diem, and emits a JSON envelope handed to `proposal-generator`. DO NOT USE FOR FAR-based contracts (`price-to-win`/`proposal-generator`), incumbent research (`competitive-intel`), FAR clause audit (`compliance-auditor`), or prime-to-sub SOW drafting (`subcontractor-sow-builder`).

Audit project structure for convention violations, missing files, template drift, and cross-platform sync gaps; optionally auto-fix

Audit codebase for opportunities to reduce lines of code while preserving functionality, performance, and quality

Audit and implement behavior-preserving cleanup across types, dead code, dependencies, errors, and comments

Use only for developer-facing products; audit docs for quickstart clarity, examples, API reference, troubleshooting, and migration paths

Audit GDPR compliance, generate privacy policies, and document data flows. Use when auditing practices, drafting policies, or checking consent flows.

支持通过AI生成符合公众号规范的图文（文章和贴图），并推送到公众号草稿箱，兼容其它SKILL生成的图文、图片进行推送。通过配置向导扫码授权，支持多账号。无需泄露公众号Secret密钥，无需配置公众号IP白名单。

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

AI security and safety specialist for guardrails and adversarial resilience. Use when the user asks to talk to Snape, requests a safety audit, or needs guardrails design.

用于用户提交论文、学位论文或参考文献清单后，系统审查参考文献真实性、题录准确性、文内—文后对应关系以及正文主张是否得到被引文献支持，并生成专业、清晰、可直接指导修改的论文引用审计报告与飞书文档。用户要求“论文审计”“参考文献检查”“引用核对”“引用是否支持观点”“检查错引、过度推断或二手转引”时使用。开放主题综述、普通论文精读、论文代写或仅做语言润色时不使用。

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Use when planning an NDSS submission calendar — choosing between the summer and fall cycles, backward-planning from the AoE deadline through early-reject, rebuttal, notification, camera-ready, and the Seoul symposium, and placing NDSS honestly inside the security big-four retargeting year.

Initializes bug bounty hunt workspaces, logs vulnerability findings with severity and evidence, and enriches them throughout a session.

Provides a complete deep-dive into Cross-Site Scripting (XSS) with exact payloads and bypass techniques for every PortSwigger lab variant, from apprentice to expert level.

Detect and exploit XML External Entity (XXE) injection vulnerabilities in XML parsers, including file disclosure, SSRF, and blind out-of-band exfiltration.

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Routes security testing tasks to the correct vulnerability category, guiding recon, validation, privilege escalation, and chain building for web application and API security assessments.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Generate a NullPointer Studio styled PDF penetration test report from findings.json, producing a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards, and remediation summary.

Routes API security testing into recon, authorization, token abuse, or hidden-parameter workflows based on observed endpoint characteristics.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.