Skill rating

Use when a compliance officer, security analyst, or auditor needs to assess an organization's controls against a regulatory framework (GDPR, SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF). Guides structu

Audit project dependencies for outdated packages, security vulnerabilities, and breaking changes. Use when someone asks to "check for outdated packages", "audit dependencies", "find vulnerable depende

Apply Islamic ethical constraints to AI responses about religion, Quran, Hadith, Sharia rulers, and Islamic practice. Use this skill whenever a user asks any question related to Islam, Muslims, the Qu

Use this skill for security scanning: check transaction safety, is this transaction safe, pre-execution check, security scan, token risk scanning, honeypot detection, DApp/URL phishing detection, mess

Manage web search result knowledge capture with safe URL rules, staging, user confirmation, archiving, audit logs, and multi-platform adapters for IMA, Tencent Docs, Feishu Wiki, DingTalk Docs, Obsidi

Use this skill when a nonprofit grant writer, program manager, or development director needs to turn a funder RFP or NOFO into a structured grant proposal. Extracts funder requirements, gathers projec

Audit and validate Prisma Access configurations against best practices and security standards. Use when reviewing security policies, checking for misconfigurations, or validating compliance with PAN-O

Judge whether an email is important/urgent using content-based analysis rather than sender name or mailbox labels (which can be spoofed). Use when asked to triage emails, decide priority, detect phish

Assess third-party vendor risk for AI and SaaS products. Evaluates security posture, data handling, compliance, financial stability, and operational resilience. Use when onboarding new vendors, conduc

Use when user needs to check import/export compliance requirements for specific products and countries. Use when verifying product certifications, tariffs, sanctions, or regulatory requirements. Use w

Compliance expert for snyk-agent-scan — the agent skill file scanner — NOT for other Snyk CLI tools (snyk test, snyk code SAST, snyk iac, snyk container). Fixes alerts through content restructuring, n

GitHub supply-chain forensics: recovery, IOCs, reporting.

Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

Automate AWS secrets rotation for RDS, API keys, and credentials

Harden Docker/container images and runtime deployments with secure base images, non-root users, CVE scanning, SBOM/signing, seccomp/AppArmor, and Kubernetes pod security controls. Use for Dockerfile s

Comprehensive AWS security posture assessment using AWS CLI and security best practices

Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap.

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.

⚠️ AUTHORIZED USE ONLY > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Mi

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

Provide a comprehensive checklist for planning, executing, and following up on penetration tests. Ensure thorough preparation, proper scoping, and effective remediation of discovered vulnerabilities.

Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during sec

Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.

Run read-only exposure checks for security advisories and write a structured local audit report.

Create time-boxed technical spike documents for researching and resolving critical development decisions before implementation.

Search WeChat Official Account articles using OpenClaw's web search, Tavily API, and web fetch capabilities with compliance-focused design.

Audit ecommerce listings, ad copy, and creator content against TikTok Shop policies to catch violations before they trigger penalties. Use when reviewing new listings, vetting creator videos and capti

火山引擎合规最佳实践助手：一是根据用户诉求（要满足的合规标准、关键词、关注的风险等级）， 从火山引擎官方内置的合规包模板里推荐该开启哪些、并标出哪些已开启；二是汇总账号当前的合规 态势，把已生效规则/合规包（官方内置 + 用户自定义）的评估结果按类别（法规 / 最佳实践 / 自定义）与严重度聚合成一份合规总览报告；三是当官方基线没覆盖时，指导用户写一条 Rego 策略 作为自定义合规规则并注册评估

Multi-ecosystem dependency audit — find outdated, vulnerable, unused, and license-incompatible packages across npm, pip, cargo, go, and composer. Use when asked to check dependency health, audit packa

URL safety scanner and domain reputation checker. Use when: checking if a URL is safe before visiting, scanning links in emails/messages, verifying domains for phishing/malware/scam. NOT for: submitti

Use this skill when a customs broker, trade-compliance analyst, importer, or trade counsel needs to classify a product under HTSUS, EU CN/TARIC, or another national tariff schedule. Walks GRI 1–6 in o

Assess data privacy compliance across 20 control areas with 63 controls covering governance, consent, security, breach response, vendor management, and cross-border transfers. Use when evaluating priv

Build search queries for network asset discovery platforms (space测绘). Use when users want to find network assets, discover attack surfaces, investigate vulnerabilities (CVE), or search for specific se

Encryption and decryption toolkit for string and byte data. Supports Fernet (AES-128) symmetric encryption, fallback XOR encryption, custom password protection, code obfuscation, and batch processing.

AI-powered global compliance checker, document generator, and risk assessor for GDPR, CCPA, SOC2, ISO27001, HIPAA and more

You are an accessibility auditor with expertise in web accessibility standards, assistive technology testing, and inclusive design practices. Use when: wcag 2.1/2.2 aa and aaa compliance, screen reade

Expert change management advisor for enterprise transformations. Assess readiness, diagnose adoption risks, build sponsor plans, and drive stakeholder adoption in cybersecurity, cloud, AI, and complia

Backup and restore files with compression and encryption. Use when user needs to backup important files, create scheduled backups, sync folders, encrypt sensitive backups, or restore from backup archi

Implement quantum-resistant encryption using the CIFER SDK (cifer-sdk npm package). Covers SDK initialization, wallet setup, secret creation, text encryption/decryption, and file encryption/decryption

Audit code for security issues - sensitive data exposure, dependency vulnerabilities, SQL injection, hardcoded secrets. Use when the user asks for security check, dependency scan, or before deploying.

When the user faces brand impersonation, fake websites, phishing sites, or trademark infringement. Also use when the user mentions "fake site," "impersonation," "phishing site," "trademark infringemen

Supernal Coding CLI for development workflows - task management, requirements tracking, testing, git automation, ralph loops, compliance, and documentation. Use for task management (sc task), project

API 安全扫描工具。对 REST API 端点进行自动化安全审计，检测 OWASP Top 10 漏洞、 认证/授权问题、敏感数据泄露、速率限制缺失等常见安全隐患。输出结构化安全报告。 适合开发者在部署前快速自检，也适合安全团队做轻量级审计。

You are a blockchain developer specializing in Web3 technologies and decentralized applications. Use when: blockchain platforms, smart contract development, defi protocols, web3 development, common vu

Secure communication using the Pieter Theijssen triple-layer XOR encryption algorithm. Use when encrypting or decrypting messages, files, or any sensitive data that needs to be transmitted securely ov

Scan AI agent skills for security vulnerabilities — detects code injection, prompt injection, credential exfiltration, supply chain attacks, and 69+ threat patterns. Use when installing new skills, au

Linux security auditing tool that checks SSH configuration, open/listening ports, firewall rules (ufw/iptables/nftables), failed login attempts, sudoers permissions, world-writable files, and SUID bin

Assess GDPR compliance readiness and generate gap analysis with remediation guidance. Use when evaluating data privacy compliance, GDPR readiness, EU data protection, privacy impact assessments, data