database-security
Authorized database security assessment across PostgreSQL, MySQL, MSSQL, MongoDB, and Redis: exposure, authorization gaps, UDF/command execution paths, and…
Skills
Find an Agent Skill for your task. Read the guide and copy the install command.
Updated 10-24 00:15
Security & auditing
7,384 results
security-digest
Generate a security digest summarizing events across UniFi Protect cameras, Access door events, and Network firewall activity. Use when asked about what…
security-documentation
Master security documentation with security policies, incident response plans, security procedures, and compliance documentation.
threat-modeling
Master threat modeling with STRIDE, attack trees, risk assessment, and identifying security threats in systems and applications.
api-credentials-hygiene
Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability). Use when integrating services or preparing…
security-audit
Comprehensive security auditing for Clawdbot deployments. Scans for exposed credentials, open ports, weak configs, and vulnerabilities. Auto-fix mode included.
auth-http-api-cloudbase
Use when you need to implement CloudBase Auth v2 over raw HTTP endpoints (login/signup, tokens, user operations) from backends or scripts that are not using…
hsts
Use when reviewing HTTP response headers on any site that serves content over HTTPS.
indexability
Use when auditing a site for accidental noindex directives, investigating why important pages are not appearing in Google Search, or reviewing CMS settings…
privacy-policy
Use when reviewing whether a website has a visible, accessible privacy policy link, particularly in the footer navigation.
device-integrity
Protects apps and APIs with DeviceCheck and App Attest. Use for per-device fraud state, App Attest key generation and attestation, request assertions, server…
swift-security
Builds or reviews Apple-platform security with Keychain, LocalAuthentication, CryptoKit, Secure Enclave, certificate pinning, key sharing, and secure…
create-threat-model
Analyze a codebase and produce a structured threat model at .turbo/threat-model.md covering assets, trust boundaries, attack surfaces with existing…
security-hardening
Security best practices for Shopify Apps. Covers OWASP Top 10, authentication, data protection, webhook verification, and secure coding patterns for Remix…
hr-security
Help HR managers, recruiters, and talent acquisition teams understand Cybersecurity, Application Security, Cloud Security, Security Operations, Penetration…
recon-solar-installers
Sector-specific recon for solar panel installer and renewable energy company websites.
organization-management
Implement Clerk multi-tenant organization features with RBAC, role-based access control, organization switching, member management, and tenant isolation. Use…
authentication-and-authorization-fullstack
Implement end-to-end authentication and authorization across frontend and backend with secure session design, token lifecycle controls, and role or permission…
secure-key-manager
Enterprise-grade secure key management for AI agents. Encrypts API keys using AES-256-GCM with PBKDF2HMAC key derivation (480k rounds). Features runtime…
security-drill
Automated security drill and attack simulation tester for AI agents. Runs scheduled attack scenarios (prompt injection, social engineering, command bypass) to…
skill-security-audit
Automated security audit and compliance checker for OpenClaw/Hermes skills. Scans SKILL.md files, scripts, and configurations for vulnerabilities,…
security
Reviews code for security vulnerabilities, identifies security issues, suggests improvements
find-crypto-entry
Locate the generation entry point of parameters in JS. Use when the user asks "where is the xxx parameter generated", "find the encryption entry point", "locate the signature function", "how are the request parameters encrypted"
js-reverse-automation
Connect to a real browser via chrome-devtools-mcp, trace the generation chain of sign/enc/token, identify runtime entry functions and dependencies, then generate JSRPC injection code, Flask proxy code, and a Burp autoDecoder integration document with verification output. This skill only generates the corresponding code and will not test unauthorized targets.