القائمة
Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends an agent's capabilities with specialized knowledge, workflows, or tool integrations.
OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性
OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射
OpenClaw Skills 全方位安全审计工具，检测供应链投毒、Prompt注入、恶意代码模式、权限越权和依赖风险
Implements Manus-style file-based planning for complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when starting complex multi-step tasks, research projects, or any task requiring >5 tool calls. Now with automatic session recovery after /clear.
AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.
| name | pentest-supply-chain |
| description | Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification. |
Supply chain attacks (SolarWinds, Log4Shell, xz-utils) are the fastest-growing threat category. Shannon explicitly excludes "vulnerable third-party libraries." MITRE ATT&CK T1195 has zero coverage in any existing skill.
| Category | Tools | Purpose |
|---|---|---|
| Dependency Scanning | Snyk, npm audit, pip-audit | Known CVE detection |
| Container Scanning | Trivy, Grype | Image vulnerability analysis |
| Dependency Risk | socket.dev, Semgrep | Behavioral risk analysis |
| CI/CD Review | custom scripts, actionlint | Pipeline security audit |
| SBOM | syft, cyclonedx-cli | Bill of materials generation |
references/tools.md - Tool function signatures and parametersreferences/workflows.md - Attack pattern definitions and test vectors