242 skills
Use when auditing or hardening a Supabase project's security posture. Triggers: scan/audit Supabase, RLS verification, find leaky tables, check anon grants, review SECURITY DEFINER functions, prep for the May 30 / Oct 30, 2026 Data API exposure changes, generate remediation SQL. Works against any S…
Our MCP Server connects AI workflows to current, curated cyber threat intelligence
Scan project dependencies for known vulnerabilities and CVEs
EVM Slither audit (zero-arg demo + live) + Blockscout source + security.txt lookup + MCP probe.
All-round bug bounty skill covering smart contract audits (EVM/Solidity, Move/Aptos, Solana, TRON), web/API security, and professional report generation for HackerOne, Bugcrowd, Intigriti, and Immunefi. Trigger on "audit", "bug bounty", "check for vulns", "find bugs", "write report", "security revi…
AI 驱动的生产级代码安全审计协议。面向企业内部授权审计，默认使用结构化 harness：项目画像、攻击面枚举、Sink/Control 双轨候选发现、验证队列、能力链、质量门、报告渲染和完整证据交付。支持 PHP、Java、C# / ASP.NET、Go、Python、JavaScript / TypeScript Node.js、Ruby、Rust、Kotlin、Deno/Bun，以及 JVM/.NET 编译产物反编译计划。用户说「开始审计 / 对 XXX 做安全审计 / 代码审计 / 安全扫描 / 找漏洞 / security audit / 红队审计」时触发。
Techniques and tools for testing application and infrastructure security including penetration testing, fuzzing, and vulnerability assessment
Traces data flow from entry points to dangerous operations. Cross-file reasoning to determine which entries can reach which dangers, and what validation exists in between. MUST run on Opus for reasoning depth. Use via /sast command.
Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerber…
Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.
Audits APM dependencies for supply-chain safety — apm audit flags, the content-hash / cache-integrity / unicode-scan / drift-detection model, and audit as a CI gate. Use when verifying installed primitives are untampered, wiring audit into CI, stripping hidden characters, or checking for drift befo…
Dependency health scanner covering vulnerabilities, license compliance, outdated packages, and upgrade planning. Use when auditing dependencies, checking licenses, planning upgrades, or assessing supply chain risk.
Systematically audit Solidity smart contract codebases for security vulnerabilities using a 4-phase approach - load a vulnerability cheatsheet, sweep code with grep and semantic analysis, deep-validate candidates against reference files, and output a severity-ranked findings
Runs Semgrep security scans on the current project to detect vulnerabilities, secrets leakage, and OWASP Top 10 issues. Use when the user asks for security scanning, vulnerability detection, code auditing, secrets checking, or says things like 安全扫描, 代码扫描, 扫漏洞, 安全检查, 漏洞检测, 扫一下安全.
Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive configuration files, credentials, and source code.
AI-powered application security testing — scan APIs, discover endpoints, and find vulnerabilities.
An MCP server that provides DevOps and DevSecOps context for the project
Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing GitHub configuration, checking CI/CD or A…
Supply-chain security audit — Composer + npm dependency CVE check, license compatibility (GPL-compatible only), abandoned package detection, typosquatting risk, lockfile integrity, post-install / preinstall scripts that smell like supply-chain attacks. Use when the user says "supply chain audit", "…
Live threat intel for Claude — CVE, KEV predictions, IP lookup, malware hashes. Free, no API key.
Dependency management, version conflict resolution, security patch updates, and supply chain hygiene across npm, pip, Maven, Cargo, and Go modules. Use when asked to update dependencies, resolve a version conflict, audit for vulnerabilities, set up Dependabot or Renovate, fix a broken lock file, or…
Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.
Detect Insecure Direct Object Reference (IDOR) vulnerabilities in a codebase using a three-phase approach: recon (find candidates), batched verify (check authorization in parallel subagents, 3 candidates each), and merge (consolidate batch results). Checks endpoints for missing ownership or authori…
Multi-scanner security gate. TRIGGER when: user mentions installing, adding, or reviewing a skill to Claude Code, OpenClaw, or any other AI agent. Detects malicious code, vulnerabilities, and suspicious patterns.
Manage shared Engineering OS conventions, patterns, security policies, and team knowledge synchronization.
Guidelines for assisting with authorized security testing, defensive security, CTF challenges, and educational contexts while censoring requests for malicious activities
Tauri Capabilities 深度配置技能，指导高级权限管理、作用域控制和多窗口权限差异化。 触发场景： - 需要精确控制 API 访问权限 - 需要限制文件访问作用域 - 需要为不同窗口配置不同权限 - 需要自定义 Capability 权限组 触发词：Capabilities、权限配置、作用域、scope、精细权限、安全配置
Red-team security audit for code changes. Use automatically when working on authentication, authorization, user inputs, API endpoints, database queries, or any security-sensitive code. Also use before commits that touch sensitive areas.
AI-augmented binary vulnerability analysis with 38 MCP tools for taint tracing and zero-day hunting
Ybe Check – security and compliance orchestrator for AI-generated repositories.