PAI (Personal AI Infrastructure) - Your AI system core. AUTO-LOADS at session start. USE WHEN any session begins OR user asks about PAI identity, response format, stack…
Real-time crypto risk intelligence; before and as things break. Two tools: Flare (15-min precursor detection, immediate alarms) and Core (60-min state synthesis, context…
Put an inline firewall and containment layer in front of agent network traffic, tool calls, and MCP traffic before you trust an agent with local secrets.
Scan staged changes, commits, or repositories for secrets before they leave the workstation or CI job, instead of relying on a later platform-side catch.
Master blockchain fundamentals including consensus, cryptography, and distributed systems
Blockchain analysis, cryptocurrency tracing, wallet investigation, and transaction tracking. Use when the user mentions: blockchain, cryptocurrency, bitcoin, ethereum, wallet…
Use when building DeFi protocols, implementing AMMs, yield farming strategies, or integrating with Ethereum/L2s - covers smart contract patterns, liquidity pools, and security…
Use when a task needs the judgment of a Blockchain Engineer — applying the checks-effects-interactions pattern to prevent a reentrancy exploit, auditing a…
Expert blockchain forensics assistant for investigators and auditors. Covers the full investigation methodology: threat recognition, incident scoping, data collection, transaction…
Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address…
Expert smart contract security auditor specializing in vulnerability detection, formal verification, exploit analysis, and comprehensive audit report writing for DeFi protocols…
Solidity smart contracts, Web3 development, DeFi protocols, NFTs, EVM chains, Hardhat/Foundry tooling, and blockchain security.
Shared reference for the blockchain-web3 cluster: the adversarial on-chain threat model (immutable, anyone-can-call, MEV), checks-effects-interactions, oracle-manipulation…
Route a blockchain/web3 task to the right specialist among six — Solidity AMM security, autonomous trading-agent security, EVM token-decimal correctness, Node Keccak-256 hashing,…
Blockscout MCP tool reference for on-chain data queries. Covers all 16 tools: address info, transactions, token transfers, NFTs, contract ABI/source, read-only calls, ENS…
Defensive response to red team security findings — analyze each vulnerability, propose a targeted fix, and add a test that covers the fix.
Security OS for autonomous agents and builders on Base. 31 pay-per-use tools across Quantum Security, Agent Safety, Research, Data, and Earn.
Unified story creation and enrichment engine (story-spec v2). Produces implementation-ready stories with real-data confrontation (provider/DB/cloud), external research…
Assesses Non-Functional Requirements (security, performance, reliability, maintainability, observability) with evidence-based codebase analysis.
Orchestriert den kompletten BMAD-Entwicklungszyklus als automatische Pipeline: bmad-create-story → bmad-testarch-atdd → bmad-dev-story → bmad-testarch-test-review →…
Assess NFRs like performance security and reliability. Use when the user says "lets assess NFRs" or "I want to evaluate non-functional requirements
Assemble the quarterly security board pack or audit-committee pack from the section objects the other skills produce, and output it as a print-ready document and an editable…
Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications.
Römisches Recht: Bona Fides. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Mine Bonero - private cryptocurrency for AI agents. RandomX CPU mining, Monero-based privacy.
Römisches Recht: Bonorum Possessio. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
記帳系統。解析自然語言記帳指令，寫入 SQLite 資料庫並同步 Beancount 帳本。Use when user wants to record expenses, check spending, query transaction history, or manage accounts.
BorgBackup (Borg) is a deduplicating backup program with optional compression and authenticated encryption.
Use this for securing AI-agent workspaces themselves, including instruction files, MCP setups, memory, external content, prompt-injection surfaces, and least-privilege…
Use this for cybersecurity review, privacy, abuse-case analysis, auth and authorization concerns, trust boundaries, fraud risk, and operational risk evaluation.
Use this for SQL and NoSQL database design across MariaDB, MySQL, PostgreSQL, SQLite, MongoDB, indexing, transactions, migrations, constraints, query plans, and data correctness.
Use this for prompt injection, tool abuse, memory poisoning, untrusted document handling, agent permissions, and AI workspace security.
Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.
Autonomously inspects a live OpenClaw instance across 5 health domains (hardware, config, security, skills, autonomy) and delivers a quantified traffic-light report with…
Use when when two mapping implementations (or versions of the same mapper) show disagreement on per-read mapping status—e.g., one mapper leaves reads fully unmapped that the other…
Use esta skill sempre que houver perguntas sobre contribuições INSS (Previdência Social) para profissionais autônomos no Brasil (contribuinte individual).
Add better-route 0.5.0 ownership checks for user-owned REST resources. Use when a route or Resource DSL endpoint must ensure the authenticated user owns the order, record, token,…
Claw Brain - Personal AI Memory System for OpenClaw/ClawDBot. Provides memory, personality, bonding, and learning capabilities with encrypted secrets support.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for…
Builds PowerPoint decks on the user's own company template and checks every slide against written brand rules (colours with hex codes, fonts, logo placement, banned visuals).
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations.
Comprehensive Brazilian financial regulatory compliance guide. Use when implementing LGPD data protection, BCB regulations, PIX/Boleto standards, or financial security patterns…
Red team engineering agent. Designs attack scenarios, builds threat models, applies MITRE ATT&CK/OWASP frameworks, runs Purple Team exercises, and performs AI/LLM red teaming.
Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring.
Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and…
Summarizes cybersecurity breach incidents into structured legal and compliance records. Trigger when synthesizing incident reports, forensics, logs, or notifications into a…
PFLICHT vor jeder externen Aktion. Wird automatisch geladen wenn ein Agent mit externen Services interagiert, Browser-Aktionen durchfuehrt, Accounts verwaltet, APIs aufruft,…
Brief a subagent with task context + constraints, then verify comprehension via drill before delegating real work.
Daily news briefing generator — produces a conversational radio-host-style audio briefing + DOCX document covering weather, X/Twitter trends, web trends, world news, politics,…
Bright Security integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bright Security data.
Apply Bright Data security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Bright Data security…
Banking interface for AI bots and automation. Get a bank account, issue a Mastercard, buy and sell crypto, send payments and invoices — all via API.
Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to…
Store credentials once, then inject them into outbound agent requests at runtime so agents can call services without receiving raw secrets.
Alpaca broker limitations: crypto shorts blocked (broker doesn't support), stock shorts allowed. Trigger when: (1) shorting gate blocks wrong assets, (2) SELL signals blocked, (3)…
Index local coding-agent sessions into a searchable SQLite-backed view so you can inspect usage, compare failures, and recover prior context quickly.
Run the pre-flight checklist before an agent drives a browser — the untrusted-web-content threat (every page is attacker-controllable), the credential and session-cookie exposure,…
Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE),…
Browser extension development with security and cross-browser support. Use when: - Building Chrome, Firefox, or Safari extensions - Requesting permissions in manifest -…
Analyze web browser artifacts for forensic investigation. Use when investigating user browsing activity, downloaded files, cached content, or web-based attacks.