القائمة
Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends an agent's capabilities with specialized knowledge, workflows, or tool integrations.
OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性
OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射
OpenClaw Skills 全方位安全审计工具，检测供应链投毒、Prompt注入、恶意代码模式、权限越权和依赖风险
Implements Manus-style file-based planning for complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when starting complex multi-step tasks, research projects, or any task requiring >5 tool calls. Now with automatic session recovery after /clear.
AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.
| name | pentest-config-hardening |
| description | Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification. |
Shannon checks only 2 of 14 WSTG-CONF items. The remaining 12 are "low-hanging fruit" findings expected in every professional pentest report — straightforward to test systematically.
| WSTG ID | Test Name | Status |
|---|---|---|
| WSTG-CONF-02 | Test Application Platform Configuration | ✅ |
| WSTG-CONF-03 | Test File Extensions Handling | ✅ |
| WSTG-CONF-04 | Review Old Backup and Unreferenced Files | ✅ |
| WSTG-CONF-05 | Enumerate Infrastructure and Admin Interfaces | ✅ |
| WSTG-CONF-06 | Test HTTP Methods | ✅ |
| WSTG-CONF-07 | Test HTTP Strict Transport Security | ✅ |
| WSTG-CONF-08 | Test RIA Cross Domain Policy | ✅ |
| WSTG-CONF-09 | Test File Permission | ✅ |
| WSTG-CONF-11 | Test Cloud Storage | ✅ |
| WSTG-CONF-12 | Test Content Security Policy | ✅ |
| WSTG-CONF-13 | Test for Subdomain Takeover | ✅ |
| WSTG-CONF-14 | Test Security Headers | ✅ |
| Category | Tools | Purpose |
|---|---|---|
| TLS Testing | testssl.sh, nmap ssl-enum-ciphers | Protocol and cipher analysis |
| Header Audit | SecurityHeaders.com API, Mozilla Observatory | Security header grading |
| Method Testing | curl, nmap http-methods | HTTP method enumeration |
| CSP Analysis | CSP Evaluator, custom scripts | CSP bypass assessment |
| Cloud Storage | S3Scanner, cloud_enum | Public bucket detection |
| Subdomain | subjack, can-i-take-over-xyz | Subdomain takeover detection |
references/tools.md - Tool function signatures and parametersreferences/workflows.md - Attack pattern definitions and test vectors