Skill rating

/cs:ciso-review <plan> — Risk-paranoid interrogation of any plan that touches data, compliance, or production access. Use when launching features that handle customer data, before a SOC 2 / ISO audit,

/cs:cto-review <plan> — Architecture and scaling interrogation. Tech debt, scaling cliffs, team scaling, build-vs-buy. Use when committing to an architecture, planning for 10x load, or weighing a rebu

/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system i

Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-expl

Comprehensive security audit and vulnerability detection for JavaScript/TypeScript applications following OWASP Top 10. Use when (1) Users say 'audit security', 'check for vulnerabilities', 'security

HIPAA compliance, healthcare regulations, privacy and security standards for medical organizations and providers

Human resources management, employee relations, recruitment support, and HR compliance assistance

Comprehensive guide for implementing NetworkPolicy, PodSecurityPolicy, RBAC, and Pod Security Standards in Kubernetes.

Creates valid Microsoft Threat Modeling Tool (.tm7) files compatible with the Microsoft Threat Modeling Tool v7.3+. Use this skill whenever asked to create, generate, or modify a .tm7 threat model fil

Use when the user asks to prepare for SOC 2 audits, map Trust Service Criteria, build control matrices, collect audit evidence, perform gap analysis, or assess SOC 2 Type I vs Type II readiness.

Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability). Use when integrating services or preparing production deployments where secrets must be

Use this skill when the user wants FOFA-based asset discovery, host profiling, distribution statistics, icon_hash generation, query refinement after zero-result searches, or cautious follow-up vulnera

EN: Convert unstructured Chinese clinical narratives (admission notes, progress notes, discharge summaries, outpatient records) into structured JSON aligned with HL7 FHIR R4 and Chinese national EMR s

Runs defensive security: alert triage, compromise investigation, attack paths, vulnerability prioritization, detection, and risk reporting. Use when an alert, a suspicious login, a reported email, enc

Senior Quality Manager Responsible Person (QMR) for HealthTech and MedTech companies. Provides quality system governance, management review leadership, regulatory compliance oversight, and quality per

Design a folder structure people actually file into — shallow, purpose-first, with a home for everything and an inbox for the undecided, sized to the team that must maintain it. Use when asked organiz

This skill should be used when the user wants to read, analyze, or work with CAD DWG/DXF drawing files. Trigger phrases include: DWG, DXF, CAD drawing, drawing analysis, layer, block, entity, screensh

Manage Cloudflare DNS records, Tunnels (cloudflared), and Zero Trust policies. Use for pointing domains, exposing local services via tunnels, and updating ingress rules.

CRITICAL: Use for Matrix SDK integration with Makepad. Triggers on: Matrix SDK, sliding sync, MatrixRequest, timeline, matrix-sdk, matrix client, robrix, matrix room, Matrix 集成, 聊天客户端

Build a minimal but real security policy for sensitive apps. The output is a single, coherent Blue Book document using MUST/SHOULD/CAN language, with explicit assumptions, scope, and security gates.

Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.

Safe command execution for OpenClaw Agents with automatic danger pattern detection, risk assessment, user approval workflow, and audit logging. Use when agents need to execute shell commands that may

Enforce the simplest meeting rule that works — no agenda, no meeting — with the three-line agenda format (purpose, decisions sought, pre-reads), the 24-hour rule, and the graceful cancel scripts. Use

한국 비즈니스 서류(세금계산서, 계약서, 통장사본, 견적서, 거래명세서, 사업자등록증, 사업비 요청 공문, 지원금 신청서, 검수조서, 이체확인증, 결과보고서) 검토 및 검증. Use when reviewing Korean business documents for format compliance, required fields, value accuracy, a

Use this skill whenever the user wants to design, execute, or manage complex multi-step VMware workflows with human approval gates and explicit, best-effort rollback. Pilot is the orchestration brain

Enterprise-grade security and governance layer for OpenClaw agents. Detect PII, enforce policies, generate compliance receipts, control tool access, and scan skills for vulnerabilities before insta...

EN: Extract structured information from engineering drawings — mechanical 2D drafts, P&IDs, electrical schematics, construction architectural/structural drawings — into machine-readable BOM, dimension

Interactive guide for integrating MobTech ShareSDK into Android projects with 6-step workflow. Use when user says "我要在app中增加分享能力", "ShareSDK集成", "Android分享功能", "配置微信分享", or asks about ShareSDK setup,

Interactive guide for integrating MobTech FlyVerify (SecVerify) into Android projects with 5-step workflow. Use when user says "我要在app中增加一键登录", "秒验集成", "FlyVerify集成", "Android一键登录", or asks about FlyV

Secure n8n workflow automation integration for coding tasks. This skill implements enterprise-grade security with credential isolation, input validation, audit logging, rate limiting, and granular per

Security, performance, and quality auditing for AgentSkills. Use when reviewing skills before installation, auditing during development, checking installed skills for risks, optimizing performance, or

Unified audit logging, policy enforcement, and input sanitization for the entire VMware MCP skill family. Use when querying audit logs, managing policy rules, or when any VMware skill needs audit/poli

Interactive guide for integrating MobTech MobLink into Android projects with step-by-step workflow. Use when user says "MobLink集成", "Link集成", "Android深度链接", "场景还原", "一键集成 MobLink", or asks about MobLi

Scan content for product mentions and auto-insert affiliate links with FTC compliance disclosures. Use when the user needs to monetize blog posts, product reviews, or guides with tracked affiliate lin

Interactive guide for integrating MobTech MobLink into HarmonyOS NEXT projects with 6-step workflow. Use when user says "MobLink集成", "Link集成", "鸿蒙深度链接", "场景还原", "一键集成 MobLink", or asks about MobLink o

Automatic security gate that checks packages against a vulnerability database before installation. Use before any npm install, pip install, yarn add, or package manager operation.

Open security platform for agentic infrastructure — broad scanning plus MCP discovery, CVEs, blast radius, SBOMs, CIS benchmarks (AWS, Azure, GCP, Snowflake), OWASP/NIST/MITRE compliance, AISVS v1.0,

Plan what happens to your digital life if you die or become incapacitated. Inventory accounts, subscriptions, crypto wallets, important files, social media legacy contacts, and generate a sealed instr

Real-time cryptocurrency scam detection with database-first architecture. Protects users from phishing, honeypots, rug pulls, and ponzi schemes. No external API calls during checks!

Interactive gotchi petting via Bankr wallet. Check cooldowns, pet when ready, track your kinship journey. Daily ritual for bonding with your Aavegotchi NFTs on Base chain.

AI-powered cryptocurrency safety assistant with database-first architecture. Protects users from phishing, honeypots, rug pulls, and ponzi schemes. No external API calls during checks!

Search FDA industry guidelines by therapeutic area or topic. Trigger when user requests FDA guidance documents, regulatory guidelines, or asks about FDA requirements for specific disease areas, drug d

Provides binary exploitation (pwn) techniques for CTF challenges. Use when exploiting buffer overflows, format strings, heap vulnerabilities (House of Orange, Spirit, Lore, Apple 2, Einherjar, tcache

Drift detection + baseline integrity guard for agent workspace files with automatic alerting support