Menu
Skills in this repository
SkillsMP has collected 2,449 skills from aibot88/sec_skill_store. Open a skill to review its source and details.
aibot88/sec_skill_storeShowing 40 of 2,449 collected skills.
Performs advanced SAST (Static Application Security Testing) and compliance analysis on Pull Request diffs. Identifies real security vulnerabilities, secrets, and regulatory compliance violations (GDPR, HIPAA, SOC2, PCI-DSS) by analyzing only changed code.…
Walk a security team member through allocating a CVE for an <tracker> tracking issue. Prints the ASF Vulnogram allocation URL and a CVE-ready title (the issue title stripped of redundant `<vendor>: <product>:` (e.g. `Apache Airflow:`), `[ Security Report ]`,…
Audit de sécurité des dépendances — détection de vulnérabilités connues, mises à jour critiques et gestion du cycle de vie des packages. À utiliser quand l'utilisateur veut vérifier la sécurité de ses dépendances, mettre à jour des packages vulnérables ou…
Source text: French
SEOcrawler security vulnerability scanner and hardening specialist for comprehensive security audits.
Sempre considera vetores OWASP top-10 ao escrever/revisar código
Source text: Portuguese
Adversarial defense layer for the mortgage plugin — protects against prompt injection, system prompt extraction, PII leakage, workflow bypass, and social engineering attacks.
Sécurisation d'agents IA contre injections, abus et fuites de données. Se déclenche avec "sécurité agent", "agent security", "prompt injection", "jailbreak", "agent abuse", "guardrails", "safe agent", "sécuriser mon agent", "agent en production sécurisé".
Source text: French
Plan de réponse aux incidents de sécurité — préparation, détection, containment, éradication, recovery et lessons learned. Se déclenche avec "incident response", "plan de réponse", "breach", "compromission", "réponse à incident", "CSIRT".
Source text: French
Merge two <tracker> tracking issues that describe the same root-cause vulnerability (typically discovered independently by two reporters, arriving via different channels), preserving every reporter's credit, every mailing-list thread reference, and every…
Attempt to fix a security issue tracked in <tracker> by implementing the change in a public <upstream> PR. Runs the security-issue-sync skill first to reconcile the issue's state, then analyses the discussion to decide whether the issue is easily fixable…
Open one or more `<tracker>` tracking issues from a markdown file containing a batch of security findings (typically the output of an AI security review or a third-party scanner). Each finding in the file becomes one tracker, landing in the `Needs triage`…
Open a tracking issue in <tracker> for a security-relevant fix that has already been opened (or merged) as a public PR in <upstream>, in the case where there is no inbound `<security-list>` report. The tracker lands in the `Assessed` board column (the…
Scan <security-list> for reports that have not yet been copied into <tracker> as tracking issues, present the proposed imports to the user, and — defaulting to *import unless the user rejects upfront* — create the tracking issues with the `Needs triage`…
Close an `<tracker>` tracking issue as invalid: apply the `invalid` label, remove the scope label, post a short closing comment, archive the item from the project board, and — for trackers imported from `<security-list>` — draft a polite-but-firm reply to the…
Synchronize a security issue in <tracker> with the state of its GitHub discussion, the <security-list> mailing thread, and any <upstream> PRs that fix it. The skill gathers all relevant signals, proposes label, milestone, assignee, field and draft-email…
For each open `<tracker>` issue carrying the `needs triage` label, read body + comments and classify the candidate disposition into one of five classes: VALID / DEFENSE-IN-DEPTH / INFO-ONLY / INVALID / PROBABLE-DUP. On user confirmation, posts a…
Plans security penetration tests for web applications. Analyzes codebase, API routes, auth implementation, and infrastructure config to generate comprehensive pentest plans. For authorized testing only.
Automated PII detection and redaction for client data protection. Scans outputs, logs, artifacts, and communications for sensitive data before external exposure. Derived from ruflo agent-security-manager + @claude-flow/aidefence patterns. Use when: generating…
Security anti-patterns — localStorage token storage (XSS risk), trusting client-side authorization checks, reflecting full error details to clients, blacklist vs whitelist input validation, using npm install instead of npm ci in CI pipelines.
Security-focused code review that emits a numeric composite score (0.0–1.0) suitable for the evolve-loop Builder self-review convergence loop
Security patterns for Web3 and blockchain applications — Solana wallet signature verification, transaction validation, smart contract interaction security, and checklist for DeFi/NFT features.
Automatisation d'audits de sécurité incluant scanning, reporting, intégration CI/CD et remediation tracking. Se déclenche avec "audit automatisé", "security scanning", "SAST", "DAST", "Trivy", "Snyk", "audit CI/CD"
Source text: French
Guide pour analyste SOC — triage d'alertes, investigation, SIEM, indicateurs de compromission et playbooks de réponse. Se déclenche avec "SOC", "analyste SOC", "SIEM", "IoC", "incident de sécurité", "triage sécurité".
Source text: French
Run composable security analysis across binaries, prompts, traces, and policies.
Analyze codebase architecture to generate a STRIDE-based threat model with data flow diagrams, trust boundaries, prioritized threats, and mitigations. Compatible with Microsoft Threat Modeling Tool concepts. Use when asked to "threat model", "security…
Modélisation des menaces pour applications et systèmes — identification des surfaces d'attaque, classification STRIDE, arbres d'attaque et stratégies de mitigation. À utiliser quand l'utilisateur veut sécuriser une architecture, identifier des vulnérabilités…
Source text: French
نظام إدارة واكتشاف ومعالجة الثغرات الأمنية. استخدم هذا الـ skill عند: فحص الثغرات، إدارة نقاط الضعف، اختبار الاختراق، تقييم المخاطر الأمنية، OWASP compliance، إدارة الأحداث الأمنية (SIEM)، استجابة الحوادث، تحديثات أمنية، مسح الشبكة، أو أي مهمة تتعلق بالأمن…
Source text: Arabic
Architecture Zero Trust — never trust always verify, micro-segmentation réseau, approche identity-centric et accès conditionnel. Se déclenche avec "Zero Trust", "zero trust architecture", "never trust", "micro-segmentation", "BeyondCorp".
Source text: French
Audit HTTP security headers for any URL and receive a grade (A+ to F) with specific recommendations for missing headers
Auditoria de segurança para skills do OpenClaw. Verifica código malicioso, prompt injection, APIs perigosas e práticas inseguras. Protege contra ClawHavoc e outros ataques.
Source text: Portuguese
Continuous self-improvement loop — AuthorClaw learns from mistakes, successes, and user feedback to get better over time
Facilitator for a student doing Agents 102 Bootstrap alone — no in-person trainer. Invoke on first session to set up the working directory and orient the student; invoke subsequent sessions with "continue" to pick up where they left off. Runs as the Teacher…
Access the Semantic Scholar Graph API to search papers and retrieve paper/author/citation data when you need literature discovery or citation graph exploration.
Use when designing or auditing icon systems, colors/badges/shapes, visual metaphors, interface signs, or naming-plus-visual surfaces that users misread. Covers semiotic reasoning across icon/index/symbol, signifier/signified, denotation/connotation/myth,…
Use when the user wants to send an SMS or WhatsApp marketing message via Twilio or Brevo, with compliance checks, consent verification, and delivery tracking.
Static security analysis agent. Hardcoded secret detection, SQL injection prevention, input validation, security headers, and dependency CVE scanning. Don't use for runtime exploit verification (Probe), general code review (Judge), CI/CD management (Gear), or…
SEO, AEO (Answer Engine Optimization), and GEO strategy for search engines and AI visibility. Use when working on "SEO audit," "technical SEO," "on-page SEO," "AI search optimization," "AEO," "GEO," "AI visibility," "optimize for ChatGPT," "optimize for…
Audit content gaps and decay using Ahrefs MCP data: missing topics, thin coverage, outdated content, and decaying pages. Use this skill when planning a content roadmap, refreshing a stale catalog, building topical authority, or identifying which existing…
Plan and execute off-page SEO including link building, digital PR, brand mentions, citation building, and external authority signals. Use this skill whenever the user wants to build backlinks, plan a digital PR campaign, list local citations, run guest post…
Use when designing or reviewing Server Actions: the 'use server' directive contract, how a server-side function becomes invokable from the browser without an API route, form integration via the `action` attribute, the React 19 hooks useActionState /…