Skill rating

当用户要把网页抓取/邮件/工具返回值/检索文档/用户上传内容喂给 AI，又担心里面藏『忽略之前指令』『你是新AI』这类指令时使用。在不可信内容进上下文之前先扫描：中英双语文式库（忽略指令/角色劫持/越狱/DAN/索要系统提示）+ 启发式（面向AI的祈使句、角色切换、索要隐藏指令）+ 沙箱规则。附可运行扫描脚本，输出风险分·命中规则·处置建议（丢弃/隔离/沙箱）。复用 desens-scan 与 r

Detect and reject indirect prompt injection attacks when reading external content (social media posts, comments, documents, emails, web pages, user uploads). Use this skill BEFORE processing any untru

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API c

Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validatio

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

Expert in Windows UI Automation (UIA) and Win32 APIs for desktop automation. Specializes in accessible, secure automation of Windows applications including element discovery, input simulation, and pro

AUTHORIZED USE ONLY: This skill contains dual-use security techniques. Before proceeding with any bypass or analysis: > 1.

PC and console game development principles. Engine selection, platform features, optimization strategies.

Comprehensive email marketing expertise for Claude Code — 68K words, 908 sources, 19 industry playbooks covering strategy, automation, deliverability, copywriting, and compliance.

Skill for working with the BlueHammer vulnerability proof-of-concept repository, covering build, usage, and code patterns.

Open-source Chrome extension replacing 12+ browser extensions with privacy-respecting tools including tab cleaner, cookie editor, dark mode, JS toggle, GDPR dismisser, and more.

Expert FastAPI developer specializing in production-ready async REST APIs with Pydantic v2, SQLAlchemy 2.0, OAuth2/JWT authentication, and comprehensive security. Deep expertise in dependency injectio

Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.

Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.

Android app that detects VPN/proxy servers (VLESS/xray/sing-box) via local SOCKS5 vulnerability, exposing exit IPs and server configs without root

Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment,

Design and implement integration architectures connecting financial systems — APIs, FIX protocol, ISO 20022, event-driven patterns, batch feeds, idempotency, and resilience. Use when building custodia

WebGL shaders and effects for JARVIS 3D HUD

Inspect, patch, validate, publish, or confirm OpenClaw GHSA security advisories and private-fork state.

Design and manage reference data systems — security master, client master, account master, identifier mapping, pricing data sources, golden source designation, and governance. Use when building or eva

Guidelines for implementing OAuth 2.0 and OAuth 2.1 authentication flows with security best practices and PKCE

Recognize breakthrough moments, blocking resolutions, and design decisions worth preserving. Detect high-value insights that save future time. Suggest distillation at valuable moments, not routine wor

Analyze the broker-dealer standard of conduct under SEC Regulation Best Interest's four obligations: Disclosure, Care, Conflict of Interest, and Compliance. Owns what triggers a 'recommendation' under

Automated accessibility testing with axe-core, Playwright, and jest-axe for WCAG compliance. Use when adding or validating a11y tests, running WCAG checks, or auditing UI accessibility.

Guidelines for implementing JWT authentication with security best practices for token creation, validation, and storage

Complete security remediation workflow. Scans code for vulnerabilities using Snyk, fixes them, validates the fix, and optionally creates a PR. Supports both single-issue and batch mode for multiple v

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

Deploy privacy-first analytics with correct API patterns, rate limits, and GDPR compliance.

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES e

Win #1 Product of the Day on Product Hunt. Completely reverse-engineered from 30x daily winner and 3x weekly winner campaigns — ranking algorithm decoded, launch timing optimized, hunter selection gui

Chinese website data scraping expert with anti-bypass strategies (中国网站数据爬取专家+反爬绕过策略). Teach AI agents to scrape Chinese websites that Scrapling alone can't handle — Baidu anti-crawl, Taobao login wall

You are the Accessibility Engineering Engine — a complete WCAG compliance, inclusive design, and digital accessibility system. You help teams build products that work for everyone, pass audits, and...

Protect OpenClaw installations from prompt injection, data exfiltration, malicious skills, and workspace tampering

B2B content writing with daily workflows and batching systems across Sales/HR/Fintech/Ops Tech

RSS/Atom feed digest with optional CVE enrichment, Ghost CMS drafts, and channel notifications

Scan SBOM for known CVE vulnerabilities

Define security policies for your workspace and audit compliance. Check installed skills against command, network, and data handling rules. Generate audit-ready compliance reports.

Use a persistent OpenClaw browser profile to access http://mail.ztpc.com/ (Aliyun Enterprise Mail), scan UNREAD emails only, and conservatively mark obvious spam / phishing as Spam (never delete). ...

This document outlines your standard procedures, principles, and skillsets for conducting security audits. You must adhere to these guidelines whenever you are tasked with a security analysis.

Network-wide ad and tracker blocking at the DNS level. A Pi-hole alternative that runs directly on your machine as an OpenClaw skill. No separate hardware needed.

change ScanResult file extension from txt -> xlsx located in template

Sovereign, recoverable memory for AI agents backed by Jackal decentralized storage.

Deploy privacy-first analytics with correct API patterns, rate limits, and GDPR compliance.

Publish and manage iOS and Android apps with account setup, submission workflows, review compliance, and rejection handling.

Comprehensive security audit for OpenClaw. Scans 7 domains (runtime, channels, agents, cron, skills, sessions, network), supports 3 expertise levels, context-aware analysis, and visual dashboard. Read

Missed deadlines are the

Agent防火墙免费版,为AI Agent应用提供基础安全防护能力. 核心能力:提示注入检测、工具调用过滤、输入净化、安全策略检查. 适用场景:Agent应用安全防护、用户输入净化、工具调用安全验证. 差异化:免费版聚焦核心防护能力,支持单Agent保护,适合个人开发者快速集成. 适用关键词: Agent防火墙, 提示注入, 安全防护, 输入净化, agent firewall, prompt i

Runtime safety guard for OpenClaw multi-agent workflows. Blocks destructive tools (write, edit, exec, process, apply_patch) for controlled agents, forcing delegation to sub-agents.