Check a repository against OpenSSF security heuristics before you trust it as a dependency, approve it for use, or ship from it.
Use SafeDep Vet as a pre-adoption gate when an agent, maintainer, or CI pipeline is about to add a new dependency or import a skill repository and needs malware and policy signals…
Prüft Screenshot-Risiken in Support, Slack, Teams und Tickets im Nis2 Cybersecurity Compliance.
Consulta a base LOCAL de reuniões do ScribaDev (índice SQLite+FTS5 com resumos, transcrições, participantes, clientes e pendências).
API de Scripts Externos da Tray. Utilize quando o desenvolvedor precisar gerenciar scripts JavaScript customizados injetados na vitrine da loja, incluindo listagem, cadastro,…
Detect + redact high-confidence secrets in the claude-vault tiers (memory files and transcript JSONL / tool-results).
SCX-Studio-Pro projesinin Prisma ORM ve SQLite tabanlı veritabanı şemasını, model ilişkilerini, migrasyon süreçlerini ve veri yönetimini açıklar.
The two-lens advisory review procedure the generic agent runs at the software-delivery review step (/foundry:sd-review, software-delivery review step).
Planning-only skill for SDD projects. SDD builds **web apps** on Django + htmx + SQLite + Pico.css in Docker — one stack, the only one.
Use when drafting a task issue, Git commit message, pull request description, or evidence-backed task, milestone, phase or final implementation report, review/revision campaign…
Rédige et met à jour les spécifications SDD par cas d'utilisation (UC) : spec racine (projet principal) ou spec d'extension (fonction ajoutée à une racine existante).
Produit les documents de conception technique SDD (ARCHITECTURE.md, DEPLOYMENT.md, SECURITY.md, COMPLIANCE_MATRIX.md) à partir d'un SPEC-racine-*.md (+ extensions).
Generate sdf-js code from a natural-language scene description. Trigger when the user asks to "draw / paint / make / illustrate" a subject (e.g.
Full mode — new feature. Planner → Architect → [UX Designer] → Skeptic → Developer → [Skeptic ∥ Security Auditor] → Tester → Friction Reviewer.
Threat-model a change that touches auth, user data, external inputs, billing, or a public endpoint — catch the exposure before the internet does.
Use when a person or company crosses the Swedish border for tax. Covers unlimited tax liability for individuals (living in Sweden, a stay of six months in a row, or an essential…
Integrate Seal threshold encryption and access control on Sui. Use when the user mentions Seal.
Use when an agent or role needs credentials on a machine that does not have them — a fresh container, a rebuilt host, a successor session — or when sealing, rotating, or verifying…
Provision, connect, and operate Sealos object storage through the sealos-cli s3 commands added in zjy365/sealos-cli#28.
Literature search and citation management for medical research. Searches PubMed, Semantic Scholar, and bioRxiv/medRxiv with verified citations.
Use when searching Ukrainian court decisions in the Unified State Register of Court Decisions (ЄДРСР, reyestr.court.gov.ua), verifying case citations, retrieving rulings by case…
Seasonal planting calendar for gardeners. Find what to plant each month in your growing zone. Use when planning your garden, checking planting schedules, or finding plants for the…
Use when a public web page or site needs its HTTP security baseline hardened or audited - missing or weak security headers (Content-Security-Policy/CSP,…
Print Peephole's security audit report for this project — current mode, binary integrity, the CWE-mapped decision tally, sec-debt items needing approval, and tamper-evident…
Enforces security rules (SEC-1 through SEC-7). Loaded by the conductor for security audits, PR/code reviews, incident response, and new service scaffolding.
Use when code encrypts, signs, hashes, derives keys or sets up TLS — vetted libraries, AEAD, nonces.
Apply cryptography — encryption at rest / in transit, digital signatures, key management, MACs, TLS/PKI, HSM, secure enclaves — with implementation guidance and anti-patterns.
Explain and list Peephole sec-debt markers — deliberate, human-authorized security trade-offs recorded in code.
Use for security detection — audit logs, Semgrep/CodeQL and Sigma rules, canaries.
Review the current changes for the CWE classes Peephole enforces, as a checklist including the absence-of-guard classes regexes cannot catch.
Anbieterneutraler Security-Scan eines eigenen Repos: Bedrohungsmodell, Aufteilung nach Vertrauensgrenzen, gezielte Prüfung je Paket (Injection, Authn/Authz, Secrets, Krypto,…
Audit software/security posture — code review, dependency scanning, secret detection, access control, audit logging — with explicit findings and remediation priorities.
Design and document threat models for software / systems — assets, threats, vulnerabilities, mitigations — using STRIDE or ATT&CK frameworks.
Use when untrusted input reaches a sink — SQL/shell injection, paths, SSRF, XSS, CSRF, deserialization.
Apply suggested security fixes from a prior code review. Use when the user wants to remediate security findings with before/after code diffs, severity filtering, and explicit…
Web+AI 安全测试知识库。融合 WooYun 88,636 案例 + 先知 L1-L4 方法论 + GAARM 150 风险 + OWASP Top 10 (LLM/ASI/WSTG)。 TRIGGER when 任务是实战安全测试：渗透测试、漏洞挖掘/利用、红队攻防、安全审计 (SAST/DAST)、 CTF、AI/LLM 安全测试 (Prompt…
Maintain and extend the SecondBrain codebase with low-risk, test-validated edits. Use when work touches FastAPI route/model/service layers, indexing/parsing, SQLite FTS,…
Security Operations agent. Triages alerts, enforces policy, scans for vulnerabilities, and hardens the perimeter.
SecOps checks for endpoints: EDR, Sysmon, updates, EVTX on heartbeat, least privilege, network visibility, credential protection (Kerberos/NTLM/pass-the-hash), device inventory…
Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices.
Secret management integration (密鑰管理整合). Use when working with HashiCorp Vault, credential management, or secure configuration.
差分に追加された API キー・トークン・credential・秘密鍵・.env 値・個人ローカルパスなどの機密情報を、言語・ファイル種別に依存せず検出する。決定論的に判定できる範囲は CI（gitleaks 等）へ移譲しつつ、レビューで取りこぼしを補足する
Automated detection and prevention of leaked secrets, API keys, passwords, and tokens in code using tools like gitleaks, trufflehog, and pre-commit hooks.
Detect secrets, credentials, and sensitive data in code and configurations. Scan git history for secrets, detect API keys, tokens, passwords, check environment files, monitor…
Prevent secret leakage across git history, package artifacts, logs, and docs. Use when editing workflows, packaging configuration, environment files, or release automation.
Use BEFORE writing API keys/tokens/passwords into code, BEFORE git commit/push, BEFORE creating PR. Blocks accidental leaks of secrets to GitHub.
The secret-source gate. Routed to when changed code reads, writes, or passes a secret — API key, token, password, connection string, signing key, certificate, or any value that…
Decision-aid skill for runtime secret hygiene — fd passing, scratch surface verification, error-path safety, identifier hygiene, and avoiding the SECRETS_ENV aggregation…
Use when handling API keys, tokens, cookies, credentials, private URLs, environment files, logs, reports, or release artifacts.
secret を GCP(source-of-truth)/Cloudflare Secrets Store/GitHub Actions org secret に no-leak で投入・rotate するスキル。値を LLM context / tool-call JSON / log に一切載せず、shell var → curl body →…
Secure credential intake via local web form. Spin up a one-page server on Tailscale, paste keys, upload PEM/JSON files, hit submit — secrets land in .hex/secrets/ with 600 perms…
Use when about to commit, push, or publish -- staged changes touch config or environment files, generated artifacts (relay sessions, logs, build output) are being added, or the…
Store, access, rotate, and audit secrets safely — provider selection (Vault, AWS Secrets Manager, GCP Secret Manager), runtime injection, rotation policy, least-privilege IAM,…
Secret lifecycle management with Vault, AWS Secrets Manager, and rotation automation. Activate on: secret management, HashiCorp Vault, AWS Secrets Manager, secret rotation, SOPS,…
HashiCorp Vault, cloud secret managers, rotation strategies, and zero-trust secret access
Manage API keys securely via GNOME Keyring and inject them into OpenClaw config.
30+ service-specific secret detection regex patterns, entropy-based detection, PEM/JWT/Base64 identification, and false positive filtering.
Spin up a one-time web UI for securely entering secret keys and env vars. Supports guided instructions, single-key mode, and cloudflared tunneling.
Redact secrets and PII before sending text to an AI or committing. Use when pasting logs, env files, traces, or screenshots text, or Chinese "脱敏", "密钥", "token", "别把密码给 AI",…
Audit and rotate API keys, tokens, and secrets with expiry tracking and safe handling.