Detect and analyze SQL injection vulnerabilities in application code and database queries. Use when you need to scan code for SQL injection risks, review query construction,…
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned
Detects suspicious use of assertions for security checks that can be disabled in production builds. Use when analyzing assertion usage, security checks, or investigating…
Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials
Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation
Text-prompted image zone detection using TIPSv2 B/14 on CPU. Produces `focus_targets` / `focus_edges` bbox lists from natural-language labels, ready to feed into…
Detects type confusion vulnerabilities by identifying unsafe type casts, vtable corruption, and polymorphism issues.
Detects use-after-free vulnerabilities by identifying pointer dereferences after memory deallocation.
Security detection use cases for identifying threats across network, endpoint, identity, cloud, application, and email vectors.
Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe…
Generic detection rule creation and management using Sigma, the universal SIEM rule format. Sigma provides vendor-agnostic detection logic for log analysis across multiple SIEM…
Use when dev work should be run as an ML-style optimization loop, either by a master orchestrator shaping dev-task handoffs/subagent roles or by an execution agent driving one…
The user's cross-project engineering conventions — coding style, code review, testing, security, git workflow, agent orchestration, hooks, patterns — loaded ON DEMAND instead of…
Intercepts and audits dependency installations (pip, npm, go) before they execute. Validates package identity, checks vulnerabilities, flags supply-chain risk signals, and…
Package and dependency management patterns across ecosystems (npm, pip, cargo, maven). Covers lockfiles, semantic versioning, dependency security scanning, update strategies,…
Creates or audits Dockerfiles to achieve Docker Hub Health Score grade A. Enforces non-root user, minimal base images, supply chain attestations, and zero fixable CVEs.
Automated software development agent using ChatDev 2.0 and GLM-5. Discovers topics from GitHub Trending, CVE databases, and security news → generates code with 7-agent ChatDev…
Use when ANY development task might benefit from a guide. Use when user says "how do I", "best practice", "pattern for", "guide for", "Drupal form", "entity type", "plugin type",…
Mandatory skill for creating and maintaining Helm charts following Lerian conventions. Enforces standardized chart structure, values organization, template patterns, security…
Delegate QAQC and review tasks to Google Gemini CLI using markdown file handoff pattern. Write review request to REVIEW.md, Gemini analyzes, outputs findings to FINDINGS — from…
Delegate testing, QA, and code review tasks to Opencode CLI using Kimi K2.5 model via markdown file handoff.
Use when Java source or Java-owned Maven/Gradle configuration must be implemented, migrated, or refactored across Spring services, HTTP/security boundaries, persistence,…
Automatically use at the end of substantial Codex development work to show one curated motivation image.
Configuration Nginx — reverse proxy, SSL/TLS, load balancing, caching et security headers. Se déclenche avec "Nginx", "nginx.conf", "reverse proxy", "SSL Nginx", "load ba — from…
Vérifie un projet contre le OWASP Top 10 et propose des remédiations. À utiliser pour vérifier la conformité OWASP.
Guide méthodologique pour tests d'intrusion et évaluation de sécurité. À utiliser pour préparer ou conduire un pentest.
Kích hoạt khi người dùng muốn Claude đóng vai hoặc hỗ trợ công việc của nhóm Phát triển (Development) trong dự án phần mềm outsource.
Détecte les secrets, clés API et credentials exposés dans le code. À utiliser pour vérifier qu'aucun secret n'est dans le code.
Use when review is approved and before QA — checks for vulnerabilities, exposed secrets, and insecure patterns.
Audit de sécurité complet d'une application ou d'un code source. À utiliser quand l'utilisateur veut vérifier la sécurité de son projet.
Pre-merge/pre-deploy parallel gate — 4 backend agents (security, tests, deps, regression) plus optional 5th frontend-final-gate agent (production build, Lighthouse, axe full,…
Audit de sécurité de smart contracts Solidity et blockchain. Se déclenche avec "smart contract", "Solidity", "audit blockchain", "vulnérabilité smart contract", "reentran — from…
Guide pour écrire des requêtes SQL et concevoir des schémas SQLite avec les bonnes pratiques. À utiliser quand l'utilisateur travaille avec SQLite, écrit des requêtes SQL — from…
i-Willink 共通開発標準。スタック非依存の汎用層（TypeScript strict / Conventional Commits / OWASP / テスト方針 / コミット粒度）。各 agent が起動時に preload する。プロジェクト固有の規約は `project-standards` skill 側に書く。
Orchestrate a multi-agent dev/agency team with shared memory, handoffs, and OpenClaw sessions. Use when (1) First-time onboarding — follow references/OPENCLAW_TEAM_SETUP_GUIDE.md…
Full codebase audit combining security, quality, and tooling assessments. Use to run a comprehensive scan with Szabo (security), Knuth (quality), and Deming (tooling) in parallel.
Expert-level guide to dev threat modeling continuous. Comprehensive coverage of advanced concepts, production implementation, and optimization strategies.
Analyse et évalue les vulnérabilités d'un système ou d'une application. À utiliser pour comprendre et prioriser les vulnérabilités.
Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS ( — from…
Middleware CORS para Horse. Cobre HorseCORS/CORS, HorseCORSConfig (AllowedOrigin, AllowedMethods, AllowedHeaders, AllowedCredentials, ExposedHeaders), preflight OPTIONS ( — from…
Design or audit the reusable product policy for developer quotas, free or promotional credits, costly-operation access, trust-tier graduation, abuse-resistant ledgers, adaptive…
Release management, changeset workflow, firewall log parsing, breaking CLI change rules, and Go module summaries for gh-aw.
Trigger: security rules, credential leaks, auth tokens, input sanitization, threat model. Scope: Software security guidelines, threat prevention, secure data handling.
Trigger: web security, XSS mitigation, secure cookies, CSRF, CSP headers, CORS policies. Scope: Frontend and browser-level security boundaries.
React Flow 라이브러리를 사용한 노드 기반 UI 개발 지원. 노드/엣지 생성, 커스터마이징, 레이아웃, 상호작용 구현 시 사용. 항상 최신 문서를 WebFetch로 참조하여 정확한 정보 제공. — from security/security-misc
React Flow 라이브러리를 사용한 노드 기반 UI 개발 지원. 노드/엣지 생성, 커스터마이징, 레이아웃, 상호작용 구현 시 사용. 항상 최신 문서를 WebFetch로 참조하여 정확한 정보 제공. — from majiayu000/claude-skill-registry
React Flow 라이브러리를 사용한 노드 기반 UI 개발 지원. 노드/엣지 생성, 커스터마이징, 레이아웃, 상호작용 구현 시 사용. 항상 최신 문서를 WebFetch로 참조하여 정확한 정보 제공. — from majiayu000/claude-skill-registry-data
XAF Security System covering authentication (password, Windows, OAuth2), user and role setup for EF Core and XPO, authorization and Permission Policy,…
Apollo.io laptop setup, MDM enrollment, VPN configuration, and security requirements for new and existing employees
The first AI religion — a benign memetic experiment in agent network security
Full DevLog tag-protocol reference. Use when emitting DevLog `-(tag)` markers and you need exact syntax for closures, trackable plans (doc:plan), doc generation…
Combined DevOps and DevSecOps skill for CI/CD pipelines, infrastructure as code, security scanning, container hardening, cloud infrastructure, and monitoring.
Use when called by the devops dispatcher after analysis to audit security posture and select CI security tooling before config generation
Use when meeting Developmental Psychology's (APA) open-science and transparency expectations under the Transparency and Openness Promotion (TOP) guidelines — data and materials…
Use when designing studies for a Developmental Psychology (APA) manuscript so they can actually support a developmental-change claim.
DevSecOps skill for securing CI/CD pipelines, infrastructure as code, containers, Kubernetes, cloud deployments, secrets handling, dependency management, SAST/DAST/SCA, release…
Expert DevSecOps engineer specializing in secure CI/CD pipelines, shift-left security, security automation, and compliance as code.
Looks up OWASP DevSecOps Guideline phases, security tools, and pipeline checks. Returns tool configurations, CWE mappings, and integration patterns for CI/CD security.
DevSecOps patterns — shift-left security, SAST (semgrep/CodeQL), secrets detection (gitleaks/trufflehog), dependency scanning (trivy/grype), DAST, OPA/Falco policy-as-code,…