Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications.
Römisches Recht: Bona Fides. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Mine Bonero - private cryptocurrency for AI agents. RandomX CPU mining, Monero-based privacy.
Römisches Recht: Bonorum Possessio. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
記帳系統。解析自然語言記帳指令，寫入 SQLite 資料庫並同步 Beancount 帳本。Use when user wants to record expenses, check spending, query transaction history, or manage accounts.
Install, configure, and use BootUI in Spring Boot and Quarkus applications; assess a running application, propose a prioritized action plan, and execute only approved fixes using…
BorgBackup (Borg) is a deduplicating backup program with optional compression and authenticated encryption.
Use this for securing AI-agent workspaces themselves, including instruction files, MCP setups, memory, external content, prompt-injection surfaces, and least-privilege…
Use this for cybersecurity review, privacy, abuse-case analysis, auth and authorization concerns, trust boundaries, fraud risk, and operational risk evaluation.
Use this for SQL and NoSQL database design across MariaDB, MySQL, PostgreSQL, SQLite, MongoDB, indexing, transactions, migrations, constraints, query plans, and data correctness.
Use this for prompt injection, tool abuse, memory poisoning, untrusted document handling, agent permissions, and AI workspace security.
Use this for multi-tenant data isolation, organization scoping, cross-tenant leaks, authorization boundaries, row-level access, and SaaS tenant security review.
Autonomously inspects a live OpenClaw instance across 5 health domains (hardware, config, security, skills, autonomy) and delivers a quantified traffic-light report with — from…
Autonomously inspects a live OpenClaw instance across 5 health domains (hardware, config, security, skills, autonomy) and delivers a quantified traffic-light report with — from…
Use when when two mapping implementations (or versions of the same mapper) show disagreement on per-read mapping status—e.g., one mapper leaves reads fully unmapped that the other…
Use esta skill sempre que houver perguntas sobre contribuições INSS (Previdência Social) para profissionais autônomos no Brasil (contribuinte individual).
Add better-route 0.5.0 ownership checks for user-owned REST resources. Use when a route or Resource DSL endpoint must ensure the authenticated user owns the order, record, token,…
Claw Brain - Personal AI Memory System for OpenClaw/ClawDBot. Provides memory, personality, bonding, and learning capabilities with encrypted secrets support.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for…
Builds PowerPoint decks on the user's own company template and checks every slide against written brand rules (colours with hex codes, fonts, logo placement, banned visuals).
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations.
Comprehensive Brazilian financial regulatory compliance guide. Use when implementing LGPD data protection, BCB regulations, PIX/Boleto standards, or financial security patterns…
Red team engineering agent. Designs attack scenarios, builds threat models, applies MITRE ATT&CK/OWASP frameworks, runs Purple Team exercises, and performs AI/LLM red teaming.
Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring.
Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and…
Summarizes cybersecurity breach incidents into structured legal and compliance records. Trigger when synthesizing incident reports, forensics, logs, or notifications into a…
PFLICHT vor jeder externen Aktion. Wird automatisch geladen wenn ein Agent mit externen Services interagiert, Browser-Aktionen durchfuehrt, Accounts verwaltet, APIs aufruft,…
Brief a subagent with task context + constraints, then verify comprehension via drill before delegating real work.
Daily news briefing generator — produces a conversational radio-host-style audio briefing + DOCX document covering weather, X/Twitter trends, web trends, world news, politics,…
Bright Security integration. Manage data, records, and automate workflows. Use when the user wants to interact with Bright Security data.
Apply Bright Data security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Bright Data security…
Banking interface for AI bots and automation. Get a bank account, issue a Mastercard, buy and sell crypto, send payments and invoices — all via API.
Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to…
Store credentials once, then inject them into outbound agent requests at runtime so agents can call services without receiving raw secrets.
Alpaca broker limitations: crypto shorts blocked (broker doesn't support), stock shorts allowed. Trigger when: (1) shorting gate blocks wrong assets, (2) SELL signals blocked, (3)…
Reverse-engineer an existing project to produce a Design Doc, API contracts, and a Threat Model anchored in the real code, IaC, and observability. Run once per project.
Index local coding-agent sessions into a searchable SQLite-backed view so you can inspect usage, compare failures, and recover prior context quickly.
Run the pre-flight checklist before an agent drives a browser — the untrusted-web-content threat (every page is attacker-controllable), the credential and session-cookie exposure,…
Use when building a client-side browser exploit — V8/JSC JIT type confusion to renderer R/W, V8 heap-sandbox escape, renderer-to-browser sandbox escape (Mojo IPC, GPU/Dawn/ANGLE),…
Browser extension development with security and cross-browser support. Use when: - Building Chrome, Firefox, or Safari extensions - Requesting permissions in manifest -…
Analyze web browser artifacts for forensic investigation. Use when investigating user browsing activity, downloaded files, cached content, or web-based attacks.
Use when you need to run a web application locally (by opening index.html directly in the browser) and the application uses WebWorker or WebAssembly modules that fail to load with…
Decide where a web app keeps tokens and state by reasoning about the XSS blast radius of each store, not by convenience.
Prüft Cloudanbieter und SaaS nach BSI C5 und NIS-2-Lieferkette im Nis2 Cybersecurity Compliance.
Führt Schutzbedarfsfeststellung und Grundschutz-Bausteine praxisnah zusammen im Nis2 Cybersecurity Compliance.
Bereitet Meldungen an BSI und parallele Stellen vor im Nis2 Cybersecurity Compliance.
Führt Registrierung und Kontaktdaten beim BSI sauber durch im Nis2 Cybersecurity Compliance.
Real-time Bitcoin trading intelligence API providing market data, AI trade signals, derivatives flow, liquidation heatmaps, live crypto news, economic calendar, historical OHLCV,…
SAP BTP enterprise architecture best practices — runtime selection (CF vs Kyma), CAP project setup, MTA structure, XSUAA security, destination management, resilience patterns,…
Monthly QFX merge workflow — identifies bank statements, generates an inspection report, iterates on categorization rule patches, and writes an encrypted budget snapshot.
Parse-job handler for the dispatch chain — runs budget-etl from a statement parse-job issue (filed by dispatch-statements-scan), report-first to detect uncategorized transactions,…
Römisches Recht: Buergschaft Und Sicherheiten. Geführter Fachmodul mit Quellenlogik, Prüfroutine, Red-Team-Fragen und verwertbarem Output.
Comprehensive bug audit for Node.js web projects. Activate when user asks to audit, review, check bugs, find vulnerabilities, or do security/quality review on a project.
Bug bounty program management and security disclosure expertise for smart contracts. Covers program setup on Immunefi, vulnerability triage, responsible disclosure coordination,…
Target-agnostic bug bounty hunting methodology with parallel recon, systematic testing workflows, and vulnerability-specific exploitation guidance
Chain multiple low-severity bugs into critical impact for maximum bounty payouts. Use when combining vulnerabilities,
Converts a confirmed bug bounty finding — raw notes, a request/response, or a PoC — into a complete, triage-ready report with clear description, numbered reproduction steps,…
Activates for any bug bounty, penetration testing, or vulnerability research request. Triggers on: "start recon on [target]", "check for IDOR/SSRF/XSS on [endpoint]", "map attack…
Adversarial code auditor that hunts down bugs, logic errors, and security flaws. Use for deep correctness passes, not style reviews.
Builds tamper-evident audit logging — structured actor/action/target/result records for security-relevant events, append-only hash-chained or WORM/object-lock storage, PII-safe…