[STUB - Not implemented] Security testing strategies including vulnerability scanning and penetration testing guidance. PROACTIVELY activate for: [TODO: Define on implementation]. Triggers: [TODO: Define on implementation]

Security pattern for field-level encryption at rest. Use when encrypting specific sensitive data fields before storage, implementing application-level encryption for databases, or when only certain data elements need encryption at rest. Addresses "Leak data at rest" problem.

Security pattern for encrypting specific data before transmission. Use when only certain data elements need encryption, implementing field-level encryption for transit, or when entities must actively manage encryption decisions. Addresses "Leak action request or data in transit" problem.

Security pattern combining session authentication with authorization. Use when implementing web application security requiring both user authentication via session IDs and authorization checks for resource access. Combines Opaque token-based authentication with Authorisation pattern.

Security anti-pattern for session fixation vulnerabilities (CWE-384). Use when generating or reviewing code that handles user sessions, login flows, or authentication state changes. Detects failure to regenerate session IDs after authentication.

Use when you want to audit SKILL.md files for CSO compliance, check if skill descriptions follow the "Use when..." pattern, or verify skill structure meets quality standards before committing or publishing.

Launch both thermo-nuclear review subagents in parallel, then synthesize their findings. Use for thermos, double thermo review, or combined bug/security and code-quality branch audits.

Security pattern for full-disk or database-level encryption at rest. Use when implementing Transparent Data Encryption (TDE), full-disk encryption, or when storage infrastructure should handle encryption without application changes. Addresses "Leak data at rest" problem.

Security anti-pattern for weak password hashing (CWE-327, CWE-759). Use when generating or reviewing code that stores or verifies user passwords. Detects use of MD5, SHA1, SHA256 without salt, or missing password hashing entirely. Recommends bcrypt, Argon2, or scrypt.

Secures webhook receivers with signature verification, retry handling, deduplication, idempotency keys, and error responses. Provides verification code, dedupe storage strategy, runbook for incidents. Use when implementing "webhooks", "webhook security", "event receivers", or "third-party integrations".

Comprehensive security assessment and remediation. Use for security reviews, compliance checks, vulnerability assessments.

Audit security with vulnerability scanning, input validation checks, and auth/authz review against OWASP Top 10. Use when implementing authentication, reviewing security-sensitive code, or conducting security audits.

OWASP Top 10 with code examples, SAST/DAST tools, dependency scanning, CSP headers, and input validation patterns. Use when hardening applications, reviewing security posture, or implementing defensive coding practices.

Produces build artifacts with Software Bill of Materials (SBOM) and supply chain metadata for security and compliance. Use for "artifact publishing", "SBOM generation", "supply chain security", or "build provenance".

Define, validate, run, resume, and audit repo-local multi-step automations with current `asc workflow` and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Define, validate, run, resume, and audit repo-local multi-step automations with current `asc workflow` and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

Deep EVM smart contract security audit system. Use when asked to audit a contract, find vulnerabilities, review code for security issues, or file security issues on a GitHub repo. Covers 500+ non-obvious checklist items across 19 domains via parallel sub-agents. Different from the security skill (which teaches defensive coding) — this is for systematically auditing contracts you didn't write.

Phase 5: Verify all corrections were applied correctly

Read-only drift detector. Diffs SPEC.md against current code and reports violations grouped by severity. Writes nothing — suggests remedies via the spec or build skills but never invokes them. Triggers when the user asks to check drift, audit the spec, verify invariants, or ask whether code still matches the spec. Phrasings: "check drift", "audit the spec", "does the code still match §V", "check invariants", "spec vs code".

Comprehensive code review covering security vulnerabilities, performance bottlenecks, best practices, and refactoring opportunities. Use when user requests code review, security audit, or performance analysis.

Set up and manage INFYNON Eagle Eye — continuous CVE monitoring with scheduled email alerts. Use when the user wants vulnerability monitoring over time, automated CVE alerts, SMTP configuration, or ongoing security monitoring.

Fix or guide remediation for a specific security finding from the latest scan report

Token-efficient git operations with security scanning and auto-split commits

This skill should be used when the user asks "is this real HDR", "check HDR metadata", "fake HDR", "is this Dolby Vision legitimate", "HDR vs SDR", "check HDR peak brightness", or wants to verify whether HDR content is genuine or inverse tonemapped from SDR.

Security anti-pattern for log injection vulnerabilities (CWE-117). Use when generating or reviewing code that writes to log files, handles logging of user input, or processes log data. Detects unsanitized data in log messages enabling log forging and CRLF injection.

Audit and maintain project rules in .cursor/rules/. Use when auditing project rules, checking prefix convention, syncing doc/rules.md, or when the user asks about .cursor/rules or prefix convention.

Audit the martech stack. Use when: evaluating marketing tools, recommending consolidation, or choosing between platforms.

Audit cross-repo dependencies within an org and flag outdated or breaking changes

Find and review Google Drive files shared outside the organization.

List and review Google Workspace security alerts from Alert Center.

Security anti-pattern for Regular Expression Denial of Service (CWE-1333). Use when generating or reviewing code that uses regex for input validation, parsing, or pattern matching. Detects catastrophic backtracking patterns with nested quantifiers.

Review a code change for correctness, security, broken contracts, robustness, and real tests.

Protocol and DeFi risk evaluation covering hack history, oracle dependencies, treasury health, TVL concentration, and yield sustainability. Use when the user asks "is X safe", "how risky is", protocol security, risk analysis, or wants to evaluate risk before investing or depositing funds.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Run security audit with GitLeaks pre-commit hook setup and code analysis

Security vulnerability scanning and OWASP Top 10 compliance checking. Use when reviewing code for security issues, validating authentication/authorization, or ensuring security best practices.

Security review guardrails for AIRBot

Security review checklist for features and changes

Run Semgrep security and code quality analysis

Cart abandonment recovery — email sequences, SMS, retargeting, exit intent, checkout friction audit

This skill should be used when the user asks "check subtitles", "audit subs", "subtitle font issues", "ASS vs SRT", "missing fonts", "subtitle timing", or wants to analyze subtitle tracks for issues like missing fonts, timing problems, or format limitations.

This skill should be used when the user asks to "audit dependencies", "run security audit", "check for vulnerabilities", "supply chain report", "security posture", "audit npm packages", "check dependency security", or "generate SBOM". Runs a comprehensive security posture report using npm audit, lockfile-lint, Socket.dev, and dependency age analysis. Cross-references devs:deps-core for package manager commands.

Create security zones and assign rights to profiles. Use when registering controllers.

Security anti-pattern for timing side-channel vulnerabilities (CWE-208). Use when generating or reviewing code that compares secrets, tokens, passwords, or cryptographic values. Detects early-exit comparisons that leak information through timing differences.

Security anti-pattern for type confusion vulnerabilities (CWE-843). Use when generating or reviewing code in dynamic languages that compares values, processes JSON/user input, or uses loose equality. Detects weak typing exploits and type coercion attacks.

Security pattern for self-contained token authentication (e.g., JWT). Use when implementing stateless authentication, designing tokens with embedded claims, or building systems where tokens contain principal information and can be verified without server-side storage. Specialization of Authentication pattern.

Phase 6: Archive URLs via perma.cc

Phase 1: Extract footnotes from DOCX with formatting annotations

Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection. Provides auth routes, middleware, security configurations, and threat model documentation. Use when building "authentication", "login system", "JWT auth", or "session management".

Audit existing Google Analytics implementation. Checks for common issues, missing configurations, and optimization opportunities.

Review RFCs for problem clarity, compliance, security, and performance using SCQA framework

Performs comprehensive codebase analysis covering architecture, code quality, security, performance, testing, and maintainability. Use when user wants to audit code quality, identify technical debt, find security issues, assess test coverage, or get a codebase health check.

Query federation audit logs with compliance filtering

Review current branch for blindspots; fix now / needs spec / create issues.

Audit milestone completion against original intent before archiving

Create phases to close all gaps identified by milestone audit

Audits HealthTech applications for HIPAA technical safeguards like encryption and audit logging. Use when reviewing healthcare infrastructure or ensuring PHI is handled according to legal security standards.

IoT network traffic analyzer for detecting IoT protocols and identifying security vulnerabilities in network communications. Use when you need to analyze network traffic, identify IoT protocols, or assess network security of IoT devices.

Audit kubeconfig clusters and recommend cleanup

Security pattern for implementing password-based authentication. Use when designing login systems with username/password, implementing password storage, hashing, salting, peppering, password policies, or password reset flows. Specialization of the Authentication pattern.

Audit and improve SwiftUI runtime performance. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps.

Administer IT — monitor security and configure Workspace.

Publish E2E/QA test reports (markdown + screenshots) as secret GitHub Gists. Uses two-gist pattern to work around GitHub rendering limits. Trigger when: report needs to be shared via gist, E2E test run completed and report must be published, user asks to "upload report", "publish to gist", "share test results", or after manual-qa produces a report with screenshots.

View the most recent security scan results without re-running the scan

Use for security review with project-specific framing. Adds memory of prior incidents/threats, project-stack-aware patterns (Salesforce sharing model, etc.). Complementary to built-in /security-review.

Run a security audit on the project (dependencies, secrets, OWASP)

Application security covering input validation, auth, headers, secrets management, and dependency auditing

Run full security scans on the codebase using Ruflo security tools

Manage, audit, and maintain your skill ecosystem. Use when the user asks to "check my skills", "audit skills", "find duplicate skills", "which skills am I using", "prune unused skills", "are my skills synced", "check for skill updates", "skill report", "skill health", or mentions skill maintenance, cleanup, or organization.

Web crawling and scraping with analysis. Use for crawling websites, security scanning, and extracting information from web pages.

Quick reference for all Supabase security audit skills with usage examples and command overview.

Keeps an existing Linear project tidy after planning and during execution. Use when the user asks to "tidy Linear", "clean up the project", "audit issues", "find duplicates", "check stale blockers", "fix project drift", or run periodic Linear housekeeping on a project, initiative, or milestone set. Use when planning is underway or execution has started and relationships, labels, priorities, documents, and issue states need coherence without changing product scope.

Accessibility audit for WCAG compliance and usability

Diagnose why an AI feature is underperforming, hallucinating, or behaving inconsistently. Uses 4D audit to work backwards from symptoms to root cause.

Solidity smart contracts, Web3 development, DeFi protocols, NFTs, EVM chains, Hardhat/Foundry tooling, and blockchain security. Use when writing smart contracts, building dApps, auditing contract security, or integrating Web3 wallets.

Perform thorough code reviews with security, performance, and maintainability analysis. Use when user asks to review code, check for bugs, or audit a codebase.

Analyze code quality, security, performance, and maintainability

Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.

Verifies alignment between curriculum modules and generated projects to ensure no knowledge gaps. Use to audit the logical flow of a teaching program and ensure students are prepared for assigned tasks.

Configure database containers with security, persistence, and health checks

Analyzes project dependencies for known security vulnerabilities using npm audit, pip-audit, or similar tools. Use when auditing packages, checking for CVEs, or updating vulnerable dependencies.

Audit npm dependencies for security vulnerabilities, outdated packages, and unused dependencies. Use when checking for security issues, updating packages, or cleaning up dependencies.

A skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.

Use to generate adversarial edge-case test inputs targeting the actual code paths. AI reads the function, finds the assumptions, and writes inputs that violate them. Beats random fuzzing for code with structure.

Diagnostic audit across all seven layers — identifies the bottleneck layer and recommends where to focus

Run this skill to harden openclaw's security by adding an override so that the admin can always get into the bot even if the allowlist is corrupted. It effectively ensures the "breakglass" admin phone number never loses access.

Review code changes on a given GitHub PR using gh CLI. Use when the user asks to review a pull request, analyze PR diffs, or provide feedback on open PRs with structured quality, security, and testing assessments.

Run a focused STRIDE-based security review using Bug Hunter-native artifacts. Use whenever the user asks for a full security audit, repository security review, weekly security scan, PR security review with deeper validation, or wants dependency CVEs and threat-model context combined into one workflow.

Use this skill when the user mentions "sonar", "sonarqube", "code quality", "code smell", "quality gate", "new code issues", "fetch issues", "security hotspots", or wants to analyze code quality.

Generate or refresh a STRIDE-based threat model for the current repository using Bug Hunter-native artifacts. Use whenever the repository has no threat model yet, the architecture changed materially, a security review needs fresh trust-boundary context, or the user explicitly asks for a threat model.

Brutal Vibe Audit for engineering quality. Auto-activates on: "code review", "technical audit", "engineering quality", "is this production ready", "vibe check", "slop check", "AI-generated code", "technical due diligence", "can we ship this", "quality assessment"

Validate security findings for exploitability, reachability, and real-world impact using Bug Hunter-native findings artifacts. Use after security scans, before patch generation, or whenever the user wants confirmation that a suspected vulnerability is actually exploitable.

Project overview and audit preparation for smart contract security. Triggers on weasel overview, weasel scope, or weasel onboard.

Audit report writing for smart contract vulnerabilities. Triggers on weasel report, weasel write up, or weasel document.

Audit designs and code for WCAG 2.1 AA compliance. Trigger with "is this accessible", "accessibility check", "WCAG audit", "can screen readers use this", "color contrast", or when the user asks about making designs or code accessible to all users.

Root-cause a reconciliation break to its source transaction or posting — follow the audit trail from the break row back to the originating entry on each side and state what differs and why. Use after gl-recon has classified a break.