repository-dependency-reviewer
Use this agent inside a source repository when the user wants a read-only dependency risk review based on local manifests. It inspects dependency…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-22 00:14
Security & auditing
7,315 results
vulnerability-explainer
Use this agent when the user asks what a specific vulnerability means and how to reason about it. Examples: "Explain CVE-2021-44228", "What does CVE-2021-45046…
commit-security-scan
Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns. Use for PR reviews, pre-commit checks, or branch comparisons.
vulnerability-validation
Validate security findings from commit-security-scan by assessing exploitability, filtering false positives, and generating proof-of-concept exploits. Use…
file-upload
This skill should be used when the user asks to "check file upload security", "analyze upload validation", "find upload vulnerabilities", "check for zip slip",…
oracle-confidentiality
Enforce confidentiality across Oracle deliverables — pre-delivery audits, codename enforcement, and content sanitization. Use before any Oracle client handoff,…
codereview-scan
Use OCR scan when the user wants to audit a legacy repository, a specified directory, or complete files without a suitable Git diff; first determine the scope, model, and budget, report coverage and omissions, and do not pass off a full-file scan as a pre-commit review.
linux-platform-security
Analyze Linux, SteamOS, Steam Deck, Wine, or Proton game-security boundaries. Use for ELF/process evidence, privileges, namespaces, seccomp, LSMs,…
security-by-design
Strategic principles for integrating security from the start, not retrofitting it later
iblai-api-agent-audit
Read an ibl.ai agent's audit log via the platform API — a who-changed-what trail filterable by action, actor email, and date range. Read-only. Use when…
iblai-api-agent-privacy
Configure an ibl.ai agent's Privacy Router via the platform API — enable PII detection, choose redact/mask/block action, select entity types (PERSON,…
iblai-api-token
Manage an organization's Platform API Tokens via the platform API — list, create (secret shown once), and delete Api-Tokens by name. Use when issuing or…
insecure-temp-files-anti-pattern
Security anti-pattern for insecure temporary files (CWE-377). Use when generating or reviewing code that creates temporary files, handles file caching, or…
noir
Run OWASP Noir for attack surface analysis and API endpoint discovery. Use when mapping API endpoints, finding shadow APIs, discovering hidden routes, or…
code-analyzer
Audit an entire project for bugs, security vulnerabilities, code quality problems, performance issues, missing tests, documentation gaps, and concrete…
security-review
Run a security review of code changes exactly like Claude Code's /security-review command — but in ANY AI coding agent (Claude Code, Cursor, Codex, Windsurf,…
openclaw-threat-detect
OpenClaw attack pattern detection tool that identifies high-risk behaviors such as data exfiltration, reverse shells, file leakage, prompt injection, and supply chain poisoning, with MITRE ATT&CK mapping support
skill-security-auditor
Comprehensive security audit tool for OpenClaw Skills, detecting supply chain poisoning, prompt injection, malicious code patterns, privilege escalation, and dependency risks
audit-payment-system
Read-only audit of payment and money-movement code, scoped from Stripe Checkout to in-house ledgers. Use when "audit payment system", "double charge /…
audit-resilience
Read-only production-resilience audit: timeouts, bounded retries, circuit breakers, idempotency, rate limits, graceful degradation, PII in logs. Use when…
credential-setup
Standardize credential handling for an ESP32 project (credentials.h.example, .gitignore, pre-commit protection)
security-patterns
Invoke when code-developer or quality-reviewer handles PHP security concerns. Provides input validation patterns, SQL injection prevention, XSS protection,…
threat-modeling
Threat modeling methodologies (STRIDE, DREAD), attack trees, threat modeling as code, and integration with SDLC for proactive security design
better-auth
Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password…