Skill rating

Turn a product lineup into a live shopping script your host can actually read on air. This live commerce script studio builds the run of show for the whole session as a minute-by-minute live selling s

Activate when: user asks 'what do we know that others don't,' 'where is our edge,' 'what important truth do few people agree with me on,' 'is this idea defensible,' or is hunting for a startup idea, a

国内电商全链路运营专家技能，覆盖淘宝、天猫、京东、拼多多、抖音电商、小红书、视频号、Temu八大平台。提供选品评分、定价与利润测算（含达人佣金）、广告投放ROI测算、店铺转化漏斗诊断、广告法违禁词合规检查、商品标题生成、备货与资金占用测算七个可计算工具，以及一个实时数据桥接器(live.py)——先用 WebSearch/WebFetch 拉取当前真实佣金率、类目退货率、1688进货价、关键词搜索

Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP cached store. Classify flows by business impact, detect orphaned resources, audit connector usage, enforce compliance stand

Use for nonprofit and NGO operations — donor management, grant tracking, fundraising campaigns, volunteer coordination, program impact measurement, board governance, event planning, fund accounting, c

Generate Software Bill of Materials (SBOM) in CycloneDX or SPDX format — inventory all dependencies, licenses, vulnerabilities, and supply chain metadata. Required for compliance (FDA, EU CRA, NIST) a

Use when user needs reverse compliance strategy for global market entry. Use when generating compliance-first architecture plans for cross-border business. Use when creating compliance weaponization s

Scan OpenClaw skills for malware and security issues before installation. Use when the user wants to verify a skill is safe, audit a ClawHub skill, or check a local or GitHub skill.

Software IP self-assessment: AI-delivered compliance review for Chinese software copyright applications. Performs material completeness check, source code documentation audit, user manual review, righ

Activate when: goods may fall under an antidumping/countervailing duty order or Section 301; sourcing changes; 'are we exposed to AD/CVD or 301?'; scope ambiguity. Do NOT activate when: product clearl

Rate limiting & API throttling anti-pattern analyzer -- detects missing rate limits, brute force exposure, no backoff strategies, unbounded queues, retry storm vulnerability, and flow control gaps

Cryptography misuse & weak algorithm detector -- detects deprecated algorithms, hardcoded keys/IVs, ECB mode, weak random number generation, timing-vulnerable comparisons, and insecure TLS configurati

Professional business hospitality including reception plans, seating arrangements, dining coordination, and etiquette guidance. Covers VIP visits, business dinners, corporate events, and relationship-

Logging quality & observability analyzer -- detects missing structured logging, sensitive data in logs, inconsistent log levels, and log injection vulnerabilities

Scan and audit installed skills for security risks, suspicious patterns, and permission overreach. Use when: (1) before installing a new skill; (2) periodically reviewing installed skills; (3) before

Get a real email address for your AI agent. Create an inbox, send and receive email, with optional PGP encryption and DID verified identity.

生态环境法典普法与合规助手。基于《中华人民共和国生态环境法典》（2026年8月15日施行）全文1242条构建的智能问答与合规预检技能。当用户提出法典条款查询、场景化法律咨询、企业合规预检、新旧法律衔接、法典结构查询、主体权责查询、专家解读查询等需求时触发本技能。涉及"生态环保法典""环境法典""环保合规""双罚制""排污许可""环评""损害赔偿""法典第X条""企业环保合规检查"等关键词时应使用。

Operational assistant for independent climbing gyms and bouldering studios — membership management, churn reduction, route-setting coordination, youth program scheduling, safety compliance, and revenu

Integrate Paddle payments with subscriptions, webhooks, checkout, and tax compliance.

Audits project dependencies for security vulnerabilities, license compliance issues, outdated packages, and transitive dependency risk. Use when asked to audit dependencies, review package security, c

Security audit for multi-agent AI systems - OWASP ASI01-ASI10

RAG-enhanced compliance Q&A with regulatory interpretation guardrails, source attribution, and escalation triggers.

Run security audits on Linux servers, web applications, and cloud infrastructure. Checks SSH hardening, firewall rules, open ports, SSL/TLS config, file permissions, and common vulnerabilities. Produc

Use this skill when a RIM lead, IG officer, compliance officer, or legal-ops professional needs to draft an ARMA GARP-aligned records retention schedule. Covers multi-jurisdictional regulatory citatio

Activate when: an importer has recurring, material duty spend; evaluating FTZ, duty drawback, first-sale valuation, bonded warehouse, or FTA use; 'are we leaving duty savings on the table?'. Do NOT ac

Activate when: filing an entry or ISF; onboarding an importer (POA); building the compliance file; 'did we file ISF in time?', 'is our reasonable-care record complete?'. Do NOT activate when: the ship

Daily operational compliance monitoring for restaurant and franchise operators. Three structured check-ins per day — opening, mid-shift, and closing — with pattern tracking. Built by a franchise GM wi

Threat-model and harden applications against security vulnerabilities

Activate when: determining country of origin; testing USMCA (or other FTA) preference eligibility; marking; 'does this qualify for duty-free?'; goods with multi-country inputs. Do NOT activate when: w

End-to-end iOS malware/spyware forensic assessment of a non-jailbroken iPhone from a Mac. Installs tooling (libimobiledevice + Mobile Verification Toolkit), pulls crash logs, creates a full ENCRYPTED

Multi-layered security audit system for GitHub/ClawHub releases. Prevents credential leaks, detects vulnerabilities, validates documentation. Frequency-aware scanning (quick/history/dependencies). Blo

Scan web applications for accessibility issues — WCAG 2.2 compliance, screen reader compatibility, keyboard navigation, color contrast, and ARIA usage.

Generate South African tax/VAT/SARS compliance articles

Activate when: classifying merchandise under the HTSUS; ambiguous/multi-function goods; 'which heading applies?'; a product spanning multiple chapters. Do NOT activate when: an established binding rul

Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static code analysis, and permission auditing. Re

Use this skill when a resilience, continuity, audit, or process owner wants to draft or review an ISO 22301 / NIST-aligned Business Impact Analysis. Covers process inventory, impact-over-time scoring,

Crawl any website and get a 0-100 SEO score with 50+ checks across Technical, On-Page, Schema, Social, and Compliance categories. Identifies quick wins, competitor gaps, and generates AI-written SEO a

Helps audit transitive skill dependency chains in agent compositions — catching the class of risk where a skill's direct dependencies appear safe but a dependency-of-a-dependency introduces a vulnerab

Send Web Push notifications from a Node.js backend using the web-push npm library (VAPID authentication, payload encryption). Covers generating VAPID keys, subscribing browsers, sending notifications,

Security audit and hardening for Clawdbot/Moltbot installations. Detects exposed gateways, fixes permissions, enables authentication, and guides firewall/Tailscale setup.

Security hardening guide for Moltbot/Clawdbot. Lock down your gateway, fix file permissions, set up auth, configure firewalls. Based on real vulnerability research.

Audit authentication flows for security vulnerabilities

Real-time monitoring of Greek AADE tax authority systems — tracks deadlines, rate changes, and compliance updates. File-based, OpenClaw-native.

Curated skill bundle for fintech startups, neobanks, payment processors and wealth-management platforms. Activates the firm pyramid with Finance, Legal, Engineering and Compliance agents pre-configure

跟踪 Ubuntu Linux 内核 CVE 漏洞的工具技能。当用户需要以下操作时使用此技能：(1) 查询特定内核版本（如 5.10/5.15）的 CVE 列表和修复状态；(2) 分析 Ubuntu Security Notice (USN) 中的内核漏洞详情；(3) 获取漏洞发现方式（发现者/发现方法）；(4) 汇总某个内核系列的漏洞报告；(5) 对比不同 Ubuntu 版本的内核 CVE 状态

Full-stack, multi-chain blockchain assistant covering BTC, ETH, BSC, Solana and major L2s. Reads charts and on-chain data, traces wallet and contract fund flows, weighs DeFi/staking yields against ris

Wrap every tool call with timeouts, circuit breakers, audit logging, and crash loop protection. Enforcement the agent cannot bypass.

License rug-pull detection. Scans dependencies and forks for license changes, gates upstream merges, maintains a license ledger, and generates a public compliance dashboard.

HTTP security header auditor that fetches response headers from any URL and grades them against OWASP, Mozilla Observatory, and Google standards. Checks Content-Security-Policy (detects unsafe-inline,

Comprehensive database administration, schema management, data operations, and optimization. Use when Codex needs to: (1) Create or modify database tables with proper indexing, (2) Perform bulk data i