Workflow полного health check проекта. Architecture → Security → Quality → Report → (Fix). Use before major release or onboarding.
Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features.
AWS compliance evidence collection for auditclaw-grc. 15 read-only checks across S3, IAM, CloudTrail, VPC, KMS, EC2, RDS, Lambda, EBS, SQS, SNS, Secrets Manager, Config,…
GCP compliance evidence collection for auditclaw-grc. 12 read-only checks across Cloud Storage, firewall, IAM, logging, KMS, DNS, BigQuery, Compute, and Cloud SQL.
GitHub compliance evidence collection for auditclaw-grc. 9 read-only checks covering branch protection, secret scanning, 2FA, Dependabot, deploy keys, audit logs, webhooks,…
AI-native GRC (Governance, Risk, and Compliance) for OpenClaw. 97 actions across 13 frameworks including SOC 2, ISO 27001, HIPAA, GDPR, NIST CSF, PCI DSS, CIS Controls, CMMC,…
Use before a repository's first push, when adding a remote, when making a repo public, or when auditing an existing repo that may already carry private data — personal paths, real…
Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization.
Use right after `board-superpowers:classifying-actions` returns a decision, every time a board-superpowers skill is recording what it is about to do or what it just did.
Screens transaction data for suspicious patterns using red flag typologies and structures SAR narrative elements.
Use when targeting 《审计与经济研究》(Auditing and Economics Research — 南京审计大学主办、专家匿名审稿、不收审稿费/版面费的审计经济双月刊) or deciding whether a Chinese auditing/accounting/econ manuscript fits this…
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs,
Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies,
Audits a self-hosted CockroachDB cluster against the CIS CockroachDB Benchmark v1.0.0 Level 1 controls.
Audits the security posture of a CockroachDB cluster (Cloud or self-hosted) across network, authentication, authorization, encryption, audit logging, and backup dimensions.
Audit code against OWASP Top 10 vulnerabilities with structured findings. Use when reviewing code for security issues or conducting security audits.
Reviews coded encounters for accuracy using OIG compliance guidelines and CMS documentation requirements.
Auditing and updating npm dependencies to prevent security vulnerabilities in TypeScript projects
Use when reviewing a Dependabot (or similar) dependency-bump PR — npm/pnpm minor/patch group bumps or GitHub Actions SHA bumps — and you need to do a supply-chain audit before…
Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions.
Run Microsoft Entra ID tenant reconnaissance, token acquisition and manipulation, and federation backdoor testing with the AADInternals PowerShell toolkit to validate…
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations.
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based…
Auditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage,
Conducts HIPAA compliance assessments with Privacy Rule, Security Rule, and Breach Notification analysis.
Audits the fit between a model's reasoning capability and the complexity of the context it receives. Use when an AI system is underperforming despite good retrieval, when teams…
Audit shipping iOS download, install, binary, and resource size. Use proactively for release-size regressions or bloat investigations; not routine simulator build sizing.
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous
Find over-permissive RBAC roles and service-account token abuse paths in Kubernetes using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess during authorized cluster…
Use whenever the user asks to 严格审稿、找茬、漏洞审计、pre-submission sanity…
Scan Model Context Protocol servers and tool metadata for poisoning, SSRF, and unauthenticated exposure.
Runs KiCad DRC/ERC checks, exports gerbers and BOM, and generates a structured findings report. Use when reviewing PCB designs, running design rule checks, or preparing…
Audits notification permission request flows. Use when reviewing or improving permission prompts, settings paths, or denial handling.
Audits the project for consistency issues that may arise from manual editing. Checks package scripts, tsconfig paths, README tables, and other conventions.
Audit README.md files against best practices for repos, accounts, or orgs. Detects missing sections, stale links, inconsistent formatting, and convention violations.
Use when targeting 《审计研究》(Auditing Research — 审计署主管、中国审计学会主办、匿名审稿、不收版面费的审计权威核心双月刊) or deciding whether a Chinese auditing manuscript fits this venue.
Use when reviewing website copy, SEO titles/descriptions, marketing content, or public messaging - applies Anil Dash's shareability framework to ensure others can authentically…
Canonical home for utilities shared across the auditing-* skill families (auditing-cc-configs, auditing-skills, auditing-subagents, auditing-context-files, and — as of ADR-0042 in…
Audits optimizer table statistics for staleness, missing coverage, and data quality issues using SHOW STATISTICS.
Use when running a technical SEO audit, debugging Core Web Vitals regressions, checking indexability, validating schema and sitemaps, diagnosing why a site isn't ranking, or…
Auditing Terraform infrastructure-as-code for security misconfigurations using Checkov, tfsec, Terrascan, and
Monitors Certificate Transparency (CT) logs to detect unauthorized certificate issuance, discover subdomains
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI…
Use when checking if beads-superpowers is outdated, before a plugin release, or when auditing for missing capabilities — covers upstream drift, test execution, documentation,…
Audit wallet security by analyzing token approvals, permissions, and transaction patterns. Use when checking wallet security, reviewing approvals, or assessing risk exposure.
Audit the health of a PostHog project's data warehouse sources and syncs — find every broken or degraded source connection, sync schema, and webhook channel.
Audit the health of a PostHog project's materialized views (saved queries) — find every failed materialization and flag unused or stale materialized views that cost storage and…
Audits website accessibility for WCAG 2.1 AA compliance, generating findings and code fixes. Use when reviewing accessibility, keyboard navigation, screen reader compatibility, or…
Audits a site's SEO and AI-search (GEO) readiness — meta tags, Open Graph/Twitter, JSON-LD, robots/llms conventions — and generates fixes.
Audits website usability for UX optimization, covering forms, navigation, validation, and microcopy. Use when reviewing user experience, task completion flows, or interface…
Generate and administer interactive knowledge quizzes for security auditors based on repository documentation and code.
Audyt pluginu PKM Assistant metodą gauntlet - szukacze i obalacze ze świeżym kontekstem, pętla do zbieżności, jeden format znalezisk.
Wirtschaftsprüfer: aufbewahrung prüfungsakte - Rechtsprechungscheck, stärkste Gegenansicht und Red-Team-Korrektur; mit Live-Normencheck, Kammerlogik, Verhältnismäßigkeit,…
Aufklaerung, Nachforderung und Angebotsaufklaerung steuern: fehlende Unterlagen, unklare Preise, ungewoehnlich niedrige Angebote, Gleichbehandlung und Grenzen der Nachbesserung:…
Bei tragfähigen Niedrigpreisindizien Aufklärung nach Paragraf 60 VgV einleiten. Abstand, Schätzung, Marktpreise und Leistungspflichten fallbezogen würdigen; keine starre…
BaFin-Beschwerde gegen Bank bei verweigerter Rueckbuchung: § 4 Abs. 4 FinDAG, BaFin-Verbraucherbeschwerde.
AG/SE-Aufsichtsrat Praxis: Aufsichtsrat NIS2 Cybersecurity; konkretisierter Spezialmodul mit Prüfachsen, Red Flags, Varianten, Quellenhygiene und verwertbarem Output im…
Begleitet BSI-Aufsichtsverfahren und Nachweisverlangen im Nis2 Cybersecurity Compliance.
Römisches Recht: Auftrag Mandatum. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Scan AI agent skills for malware, credential theft, prompt injection, and dangerous permissions before installing them