QA opencode itself, per case: verify the CLI/terminal (opencode run, db, serve, export), prove a specific plugin hook/action/event fired via the SSE event stream, smoke-test the…
Scenario-first whitebox security vulnerability research using the OpenHack methodology (Hadrian Security).
Comprehensive operational skill specification for Anthropic Claude to automate, script, troubleshoot, and optimize OsiriX MD, PACS DICOM networking (C-STORE/C-FIND/C-MOVE — from…
OWASP Open Source Software Top 10 vulnerability knowledge base for identifying, assessing, and remediating security risks in open source software dependencies.
Authenticates to Microsoft Graph API using MSAL with Mail.ReadWrite and Calendars.ReadWrite permissions.
Systematic audit against the OWASP 2021 Top 10 web application security risks with severity-rated, file-level findings.
OWASP API Security Top 10 testing patterns, injection payloads, auth bypass vectors, and security test generation for REST APIs.
Assess a REST or GraphQL API against the OWASP API Security Top 10 (2023), producing a per-category finding set with severity and remediation.
OWASP Top 10 for Agentic Applications 2026 (ASI) classification framework. Use for mapping security findings to standardized risk categories.
Operational skill for OWASP ASVS: selecting levels, mapping requirements to controls, evidence for reviews, and gap triage.
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security…
Runs an OWASP ASVS/MASVS + BSI IT-Grundschutz security compliance audit (plus curated NIST SSDF/SLSA subsets) via orchestrated subagents, producing report.md/report.html and a fix…
Vérifie un projet contre le OWASP Top 10 et propose des remédiations. À utiliser pour vérifier la conformité OWASP.
OWASP Top 10 for LLM applications — full checklist for AI agent systems. Prompt injection, insecure output, training data poisoning, DoS, supply chain, sensitive info disclosure,…
Use when performing security audits, vulnerability assessments, or compliance checks on Flutter or mobile applications.
OWASP Top 10 (2021) and API Top 10 (2023) quick reference with attack patterns, test ideas, and CWE mappings.
Look up and map to the right OWASP Top 10 family — Web, API, LLM, or Mobile — and give the canonical category ID/name for a finding.
Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web application security.
Provides comprehensive security standards and checklists based on OWASP Top 10:2025. Includes language-specific secure coding patterns for 20+ languages, guidance on Agentic AI…
Revisa o endurece una aplicación web de frontend (React, Next.js, SPA) frente al OWASP Top 10 y a los riesgos propios del navegador.
Automated OWASP Top 10 vulnerability detection and assessment. Run OWASP ZAP automated scans, detect injection vulnerabilities, identify broken authentication patterns, check for…
Незаблокирующая проверка по OWASP Top 10 2025 при реализации. Используй для: безопасность, проверь авторизацию, права доступа, секреты, инъекции, XSS, SSRF, цепочка поставок,…
Theoretical mechanics of critical web vulnerabilities, static analysis, and secure architecture remediation.
Assess a web application against the OWASP Top 10 (2021), producing a per-category finding set with severity and remediation.
Runs OWASP ZAP active security scans via the ZAP API daemon with custom scan policies. Generates SARIF reports compatible with GitHub Advanced Security code scanning alerts.
Automates REST API security testing using the OWASP ZAP Python SDK. Runs active scans, SQL injection probes, and XSS tests against OpenAPI specs with structured vulnerability…
Orchestrates OWASP ZAP active and passive scans against REST and GraphQL endpoints using ZAP's Python API client.
Automates OWASP ZAP scans against REST APIs using the ZAP Python API client. Imports OpenAPI/Swagger specs for targeted scanning and generates SARIF-format reports for GitHub…
Runs automated DAST scans against REST and GraphQL APIs using OWASP ZAP daemon API. Detects injection flaws, broken auth, and CORS misconfigurations with detailed remediation…
Runs automated penetration tests using OWASP ZAP API with spider crawling, active scanning, and AJAX-aware testing.
Runs OWASP ZAP active and passive scans against target URLs using the ZAP Docker API. Parses JSON reports to flag XSS, SQLi, and CSRF vulnerabilities with severity scoring.
Orchestrates OWASP ZAP active and passive scans via the ZAP API, automating spider crawls, AJAX spidering with Selenium, and generating SARIF-format vulnerability reports.
OWASP ZAP Scanner is built around OWASP security tooling ecosystem. The underlying ecosystem is represented by zaproxy/zaproxy (14,896+ GitHub stars).
Integrates the OWASP ZAP API to run automated DAST scans against web applications. Parses ZAP JSON reports, triages alerts by CVSS severity, and generates remediation tickets via…
Deep integration with OWASP ZAP for automated security scanning, vulnerability detection, and API security testing.
Wraps OWASP ZAP API for automated web application security testing including active scan, spider crawl, and ajax spider endpoints.
Automates OWASP ZAP active and passive scanning against web applications, parsing alerts into structured vulnerability reports.
Security best practices and threat mitigation patterns for PACT framework development. Use when: implementing authentication or authorization, handling API credentials,…
Local, crash-safe persistent memory for OpenClaw agents. SQLite-backed by default. Semantic search, projects, scopes, auto-capture.
Create a dashboard panel component using vanilla TypeScript DOM API, following the worldmonitor Panel architecture.
Paper 插件的 SQLite 持久化：單一連線（WAL、busy_timeout、foreign_keys）、PRAGMA user_version 遷移、Repository 介面與 PreparedStatement 實作、單一寫入執行緒的 write-behind、onDisable 同步落盤 / SQLite persistence for…
Isolated agent runtime for code execution, live preview URLs, browser automation, 50+ tools (ffmpeg, sqlite, pandoc, imagemagick), LLM inference, and persistent memory — all via…
Detect path traversal and Zip Slip vulnerabilities where user-controlled path components can escape intended directories.
Path Traversal Finder - Auto-activating skill for Security Fundamentals. Triggers on: path traversal finder, path traversal finder Part of the Security Fundamentals skill category.
Use when creating, changing, auditing, or reviewing PAW Forkd webapp controllers, forms, validators, JSP/JSTL views, i18n bundles, Spring Security routes, CSS/JS, uploads,…
Uses Postman to perform structured API security testing by building collections that test for OWASP API Security
Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions,
Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting
Testing web applications for Cross-Site Request Forgery vulnerabilities by crafting forged requests that exploit
Assessing GraphQL API endpoints for introspection leaks, injection attacks, authorization flaws, and denial-of-service
Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and
Test automate security vulnerability testing covering OWASP Top 10, SQL injection, XSS, CSRF, and authentication issues.
Perform forensic analysis of SQLite databases to recover deleted records from freelists and WAL files, decode
Test for Server-Side Request Forgery vulnerabilities by probing cloud metadata endpoints, internal network services,
Use OWASP Threat Dragon to create data flow diagrams, identify threats using STRIDE and LINDDUN methodologies,
Bypass Web Application Firewall protections using encoding techniques, HTTP method manipulation, parameter pollution,
Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG)
Triage web application vulnerability findings from DAST/SAST scanners using OWASP risk rating methodology to
Execute web cache deception attacks by exploiting path normalization discrepancies between CDN caching layers
Exploiting web cache mechanisms to serve malicious content to other users by poisoning cached responses through