secrets-management
Prevent hardcoded secrets in source code. Covers .env setup, .gitignore patterns, secret scanning, runtime secret injection, and rotation strategies for…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-23 00:13
Security & auditing
7,322 results
webhook-security
Fix race conditions, add idempotency guards, and implement timing-safe token comparisons for payment webhooks. Covers Xendit, Stripe, Paddle, and generic…
code-audit-scripts
Run deterministic code security and quality scans — secret detection, debug artifact cleanup, and TODO/FIXME tracking. Use this skill before any security…
Security
Solidity vulnerabilities, defensive code patterns, and a pre-deployment audit checklist. Covers reentrancy, oracle manipulation, token decimals, SafeERC20,…
Smart Contract Audit
500+ item EVM smart contract audit system across 19 domains. Runs parallel specialist agents, synthesizes findings, and files GitHub issues. Separate from the…
neo-iso-27001
Use this skill when the user needs to establish, review, or improve an ISO/IEC 27001 ISMS, perform information security risk discovery, define scope, create an…
octocode-news
Researches what is new in AI, developer tools, web platform, security, and notable repositories. Use when the user asks for whats-new, latest updates, recent…
audit-code
Run a two-pass, multidisciplinary code audit led by a tie-breaker lead, combining security, performance, UX, DX, and edge-case analysis into one prioritized…
clawhub-skill-scanner
Security gatekeeper for skill installations. MANDATORY before installing any skill from ClawHub, GitHub, or external sources. Performs deep code analysis to…
flaw0
Security and vulnerability scanner for OpenClaw code, plugins, skills, and Node.js dependencies. Powered by OpenClaw AI models.
java-audit-skill
AI-driven Java code security audit skill, enabling systematic, high-coverage vulnerability discovery. Use cases: (1) Audit Java/Kotlin projects to find security vulnerabilities (0day discovery, code audit, security assessment) (2) Security audit of enterprise-level codebases (supports large projects) (3) Need high-quality, low-hallucination-rate security audit reports (4)…
security-audit
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10…
security-reviewer
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing,…
skill-auditor
Security scanner that catches malicious skills before they steal your data. Detects credential theft, prompt injection, and hidden backdoors. Works immediately…
skill-vetting
Vet ClawHub skills for security and utility before installation. Use when considering installing a ClawHub skill, evaluating third-party code, or assessing…
skills-security-check
Produced by Tencent Cloud Yunding Laboratory, a Skill security review tool. Conducts a comprehensive security audit of the user-specified skill.md file and its accompanying documents, programs, scripts, etc., to ensure references are safe
headless-ghidra-scope
Deprecated compatibility-only P0.5 alias: scope selection now belongs to P0 Intake.
bianco-pyramid-of-pain
Apply David Bianco's threat hunting frameworks including the Pyramid of Pain and Threat Hunting Maturity Model. Emphasizes prioritizing detection by adversary…
loom-security-audit
Comprehensive security audits identifying vulnerabilities, misconfigurations, and best-practice violations across applications, APIs, infrastructure, and data…
finding-discovery
Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository…
security-diff-scan
Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.
security-scan
Use when the user asks for a repository-wide or scoped-path security scan.
threat-model
Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create,…
app-privacy-disclosure-comparison
Compare public App Store privacy labels, Google Play data-safety declarations, and listed Android permissions through Crawlora. Use for an app shortlist or…