Read-only: reviews staff accounts for stale logins, inactive status, and overpermissioned roles to surface security and access hygiene issues.

Expert multi-AI code review with inline PR comments — use for thorough quality and security analysis

Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.

List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.

Initialize and manage the evidence collection directory for professional security audits with documented proof of findings.

Generate a comprehensive Markdown security audit report with executive summary, findings, and remediation guidance.

Compare two security audit reports to track remediation progress and identify new vulnerabilities.

Comprehensive security and correctness audit of a branch's changes. Use for thermo nuclear, thermonuclear, or deep review requests, or branch/PR diff audits focused on bugs, breaking changes, security issues, devex regressions, and feature-gate leaks.

When the user wants to add or optimize trust badges, "Trusted by" logos, security seals, or social proof elements. Also use when the user mentions "trust badges," "trusted by," "security badges," "payment logos," "social proof," "trust seals," "SSL badge," "customer logos," "as seen in," or "trust signals." For press logos, use press-coverage-page-generator.

Assists developers with understanding Tauri application lifecycle security threats spanning development, build, distribution, and runtime phases, including threat mitigation strategies and security best practices.

Operate Joel's Obsidian Vault through the joelclaw CLI. Use when reading ADRs/projects, searching notes, listing PARA sections, or auditing ADR hygiene with `vault adr` commands. Triggers on: 'check the vault', 'read ADR', 'find this note', 'vault search', 'ADR collisions', 'ADR audit', 'decision inventory', or any Vault command task.

Apply when reviewing or designing security-sensitive boundaries in VTEX IO apps. Covers public versus private exposure, trust assumptions at route and integration boundaries, sensitive data handling, validating what crosses the app boundary, and avoiding leakage across accounts, workspaces, users, or integrations. Use for route hardening, data exposure review, or evaluating whether a service boundary is too permissive.

Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), container security scanning, dependency vulnerability management, and common vulnerability tools (Snyk, Trivy, OWASP ZAP, SonarQube)

Weed the Allium garden. Find where Allium specifications and implementation code have diverged, and help resolve the divergences. Use when the user wants to check spec-code alignment, compare specs against implementation, audit for spec drift or violations, sync specs with code or code with specs, or verify whether the implementation matches what the spec says.

Investigate security incidents using Zscaler Z-Insights analytics. Correlates threat categories, cyber incident trends, firewall actions, web traffic patterns, and shadow IT data to build a comprehensive incident timeline. Use when a security analyst asks: 'What threats were detected?', 'Show me incident trends', 'Investigate this security event', or 'What shadow IT is being used?'

Audit animation code against Disney's 12 principles adapted for web. Use when reviewing motion, implementing animations, or checking animation quality. Outputs file:line findings.

WCAG 2.2 compliance auditing: automated scanning with axe-core, keyboard navigation testing, screen reader checks, and color contrast validation.

Generate comprehensive codebase analysis covering architecture, security, performance, and code quality. Use when user says 'analyze codebase', 'code audit', 'architecture review', or 'project health check'.

Audit a spreadsheet for formula accuracy, errors, and common mistakes. Scopes to a selected range, a single sheet, or the entire model (including financial-model integrity checks like BS balance, cash tie-out, and logic sanity). Triggers on "audit this sheet", "check my formulas", "find formula errors", "QA this spreadsheet", "sanity check this", "debug model", "model check", "model won't balance", "something's off in my model", "model review".

Security pattern for implementing authentication in software systems. Use when designing or reviewing authentication mechanisms, implementing login systems, verifying user identity, protecting system access, or addressing OWASP authentication flaws. Provides guidance on enforcers, verifiers, evidence providers, subject registration, credential management, and security considerations.

When the user wants to analyze backlinks, audit link profile, or identify link issues. Also use when the user mentions "backlink analysis," "backlink audit," "referring domains," "toxic links," "link profile," or "disavow file." For acquisition, use link-building.

6-aspect structured code review (security, architecture, error handling, test gaps, type safety, simplification) with calibrated scoring and per-aspect breakdown. Use when the user asks to review code, check a PR, review a pull request, audit changes before merge, or give code feedback.

Security anti-pattern for OS Command Injection vulnerabilities (CWE-78). Use when generating or reviewing code that executes shell commands, runs system processes, or handles user input in command-line operations. Detects shell string concatenation and recommends argument arrays.

Audit and harden your OpenClaw configuration. Checks AGENTS.md, gateway settings, sandbox config, and permission policies for security weaknesses.

Guides users through configuring Tauri capabilities for security and access control, covering capability files, permissions, per-window security boundaries, and platform-specific configurations.

Guides the user through configuring Tauri permissions, including the security permission system, allow and deny lists, plugin permissions, permission identifiers, scopes, and capability integration.

Stage N3. Deep structural analysis of skill against real usage. Verifies gaps, prunes cruft, measures baseline health. Produces structural audit that feeds REM. Front-loaded in early cycles.

When the user wants to create, optimize, or audit contact page and forms. Also use when the user mentions "contact page," "contact form," "get in touch," "support form," "contact us," "reach us," "contact information," "support contact," or "inquiry form." For sitewide page planning, use website-structure.

Cross-Site Request Forgery prevention techniques. Use this skill when implementing forms, state-changing operations, or reviewing CSRF protections. Activate when: CSRF, cross-site request forgery, form security, token validation, same-site cookie, state changing request, POST request security.

When the user wants to create, optimize, or audit customer stories or case study pages. Also use when the user mentions "case studies," "customer stories," "success stories," "testimonials page," "case study," "customer proof," "social proof page," or "results page." For testimonial components, use testimonials-generator.

OWASP A09 - Using Components with Known Vulnerabilities. Use this skill when auditing dependencies, updating packages, or reviewing security advisories. Activate when: npm audit, dependency check, vulnerable package, CVE, security advisory, outdated packages, supply chain, package vulnerability, Dependabot, Snyk.

Diagnose bugs, errors, and issues with root cause analysis. Use when asked to diagnose, debug, investigate, or find root cause of any problem — whether a wipnote bug ID, error message, unexpected behavior, or delegation audit.

Audit, restructure, and consolidate project documentation for clarity and maintainability. Use this skill when docs have grown organically and need reorganization, when duplicate content exists across files, or when documentation structure needs standardization.

Security pattern for implementing encryption and decryption operations. Use when encrypting data for confidentiality, selecting encryption algorithms (AES, RSA), configuring cipher modes (GCM, CBC), choosing key lengths, or implementing symmetric/asymmetric encryption. Specialization of Cryptographic action pattern addressing confidentiality requirements.

Check system setup health across 7 categories. Use for /harness-audit, "verify my setup", "check harness". NOT for project quality (/audit) or eval scoring (/eval-score).

Security anti-pattern for integer overflow vulnerabilities (CWE-190). Use when generating or reviewing code that performs arithmetic on user-controlled values, handles sizes/quantities, or calculates prices/amounts. Detects overflow in validated inputs.

Audits a local Claude-managed knowledge base in Simon's '/Users/simon/Claude CoWork/Knowledge Base/' system. Surfaces contradictions between articles, broken backlinks, unsourced claims, stale articles, writing-rules violations, and three suggested new articles. Files a full report into the KB's 'Outputs/' folder, appends a one-line CHANGELOG entry, and (in interactive sessions) walks through which findings to action. Use this skill whenever the user says "run a health check", "audit the [name] KB", "audit my knowledge base", "check the wiki", "let's go through the health check report", or "action the latest health check". Also use when the monthly scheduled task 'knowledge-base-monthly-health-check' fires. Use this skill for any audit-style request against a folder under 'Knowledge Base/' even if the user doesn't say the word "health check" - the protocol is the same.

Audit multilingual content consistency. Use when: checking language parity, regional compliance, or translation quality.

Security pattern for implementing Message Authentication Codes (MACs) to ensure data integrity and origin authentication. Use when implementing HMAC, CMAC, or other MAC algorithms, verifying message integrity, authenticating message origin with shared secrets, or when non-repudiation is NOT required. Specialization of Cryptographic action pattern.

Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Use when deploying OpenClaw in home labs, startups, or production-like local AI infrastructure.

Audit a Python package's metadata, verify tests pass, build distributions, test on TestPyPI, then publish to PyPI. Validates name, version, readme rendering, and dependency requirements. Handles credential setup and trusted publishers.

Security fix patterns for authentication and authorization vulnerabilities (credentials, JWT, deserialization, access control). Provides language-specific secure implementations.

When the user wants to create, optimize, or audit resources page or content hub. Also use when the user mentions "resources page," "resource center," "content hub," "learning center," "resource library," "downloads," "templates," "guides," or "resource hub." For content hub planning, use content-strategy.

Code review and security audit

This skill should be used when the user asks to "review implementation", "compare to plan", "check what was missed", "audit the implementation", "verify completeness", "quality check", or mentions "plan vs implementation", "did we miss anything", "stretch goals", "code quality audit". Reviews completed work against the original plan for completeness, quality, and thoroughness.

Critically review a hv (or any) PR for correctness, security, and codebase consistency, using adversarial verification rather than a rubber stamp. Use to review a feature's PR before merging, or whenever you want a high-confidence review of a pull request. Posts inline comments with --comment.

Process large codebases (>100 files) using the Recursive Language Model pattern. Orchestrates parallel sub-agents to map-reduce across files without context rot. Use when: analyzing large repositories; auditing security or auth across many files; finding patterns across 50+ files; processing large log files or data dumps

Health-check the wiki for contradictions, orphan pages, stale claims, and missing cross-references. Use when the user says "audit", "health check", "lint", "find problems", or wants to improve wiki quality.

HTTP security headers configuration guide. Use this skill when hardening web applications, configuring CSP, or setting up security headers. Activate when: security headers, CSP, Content-Security-Policy, HSTS, X-Frame-Options, CORS headers, clickjacking prevention, helmet.

Implements security headers and Content Security Policy with safe rollout strategy (report-only → enforce), testing, and compatibility checks. Use for "security headers", "CSP", "HTTP headers", or "XSS protection".

Validate security requirements and assess vulnerabilities across code, dependencies, infrastructure, and configuration, with OWASP/CWE compliance and STRIDE threat modeling. Use to security-review an SDD project or its implementation.

Quick configuration security check against known threats database

OWASP Top 10 vulnerability detection. Use PROACTIVELY for code handling user input, auth, APIs, payments, or sensitive data.

Read-only: lists orphan products (in zero collections) and over-collected products for catalog hygiene.

Read-only: shows which products are published to which sales channels and flags unpublished active products.

When the user wants to create, optimize, or audit a showcase or gallery page for user-generated content. Also use when the user mentions "showcase," "gallery," "user work," "UGC," "creator showcase," "examples," or "made with [product]." For social proof components, use testimonials-generator.

Trace codepaths in diffs, map against tests, auto-generate missing coverage — use before shipping PRs

URL validation and content sanitization for untrusted sources — use when handling external input safely

Security-first vetting for OpenClaw skills. Use before installing any skill from ClawHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

Interactive skills workflow for chaining multiple skills where the output of step i becomes the input of step i-1. Use when you need to: (1) Chain multiple skills together in a specific order, (2) Pass outputs between skills as inputs, (3) Execute complex multi-step workflows with traceability, (4) Run skills in dry-run mode before execution, (5) Debug or audit multi-skill workflows

Analyze a file or code snippet for quality and security issues using SonarQube

When the user wants to create, optimize, or audit a startups, education, or special program page. Also use when the user mentions "startups program," "for startups," "education discount," "student plan," "for students," or "special pricing." For education discounts, use education-program.

List all storage buckets and their configuration to identify the storage attack surface.

Pentest Android and iOS mobile applications including APK analysis, dynamic analysis, SSL pinning bypass, root/jailbreak detection bypass, and mobile-specific vulnerabilities. Use when testing mobile app security or performing mobile pentesting.

Creates comprehensive threat models using STRIDE methodology with asset identification, threat enumeration, mitigation strategies, and residual risk assessment. Use for "threat modeling", "security analysis", "STRIDE", or "risk assessment".

This skill should be used when the user asks to "triage security findings", "fix a Checkmarx finding", "review SonarCloud results", "dismiss a false positive", "check code scanning alerts", or needs to work with GitHub Advanced Security alerts, scanner annotations on PRs, or Grype vulnerability results.

Use when reviewing code with UBS for bugs, security issues, AI-generated quality, or pre-commit checks.

Display comprehensive worktree status including active worktrees, stale references, and uncommitted changes. Invoke with "/worktrees:status" or when user mentions "worktree status", "list worktrees", "check worktrees", "worktree health", or "audit worktrees".

Write cryptography prose and notation using the project's bibsp.sty + preamble.tex conventions (acro + biblatex footnote citations and standardized math macros). Use proactively when: (1) writing/editing cryptography sections in .tex files, (2) introducing or using crypto acronyms such as IND-CPA, IND-CCA, AE, MAC, PRF, ZK, and DH, (3) defining schemes/algorithms/variables in math notation, (4) adding citations for security notions or standard primitives, (5) writing security proofs or reductions, (6) user mentions biblatex, crypto notation, or security proof in cryptographic context.

Zig testing skill for writing and running tests. Use when using zig build test, writing comptime tests, using test filters, working with test allocators to detect leaks, or using Zig's built-in fuzz testing (0.14+). Activates on queries about Zig tests, zig test, zig build test, comptime testing, test allocators, Zig fuzz testing, or detecting memory leaks in Zig tests.

Bitwarden's security principles (P01-P06), security vocabulary, and data classification standards. Use when you need foundational security context for any Bitwarden development, review, or security task — such as understanding trust boundaries, data protection requirements, or Bitwarden-specific security terminology.

When the user wants to create, optimize, or audit a careers or jobs page. Also use when the user mentions "careers," "jobs," "hiring," "open positions," "company culture," "careers page," "job listings," "we're hiring," "join our team," or "recruitment page." For sitewide page planning, use website-structure.

Reviews code for bugs, security issues, performance problems, and adherence to best practices. Use when the user asks to "review this code", "check my code", "is this code good?", or before submitting a PR.

Review code changes between commits for security, logic, performance, and style issues

Perform structured code reviews focusing on correctness, readability, security, and maintainability. Use this skill when reviewing pull requests, evaluating code changes, or establishing review standards for a team.

Guides users through configuring Content Security Policy (CSP) in Tauri v2 applications to prevent XSS attacks and enhance security by restricting resource loading.

Guides developers through configuring HTTP headers security in Tauri v2 applications, covering security headers, custom headers, and CORS configuration for secure cross-origin resource handling.

Security pattern for managing cryptographic keys throughout their lifecycle. Use when integrating cryptography requiring key generation, storage, distribution, or usage. Provides guidance on key confidentiality, integrity, configuration protection, and key information handling. Foundation for Cryptography as a service and Self-managed cryptography patterns.

Verify DevOps/infrastructure code against best practices, security, simplicity, and documentation standards. Use after implementing or before shipping infrastructure changes.

When the user wants to create, optimize, or audit a feedback or roadmap page. Also use when the user mentions "feedback page," "roadmap," "feature requests," "vote on features," "Canny," "UserVoice," or "product feedback." For sitewide page planning, use website-structure.

Security anti-pattern for hallucinated (non-existent) packages (CWE-1357). Use when generating or reviewing AI-assisted code that imports packages, dependencies, or libraries. CRITICAL AI-specific vulnerability with 5-21% hallucination rate. Detects dependency confusion and slopsquatting risks.

Security anti-pattern for insufficient randomness vulnerabilities (CWE-330). Use when generating or reviewing code that creates security tokens, session IDs, encryption keys, nonces, or any security-critical random values. Detects use of Math.random() or predictable seeds.

Audit a Johnny.Decimal system by comparing the JDex against the actual folder structure, flagging mismatches, orphaned entries, and undocumented folders. Use this skill when the user wants to verify their JD system, check for inconsistencies, sync their JDex with the filesystem, or says things like "audit my JDex," "check my system," "sync JDex," "verify my JD system," "is my JDex up to date," or "find orphaned folders."

Create a security ticket in JIRA for a CVE from a GitHub Dependabot alert URL.

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

Implement Linkerd service mesh patterns for lightweight, security-focused service mesh deployments. Use when setting up Linkerd, configuring traffic policies, or implementing zero-trust networking with minimal overhead.

When the user wants to create, optimize, or audit migration guides for users switching from competitors. Also use when the user mentions "migration guide," "migrate from X," "switch to [product]," "import from X," or "data migration." For rebrand and redirects, use rebranding-strategy.

OWASP compliance, vulnerability scanning, and adversarial red team testing — use for security reviews

Creates, audits, and updates public open-source repository documentation, including README files, CONTRIBUTING guides, SECURITY and SUPPORT docs, project badges, quickstarts, usage guidance, community links, and contributor onboarding. Use when maintaining docs for public GitHub projects, libraries, CLIs, apps, or reusable packages, especially when the user says "update this README", "write CONTRIBUTING.md", "make these docs open-source ready", or "improve the public project docs".

Perform Porter's Five Forces analysis — competitive rivalry, supplier power, buyer power, threat of substitutes, and threat of new entrants. Use when analyzing industry dynamics, assessing competitive forces, or evaluating market attractiveness.

Verify claims in a session/PR/transcript against on-disk reality. Produce a verification report (verified / false-positive / false-negative / partial) with explicit owners. STOP at verification — do not execute remediation without explicit approval.

Security fix patterns for configuration and deployment vulnerabilities (path traversal, debug mode, security headers). Provides language-specific secure implementations.

Security fix patterns for cryptographic vulnerabilities (weak algorithms, insecure randomness, TLS issues). Provides language-specific secure implementations.

This skill should be used when the user asks to "review Dependabot alerts", "check for vulnerable dependencies", "audit third-party packages", "assess supply chain risk", "run Grype scan", or needs to evaluate dependency health, transitive risk, or supply chain security.