Use when checking code for vulnerabilities, linting shell scripts, scanning containers or IaC for security issues, or managing encrypted secrets

Generate siem rule generator operations. Auto-activating skill for Security Advanced. Triggers on: siem rule generator, siem rule generator Part of the Security Advanced skill category. Use when working with siem rule generator functionality. Trigger with phrases like "siem rule generator", "siem generator", "siem".

Create threat model creator operations. Auto-activating skill for Security Advanced. Triggers on: threat model creator, threat model creator Part of the Security Advanced skill category. Use when working with threat model creator functionality. Trigger with phrases like "threat model creator", "threat creator", "threat".

Create waf rule creator operations. Auto-activating skill for Security Advanced. Triggers on: waf rule creator, waf rule creator Part of the Security Advanced skill category. Use when working with waf rule creator functionality. Trigger with phrases like "waf rule creator", "waf creator", "waf".

Configure with zero trust config helper operations. Auto-activating skill for Security Advanced. Triggers on: zero trust config helper, zero trust config helper Part of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like "zero trust config helper", "zero helper", "zero".

QuickNode security basics — blockchain RPC and Web3 infrastructure integration. Use when working with QuickNode for blockchain development. Trigger with phrases like "quicknode security basics", "quicknode-security-basics", "blockchain RPC".

Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security.

Hyperflow code review. Use when the user wants the current diff, a commit, branch, or PR reviewed — verbs like audit, review, "check for issues", "security check", "code review". Multi-level review (L1 quick → L5 exhaustive), writes findings to .hyperflow/audits/, then a fix-gate.

Technology stack evaluation and comparison with TCO analysis, security assessment, and ecosystem health scoring. Use when comparing frameworks, evaluating technology stacks, calculating total cost of ownership, assessing migration paths, or analyzing ecosystem viability.

Google Workspace administration via the gws CLI. Install, authenticate, and automate Gmail, Drive, Sheets, Calendar, Docs, Chat, and Tasks. Run security audits, execute 43 built-in recipes, and use 10 persona bundles. Use for Google Workspace admin, gws CLI setup, Gmail automation, Drive management, or Calendar scheduling.

Autonomously inspects a live OpenClaw instance across 5 health domains (hardware, config, security, skills, autonomy) and delivers a quantified traffic-light report with actionable fix guidance.

Atlassian Administrator for managing and organizing Atlassian products (Jira, Confluence, Bitbucket, Trello), users, permissions, security, integrations, system configuration, and org-wide governance. Use when asked to add users to Jira, change Confluence permissions, configure access control, update admin settings, manage Atlassian groups, set up SSO, install marketplace apps, review security policies, or handle any org-wide Atlassian administration task.

Cross-reference GitHub PRs and issues to find duplicates and missing links. Spawns parallel Sonnet subagents to semantically analyze the last N PRs and issues, finding PRs that solve the same problem (duplicates) and issues resolved by open PRs but not yet linked. Groups findings into thematic clusters, scores them by actionability, and offers rate-limited commenting or bulk actions (close, label). Use this skill when the user wants to find duplicate PRs, link issues to PRs, clean up a repo's cross-references, or audit PR/issue relationships. Also useful when the user says things like "find related PRs", "which PRs fix this issue", "are there duplicate PRs", "link issues and PRs", or "audit cross-references".

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.

Solidity smart contract security audit assistant following EEA EthTrust V3 specification. Performs structured audit workflow: vulnerability scanning, security analysis, audit reports. Detects reentrancy, integer overflow, access control issues, and more. Supports Slither/Aderyn static analysis and Foundry testing. Triggers: smart contract audit, solidity audit, security review, vulnerability assessment.

ISO 13485 internal audit expertise for medical device QMS. Covers audit planning, execution, nonconformity classification, and CAPA verification. Use for internal audit planning, audit execution, finding classification, external audit preparation, or audit program management.

World-class autonomous admin, personal ops, chief-of-staff skill system. Use ANY time user asks to triage email, manage inbox, track deadlines, monitor renewals, set reminders, capture tasks, build daily briefings, manage calendars, track expiring sessions, monitor subscriptions, handle billing, create SOPs, build checklists, track invoices, handle admin, build dashboards, manage vendors, track compliance, handle personal-business crossover, build escalation protocols, organize files, track domain/SSL/insurance renewals, monitor platform restrictions, audit accounts, or ANY admin, ops, inbox, deadline, reminder, task, briefing, or chief-of-staff task. If it involves organizing, tracking, triaging, reminding, monitoring, surfacing, filtering, scheduling, or back-office work — USE THIS SKILL. Also trigger for "what do I need to do", "anything urgent", "check my email", "what's coming up", "remind me", "don't let me forget", "track this", "when does X expire", "morning briefing". Trigger aggressively.

Vet ClawHub skills for security and utility before installation. Use when considering installing a ClawHub skill, evaluating third-party code, or assessing whether a skill adds value over existing tools.

360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks and automated scanning scripts. Supports static analysis, behavior detection, dependency auditing.

Network forensics evidence collection and analysis during security incidents. Guides volatile evidence preservation, lateral movement detection via flow records and ARP/MAC/CAM table analysis, and read-only containment verification across Cisco IOS-XE/NX-OS, Juniper JunOS, and Arista EOS. Scoped to network artifacts only — packet captures, flow data (NetFlow/sFlow/IPFIX), forwarding tables, routing state, and device logs. Not general incident response, endpoint forensics, or malware analysis.

When the user wants to develop social media strategy, plan content calendars, manage community engagement, or grow their social presence across platforms. Also use when the user mentions 'social media strategy,' 'social calendar,' 'community management,' 'social media plan,' 'grow followers,' 'engagement rate,' 'social media audit,' or 'which platforms should I use.' For writing individual social posts, see social-content. For analyzing social performance data, see social-media-analyzer.

Dual-platform Cisco ASA and Firepower Threat Defense (FTD) firewall audit with ACL analysis, NAT policy validation, Modular Policy Framework / Access Control Policy evaluation, Snort IPS assessment, VPN configuration review, and logging completeness verification.

FortiOS VDOM segmentation audit with UTM profile binding validation, FortiGuard service health assessment, SD-WAN security evaluation, and HA cluster posture check. Systematic per-VDOM policy analysis for FortiGate appliances and FortiGate-VM instances.

Security advisory feed with automated NVD CVE polling for OpenClaw-related vulnerabilities. Updated daily.

Deduplicate, normalize, and enrich CRM contacts and companies. Use when a user needs to clean CRM data, find duplicate contacts, standardize phone numbers or emails, merge duplicate records, audit data quality, or enrich contacts with external sources like Clearbit or Apollo. Works with HubSpot, Salesforce, Pipedrive, or any CRM with CSV export. Instruction-only skill — no scripts or code execution. All operations are performed via CRM platform APIs or CSV export/import workflows.

Community incident reporting for AI agents. Contribute to collective security by reporting threats.

Generate creative code names and encode/decode secret messages using classic and sophisticated ciphers. Blends nostalgic decoder ring fun with modern cryptographic techniques. Includes Caesar, Vigenère, Polybius, Rail Fence, and hybrid methods. Provides keys for secure message sharing between trusted parties.

Role-based access control for Greek accounting firms. Login, role hierarchy, per-client permissions, session management, audit logging.

Comprehensive audit of all construction data sources and systems. Map data flows, identify silos, assess quality, and create integration roadmap.

Audit and improve SwiftUI runtime performance from code review and architecture. Use for requests to diagnose slow rendering, janky scrolling, high CPU/memory usage, excessive view updates, or layout thrash in SwiftUI apps, and to provide guidance for user-run Instruments profiling when code review alone is insufficient.

Techniques for writing effective fuzzing harnesses across languages. Use when creating new fuzz targets or improving existing harness code.

Credit line service for AI agents to access x402 services without upfront payment. Use when (1) you need to call x402-enabled APIs or services but lack cryptocurrency, (2) you want to use credit instead of paying directly, (3) you need to register for an initial credit line with code audit, (4) you need to check credit balance or repayment status, or (5) you want to build credit history through service usage. ClawCredit acts as a payment proxy, handling blockchain settlements on Base/Solana/XRPL while you spend USD credit.

Create ClawhHub-ready OpenClaw skills with correct structure, scanner criteria, security rules & publish checklist. No credentials or binaries required.

Redaction-only subagent for pf-ethnographer. Accepts raw observed behavior and interpretation reports from the Ethnographer, applies aggressive PII and sensitive-data redaction using regex detectors, heuristics, and secret-scanning patterns, and returns sanitized reports plus a full redaction manifest. Never invoked directly by the user or by the model — only spawned by the Ethnographer during a research pulse.

Every Cal.com feature, plus offline agendas, composed booking flows, and analytics no other Cal.com tool ships. Trigger phrases: `book a meeting on cal.com`, `what's on my calendar today`, `find an open slot`, `reschedule my next booking`, `audit my cal.com webhooks`, `use cal-com`, `run cal-com-pp-cli`.

Every Google Search Console feature you'd reach for, plus an offline SQLite cache that powers period compare, quick... Trigger phrases: `search console performance for example.com`, `quick wins for sc-domain:example.com`, `cannibalization audit on this site`, `compare last 28 days to prior period in GSC`, `why did traffic drop on this property`, `which pages are decaying`, `use google-search-console`, `run gsc`.

Every Trigger.dev management endpoint, plus offline FTS over runs, span-cost rollups, and zombie-schedule detection no other tool gives you. Trigger phrases: `trigger.dev failed runs`, `trigger.dev cost rollup`, `trigger.dev schedule health`, `audit trigger.dev env vars`, `watch trigger.dev failures`, `use trigger-dev`, `run trigger-dev`.

Generate and audit Microsoft Clarity browser instrumentation from the terminal. Trigger phrases: `generate a Clarity snippet`, `audit Clarity instrumentation`, `add Microsoft Clarity identify call`.

Search the U.S. National Vulnerability Database for CVEs, CVSS scores, affected versions, and severity ratings — by keyword, product (CPE name), CVE ID, or date range. Trigger phrases: `look up CVE`, `CVSS score for`, `vulnerabilities in <product>`, `use nvd`.

Dynamic Application Security Testing execution and management. Configure and execute OWASP ZAP and Nuclei scans, run authenticated scanning, manage scan policies and scope, correlate findings with SAST results, and generate comprehensive vulnerability reports.

Automated OWASP Top 10 vulnerability detection and assessment. Run OWASP ZAP automated scans, detect injection vulnerabilities, identify broken authentication patterns, check for sensitive data exposure, analyze security misconfigurations, and generate OWASP-compliant reports.

AI/ML model security testing and adversarial research capabilities. Generate adversarial examples, test model robustness, perform model extraction attacks, test for data poisoning, analyze model fairness, and support ART framework integration.

Static Application Security Testing orchestration and analysis. Execute Semgrep, Bandit, ESLint security plugins, CodeQL, and other SAST tools. Parse, prioritize, and deduplicate findings across multiple tools with remediation guidance.

Mobile application security skill for implementing OWASP MASVS compliance, secure storage, certificate pinning, biometric authentication, and security hardening across iOS and Android platforms.

Generate secure main process and preload script boilerplate with proper context isolation, IPC patterns, and security best practices for Electron applications

Hardware and embedded security research capabilities. Interface with JTAG debuggers, analyze SPI/I2C communications, dump and analyze firmware, support fault injection, side-channel analysis, and hardware exploitation research.

Expert skill for TLS/SSL implementation and certificate management. Generate and validate TLS configurations, create and manage X.509 certificates, analyze cipher suite security, debug TLS handshake failures, and implement certificate pinning.

Security vulnerability scanning for dependencies and code, with CVE database checking and risk assessment

On-chain analysis and transaction forensics for blockchain security investigations. Provides capabilities for tracing fund flows, identifying suspicious patterns, MEV analysis, and generating forensic reports for incident response.

Implementation and secure usage of cryptographic primitives including ECDSA, BLS, Schnorr signatures, key derivation, secret sharing, and constant-time operations. Provides guidance for secure cryptographic implementations in blockchain applications.

Bug bounty program management and security disclosure expertise for smart contracts. Covers program setup on Immunefi, vulnerability triage, responsible disclosure coordination, bounty payments, and post-disclosure analysis.

Deep EVM bytecode analysis and decompilation capabilities for smart contract security, gas optimization, and reverse engineering. Provides tools for analyzing opcodes, storage layouts, proxy patterns, and bytecode verification.

Expert usage of OpenZeppelin Contracts library for secure smart contract development. Covers access control, token standards, governance, upgrades, and security utilities.

Analyze Electron IPC implementations for security vulnerabilities including contextIsolation, nodeIntegration, preload scripts, and channel validation

Express.js middleware patterns, routing, error handling, security, and production best practices.

Symbolic execution analysis using Mythril for deep vulnerability detection in smart contracts. Supports configurable transaction depth, timeout settings, and proof-of-concept exploit generation.

Expert integration with Slither static analyzer for smart contract vulnerability detection, code quality analysis, and security reporting. Supports all Slither detectors and custom analysis configurations.

Deep expertise in Solidity language features, patterns, and best practices for secure smart contract development. Covers ERC standards, gas optimization, upgradeable contracts, and security patterns.

Continuous vendor security monitoring for security ratings, breach notifications, and risk change detection

HIPAA security and privacy compliance automation for ePHI protection, safeguards assessment, and audit preparation

Audit Qt Widget applications for accessibility compliance using QAccessible interface and platform accessibility APIs

Developer security training and assessment for secure coding practices and vulnerability prevention

Automated vendor security assessment through questionnaire generation, response parsing, and risk scoring

SOC 2 Trust Services Criteria compliance automation for evidence collection, control mapping, and audit preparation

Strategy robustness testing, scenario-based evaluation, vulnerability identification, and adaptation planning

Validate compliance during migration with rule checking, audit trails, and security control validation

Disciplined execution of approved plans with step-by-step verification, phase checkpoints, failure investigation, and mandatory code/security reviews.

Run security scans including SAST, dependency scanning, and secret detection

Generate threat models using STRIDE, PASTA, or VAST methodologies

Comprehensive fuzzing operations with AFL++, libFuzzer, and OSS-Fuzz integration

Multi-dimensional code assessment across security, quality, performance, and maintainability with confidence-gated reporting (>=80%) and Router Contract generation.

Multi-dimensional code review across correctness, security, performance, and maintainability with confidence-gated reporting and remediation loops.

Validate OpenAPI specifications for correctness, security, and best practices

Expert skill for protocol fuzzing, vulnerability discovery, and security testing

Internal quality audit skill with planning, execution, findings documentation, and corrective action tracking

Evaluate organizational compliance with healthcare regulations including HIPAA, CMS Conditions of Participation, and accreditation standards through gap analysis and audit procedures

Develop comprehensive risk management plans for collections and cultural venues including disaster preparedness, security protocols, and insurance coordination

Security vulnerability assessment identifying OWASP risks, injection vectors, authentication issues, and data exposure with severity classification.

AgentShield security audit with 5 scanning categories, 102 static analysis rules, and optional red-team simulation.

Web application security testing with Burp Suite integration

Advanced debugging integration for vulnerability research

Android and iOS application security testing

Offensive security tools and techniques integration

STIX/TAXII threat intelligence format and sharing

Ethereum and blockchain smart contract security analysis

Integration with security-focused static analysis tools

Statistical and non-statistical audit sampling skill with sample size determination and evaluation

Verifies financial data against source documents, bank statements, contracts

Automated audit workpaper preparation skill with PBC list management

Automated freight bill validation skill with discrepancy detection and payment processing automation

Review clinical documentation and assigned codes for accuracy, compliance, and optimization, identifying documentation improvement opportunities and coding errors

Audit and recommend minimal sandbox entitlements for secure desktop applications

Automated technical architecture review, security assessment, scalability analysis

OWASP Top 10, security headers, CSP, XSS prevention, and vulnerability prevention.

Content Security Policy configuration, nonces, and reporting.