Skill rating

Security audit and threat model for OpenClaw gateway hosts. Use to verify OpenClaw configuration, exposure, skills/plugins, filesystem hygiene, and to produce an OK/VULNERABLE report with evidence and

Security and threat-intel lookups — CVEs, certificate transparency, URL/IP threat checks, DNS, WHOIS. Use this skill when: 1. Looking up a CVE (NVD, MITRE CVE, Shodan CVEDB) 2. Certificate transparenc

Audit an iOS app repo (Swift/Xcode or React Native/Expo) for App Store compliance and release readiness; output a pass/warn/fail report and publish checklist.

Authentication and authorization patterns — JWT, OAuth 2.0, sessions, RBAC/ABAC, password security, MFA, and vulnerability prevention. Use when implementing login flows, protecting routes, managing to

TRIGGER THIS when researching market salaries, building compensation strategies, creating salary bands, analyzing pay equity, conducting salary reviews, preparing compensation proposals, or ensuring c

ACTIVATE when preparing for board meetings, creating board decks, drafting board materials, developing executive summaries for directors, writing talking points, crafting board agendas, addressing gov

Prepare structured briefings for meetings with legal relevance and track resulting action items. Use when preparing for contract negotiations, board meetings, compliance reviews, or any meeting where

Chinese ad copywriter with API-powered compliance check (中文广告文案生成+广告法违禁词API检测). Generate marketing copy for 小红书/抖音/微信公众号/百度/淘宝 and auto-check for 违禁词 via real API backend. Features: (1) API-powered ba

Use when building email features, emails going to spam, high bounce rates, setting up SPF/DKIM/DMARC authentication, implementing email capture, ensuring compliance (CAN-SPAM, GDPR, CASL), handling we

Scan HTML and JSX for accessibility issues with AI-powered fix suggestions

別駭我！基本安全檢測 — Security self-check for Clawdbot/Moltbot. Run a quick audit of your clawdbot.json to catch dangerous misconfigurations — exposed gateway, missing auth, open DM policy, weak tokens, loose

Search corporate registries across multiple jurisdictions via L402 API. Find companies by name and jurisdiction for due diligence, compliance, and business research.

Instantly check if a file, URL, domain, or IP is malicious using VirusTotal. Paste any MD5/SHA1/SHA256 hash, URL, domain name, or IP address into the chat and get a full threat report — detection rat

Dependency audit, vulnerability scanning, and license compliance. Free vuln check + paid continuous monitoring via git hooks.

Build payment integrations, subscription management, and invoicing systems with webhook handling, tax compliance, and revenue recognition.

Takes screenshots of targets using Playwright and performs visual/contextual analysis for potential vulnerabilities.

Build payment-routing diagnostics, route matrices, retry and failover policies, rollout guardrails, and merchant-friendly planning briefs for payment, checkout, finance, and cross-border ecommerce tea

Secure P2P communication for AI agents. Noise XX handshake, XChaCha20-Poly1305 encryption, connection consent, human verification. Zero central servers.

Codified expertise for customs documentation, tariff classification, duty optimisation, restricted party screening, and regulatory compliance across multiple jurisdictions. Informed by trade complianc

Serves as a reviewer of the codebase with instructions on looking for Apple App Store optimizations or rejection reasons.

Complete Kalshi trading command interface — portfolio P&L, live market scanning with edge scoring, trade execution, and risk management through your OpenClaw agent. Built-in safety: $25 max trade, 100

Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and ag

Account API skill. Use when working with Account for custom_policy, fulfillment_policy, payment_policy. Covers 36 endpoints.

Generate creative code names and encode/decode secret messages using classic and sophisticated ciphers. Blends nostalgic decoder ring fun with modern cryptographic techniques. Includes Caesar, Vigenèr

Digital legacy agent — dead man's switch, final message executor, and ghost mode responder that preserves your digital presence. Use when the user wants to set up a dead man's switch, manage their dig

Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testi

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or prov

Audit web interfaces against WCAG 2.1 AA/AAA standards, identify violations, and produce actionable remediation reports with code fixes. Use when the user requests accessibility testing or provides re

Analyze open-source license compatibility, obligations, and compliance risks across project dependencies. Use when the user requests license analysis or provides relevant inputs for this workflow.

Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanni

Create, schedule, and verify database backups with support for full, incremental, and point-in-time recovery strategies. Use when the user requests database backup or provides relevant inputs for this

中国个人信息保护法（PIPL）合规检查、风险评估和文档生成工具。 为企业提供全面的PIPL合规解决方案。 Use when: 需要进行PIPL合规自查、个人信息处理风险评估、 合规文档生成、企业合规管理、数据处理影响评估、跨境传输合规检查。 🎉 v1.1.9 重要更新： - 🔧 全新统一化CLI接口，简洁高效 - 📊 支持JSON/Markdown/HTML/CSV多格式报告输出 - �

Builds DVSA/Traffic Commissioner “show me” audit readiness checklists and evidence indexes. USE WHEN preparing for audits or operator licence scrutiny.

Plans CPC/MPQC competence tracking with reminders, evidence lists, and compliance reporting. USE WHEN maintaining training/certification readiness.

Creates a 1-page driver-facing tacho/WTD infringement note plus corrective actions and review date. USE WHEN you need to explain infringements and schedule follow-up.

Analyze any public company's AI exposure using the 8-dimension AI Exposure Index. Fetches last 4 10-K filings (or international equivalents), O*NET data, patents, and earnings transcripts to score vul

Back up and restore OpenClaw state. Creates local archives and uploads to S3-compatible cloud storage (AWS S3, Cloudflare R2, Backblaze B2, MinIO, DigitalOcean Spaces, and more). Use when the user say

Analyze a GitHub pull request for mergeability — predict whether it will get merged based on technical, architectural, process, social, and compliance factors. Use when asked to review a PR, check if

Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.

扫描微信公众号文章中的违规敏感词并自动改写。覆盖翻墙工具、政治敏感、灰产、 破解逆向、引流卖货等 8 大类 100+ 敏感词。输出违规报告和改写后的安全版本。 Use when publishing WeChat articles, checking "违规", "敏感词", "审核", "公众号合规", or "wechat compliance".

Unified security suite for agent workspaces. Installs, configures, and orchestrates all 11 OpenClaw security tools in one command — integrity, secrets, permissions, network, audit trail, signing, supp

Read-only detection of website defacement/hijacking via page source, hidden SEO links, suspicious redirects, and cloaking, corroborated best-effort by Security Center and WAF. Use when a user suspects

Forensic media triage with chain of custody. Use when receiving images, videos, audio, PDFs, or documents that need evidence-grade handling, integrity verification, and audit trails.

MTProto 2.0 protocol implementation guide for Telegram backend development. Use when implementing MTProto encryption, handshake, message serialization, or building Telegram-compatible servers. Covers

Generate daily vulnerability briefings from NIST NVD, CISA KEV, and security advisories. Aggregates, scores, and formats CVE data into actionable reports. No API key needed.

Base65536 file encoding and decoding tool. Encodes arbitrary binary files into Unicode text using Base65536 encoding, supports gzip compression, original filename preservation, and byte-level XOR encr

Sarbanes-Oxley Act compliance reference — SOX sections, internal controls, audit requirements, and IT governance. Use when evaluating SOX compliance, designing internal controls, or preparing for fina

Analyze a specific domain using registration, DNS, website, safety, backlink, cross-TLD, and market and legal-risk evidence. Use when a user asks what is known about a domain, wants due diligence befo

Wraps HLE benchmark questions in a structured Chain-of-Thought (CoT) reasoning process. Use when answering HLE questions to ensure strict step-by-step logic and format compliance.

Full OpenClaw backup, restore, and migration between machines. Export your entire setup (config, workspace, memory, skills, cron jobs) into a single encrypted archive. Restore on any machine with one