Skill rating

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles

Write high-quality YARA-X detection rules for malware hunting. Covers atom selection, string optimization, false positive reduction, module usage (PE, ELF, Macho), and Trail of Bits methodology. Inclu

Audits Move contracts for security vulnerabilities before deployment using 7-category checklist. Triggers on: 'audit contract', 'security check', 'review security', 'check for vulnerabilities', 'secur

30-day countdown protocol for third-party compliance audits — EcoSure, health department, corporate brand audits. Milestone-driven preparation that makes perfect audit scores the natural outcome of th

Complete DevOps toolkit for AI-assisted software development. Release pipeline, license compliance, copyright enforcement, repo visibility guard, identity file protection, manifest reconciler, and bes

Framework skill: ClawHub Schema compliance, naming conventions, skill standardization, modularization, generalization, ecosystem registry, skill learning pipeline, starter scaffolding.

Dependency audit and upgrade planner for Node.js, Python, Rust, Go, and Ruby projects. Scans for outdated packages, vulnerability CVEs, and breaking changes, then produces a prioritized upgrade plan w

Build and manage MSHA Part 46 training programs for cement plants. Free CementOps Compliance Suite skill. Task training templates by equipment, toolbox talk generator, new miner orientation, complianc

YOAP (Yongnian Open Agent Protocol) — Open A2A protocol with Smart Matching + E2E Encryption + Negotiation Threads + Group Channels

Extract structured data from contracts, legal agreements, court filings, and compliance documents. Pre-built schemas for parties, clauses, dates, obligations. PII redaction for privilege review. 97%+

Expert guidance for Grype, the open-source vulnerability scanner by Anchore that finds known vulnerabilities (CVEs) in container images, filesystems, and SBOMs. Helps developers integrate Grype into C

智能审核食品包装标签的合规性，支持图片/PDF设计稿；当用户需要审核标签强制性标识、营养标签规范性、声称用语合规性或格式要求时使用

BNB Chain security scanner — scan contracts, simulate transactions, detect phishing, investigate deployers, track scam campaigns, and audit wallet approvals via ShieldBot's API.

Core Archon DID toolkit - identity management, verifiable credentials, encrypted messaging (dmail), Nostr integration, file encryption/signing, aliasing, authorization (challenge/response), groups, an

Run security audits on Linux servers, web applications, and cloud infrastructure. Checks SSH hardening, firewall rules, open ports, SSL/TLS config, file permissions, and common vulnerabilities. Produc

Analyzes URLs using heuristic algorithms to detect and identify phishing threats in real time.

GitHub compliance evidence collection for auditclaw-grc. 9 read-only checks covering branch protection, secret scanning, 2FA, Dependabot, deploy keys, audit logs, webhooks, CODEOWNERS, and CI/CD secur

AI-powered legal assistant for commercial transactions - provides contract review, transaction advisory, compliance checking, document generation, risk assessment, and negotiation support for business

Extract structured data from medical records, lab reports, prescriptions, and clinical documents. Pre-built schemas for patient info, diagnoses, medications, vitals. PII redaction for HIPAA compliance

Design and automate corporate employee onboarding programs with AI. Create adaptive learning paths by role, compliance training modules, microlearning sequences, and ROI dashboards for L&D departments

Store and use sudo password for automated root commands. Essential companion for skills that need sudo access (like vpn-mesh).

Authorized web pentest: recon, proof-based exploits, report.

Identifies and fixes XSS, SQL injection, and command injection vulnerabilities with validation schemas, sanitization libraries, and safe coding patterns. Use for "input validation", "XSS prevention",

Cloudflare Workers security with authentication, CORS, rate limiting, input validation. Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities.

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an exi

Audits and implements web accessibility (a11y) following WCAG 2.1 guidelines with ARIA patterns, keyboard navigation, screen reader support, and contrast checking. Use when users request "accessibilit

Hardens API security with rate limiting, input validation, authentication, and protection against common attacks. Use when users request "API security", "secure API", "rate limiting", "input validatio

Ingest OpenClaw agent history into the Obsidian wiki. Use this skill when the user wants to mine their past OpenClaw sessions for knowledge, import their ~/.openclaw folder, extract insights from prev

Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing han

Manages environment variables and secrets securely with encryption, rotation, and provider integration. Use when users request "secrets management", "environment variables", "API keys", "credentials s

Ingest Hermes agent history into the Obsidian wiki. Use this skill when the user wants to mine their past Hermes sessions for knowledge, import their ~/.hermes folder, extract insights from previous H

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Decode and inspect JSON Web Tokens (JWTs) without verification. Use when the user provides a JWT string and wants to see its header, payload, or claims — e.g. "decode this JWT", "what's in this token"

Classify a web business, then identify, draft, and checklist the compliance pages, notices, disclosures, user flows, and launch gates it needs. Use when the user wants a Privacy Policy, Cookie Policy

Attacker's-eye security review of a diff, branch, or module — walks a fixed vulnerability catalog (missing authz on new endpoints, injection, secrets in code/logs, trusting client-sent identity, SSRF,

Enhanced security with OWASP Top 10, dependency scanning, SAST/DAST, secrets detection, compliance checks, and security hardening guides.

跨境合规与贸易参考助手：认证清单（CE/FCC/GPSR）、关税估算、标签要求、 平台规则检查。经 Yufluent 云端 Harness 输出结构化 JSON 建议。 非法律或税务建议，结果须人工核实。Use for 合规、认证、关税、GPSR、CE、FCC、VAT、HS编码.

设计走查：将生成的 HTML/CSS 页面对照设计规范文档逐项审查，输出结构化合规报告。 当用户说"设计走查"、"走查页面"、"检查是否符合设计规范"、"审查设计合规"时触发。 生成任何 HTML/CSS 页面后也可主动触发，确保输出符合设计规范。 用户可指定任意设计规范文档路径，skill 会自动读取并逐项对照检查。

Activate when: a prepared 1040 or 1120-S is going to review; you are the second set of eyes on someone else's return; a firm wants one consistent review standard across reviewers; onboarding a prepare

网瘾中年的自媒体技能——微信公众号「网瘾中年」专用内容生产与发布全流程。覆盖选题评估、创作简报、爆款公式匹配、公众号原生写作、去AI味精修、AIGC合规守门、封面生成、草稿箱推送、数据复盘九个环节。触发词："写一篇公众号""发一篇""推草稿箱""推送草稿""做选题""软广""日报排版""复盘阅读数据""爆款公式""网瘾中年"。不用于X/小红书/抖音等其他平台创作，不用于纯代码任务，不用于视频号发布

AI 漏洞追踪器 - 在 GitHub 和微信公众号搜索近一个月的 AI 相关漏洞（提示词注入、提示词越狱等），并推送到飞书表格。支持去重和翻译。 搜索关键字: prompt injection, prompt jailbreak, LLM vulnerability, AI security, adversarial prompt, jailbreak attack 数据源: - GitHu

Free developer guide for building paid skills on ClawHub. Explains the standard three-phase payment flow, SkillSpector compliance requirements, and common pitfalls for developers building ClawHub skil

Reviews pull requests with scope validation, requirements compliance, and line comments