Security AI agent skills

3,127 skills in the archive. Read a skill’s instructions or open its original repository.

• Vulnhunter Fix

  by @capitalone

  Automate vulnerability remediation from VulnHunter scan results using TDD. Parses VulnHunter findings, writes exploit demos proving each vulnerability, writes security tests that define correct behavior (RED), implements fixes…

• Vulnhunt

  by @capitalone

  Scan a codebase for exploitable security defects. Enumerates every user-controllable input, traces each forward to dangerous sinks, proves exploitability with executable tests, and proposes validated fixes.

• Release Kotlin Library

  by @chrisbanes

  Use when preparing, publishing, or checking readiness for a Kotlin library release, including verifying its gradle-maven-publish-plugin prerequisite, reconciling changelogs and API snapshots, and checking publication.

• Code Review

  by @vstorm-co

  Review Python code for quality, security, and best practices

• Code Review

  by @vstorm-co

  Systematic code review for bugs, security, style, and performance

• Vibe Security

  by @raroque

  Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation,…

• Agentforce Test

  by @forcedotcom

  Write, run, and analyze structured test suites for Agentforce agents — functional AND security. TRIGGER when: user writes or modifies test spec YAML (AiEvaluationDefinition); runs sf agent test create, run, run-eval, or results…

• Deck Repro

  by @asheshgoplani

  Reproduce agent-deck bugs from an issue, transcript excerpt, or description in an isolated environment, and prove fixes with the same reproduction and a regression test. Use for a concrete agent-deck issue or candidate,…

• Audit Feedback Loop

  by @NeuroAIHub

  Coordinate iterative evidence and reliability reviews between BrainPilot's Principal Investigator and Auditor. Use when PI needs to audit its own draft, an Expert result, or a multi-agent synthesis; when Auditor receives such a…

• Optimize

  by @doccker

  结构化系统优化扫描工作流，适用于显式 optimize、性能评估、体验评估或代码质量扫描场景；默认输出问题与建议，不直接改代码。

• Rust Dev

  by @doccker

  Rust 开发规范（聚焦 Axum + Tokio 后端栈），覆盖工具链、错误处理、异步陷阱、模块组织、依赖管理与测试规范

• Codex

  by @dzhng

  Use the local Codex CLI as an independent second agent. Two branches — (1) proactively run `codex review` for a second opinion after completing a substantive change, before presenting it as done or committing; (2) delegate a…

• Protocolsio Integration

  by @wu-yc

  Integration with protocols.io API for managing scientific protocols. This skill should be used when working with protocols.io to search, create, update, or publish protocols; manage protocol steps and materials; handle…

• Platform Encryption Configure

  by @forcedotcom

  Configure Salesforce Shield Platform Encryption — generate deployable encryption settings and encrypted-field metadata, and answer key-model and lifecycle questions. TRIGGER when: user wants to turn on deterministic encryption,…

• Mobile Platform Offline Validate

  by @forcedotcom

  Review a Lightning Web Component for **mobile offline** compatibility — the Komaci offline static analyzer that pre-primes the data graph for Salesforce Mobile App Plus and Field Service Mobile App. Produces a finding list with…

• Experience Lwc Security Validate

  by @forcedotcom

  Use this skill as THE specialized Lightning Web Security (LWS) validator for a Lightning Web Component bundle (`.js`, `.ts`, `.html`, `.css`, `.js-meta.xml`) — the canonical LWS/Product-Security review for LWCs, NOT a generic…

• Platform Architecture Analyze

  by @forcedotcom

  Use when the developer asks to "review the architecture", "run a Well-Architected check", "audit this project", "is this project well-architected?", or wants to assess security/governor-limit/risk as a holistic code-and-metadata…

• Experience Lwc Rtl Validate

  by @forcedotcom

  Use this skill to review a Lightning Web Component (.html, .js, .css files) for right-to-left (RTL) internationalization correctness, producing a finding list with code-level fixes covering CSS logical properties, bidirectional…

• Asc Revenuecat Catalog Sync

  by @rorkai

  Reconcile App Store Connect subscriptions and in-app purchases with RevenueCat products, entitlements, offerings, and packages using asc and RevenueCat MCP. Use when setting up or syncing subscription catalogs across ASC and…

• Asc Ad Hoc Distribution

  by @rorkai

  Prepare, publish, resume, and verify private iOS release-testing installs with asc distribute. Use when distributing an IPA to registered devices outside TestFlight, reconciling ad hoc profiles, publishing through caller-owned…

• Asc Workflow

  by @rorkai

  Define, validate, run, resume, and audit repo-local multi-step automations with current `asc workflow` and `.asc/workflow.json`, including step outputs and safe release/TestFlight workflows.

• Binance Agentic Wallet

  by @binance

  Use when the user mentions wallet connect/sign in/sign out, check balance, send/transfer tokens, swap/buy/sell tokens, DEX trade, limit/market order, cancel order, get a quote, transaction history, wallet settings, daily limit,…

• Site Architecture

  by @LeoYeAI

  When the user wants to plan, map, or restructure their website's page hierarchy, navigation, URL structure, or internal linking. Also use when the user mentions "sitemap," "site map," "visual sitemap," "site structure," "page…

• Binance Onchain Copy Trader

  by @binance

  Scaffold for assembling on-chain copy-trading strategies on Binance Agentic Wallet. Wires the existing capabilities — address monitoring, signal subscription, address scoring, token audit, order placement, on-chain…

• Query Token Audit

  by @binance

  Query token security audit to detect scams, honeypots, and malicious contracts before trading. Returns comprehensive security analysis including contract risks, trading risks, and scam detection. Use when users ask "is this…

• Config Explorer

  by @hoangsonww

  Inspect and safely edit the Claude Code and Codex configuration surfaces exposed by CCAM. Use when auditing skills, agents, commands, plugins, marketplaces, MCP servers, hooks, settings, memory, keybindings, profiles, rules, or…

• C Sharp Scripting

  by @data-goblin

  Writing and executing C# scripts and macros against Power BI semantic models using Tabular Editor 2/3. Automatically invoke when the user mentions "C# script", "Tabular Editor script", "TOM scripting", "MacroActions.json",…

• Review Report

  by @data-goblin

  Actionable feedback on the quality, usage, and effectiveness of Power BI reports. Automatically invoke when the user asks to "review a report", "audit a report", "report usage analysis", "report health check", "find unused…

• Semantic Model

  by @data-goblin

  This skill should be used whenever the user mentions a "semantic model", "data model", or "dataset", or asks to "build", "model", "design", "optimize", "review", or "audit" one, or to "add a measure", "add a relationship",…

• Improve My Agent Setup

  by @data-goblin

  Audit and improve an entire agentic-development setup, including skills, context, memory, tools, models, permissions, hooks, workflow habits, and secrets hygiene. Invoke for setup reviews, workflow grading, Goblin Mode, or…

• Audit Tenant Settings

  by @data-goblin

  Automatically invoke this skill whenever the user asks about Fabric tenant settings or Power BI tenant settings or auditing tenant settings. You can use this skill if the user mentions "Fabric administration".

• Security Review

  by @getsentry

  Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication,…

• Gha Security Review

  by @getsentry

  GitHub Actions security review for workflow exploitation vulnerabilities. Use when asked to "review GitHub Actions", "audit workflows", "check CI security", "GHA security", "workflow security review", or review…

• Skill Scanner

  by @getsentry

  Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for…

• Django Access Review

  by @getsentry

  Django access control and IDOR security review. Use when reviewing Django views, DRF viewsets, ORM queries, or any Python/Django code handling user authorization. Trigger keywords: "IDOR", "access control", "authorization",…

• Dd Idp

  by @DataDog

  Find, filter, count, and connect software, teams, engineering work and delivery, infrastructure, and operational or security records through Pup's read-only Datadog entity graph. Use for inventory, ownership, dependencies, and…

• Find Bugs

  by @getsentry

  Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

• Prose

  by @SafeAI-Lab-X

  OpenProse VM skill pack. Activate on any `prose` command, .prose files, or OpenProse mentions; orchestrates multi-agent workflows.

• Skill Creator

  by @SafeAI-Lab-X

  Create, edit, improve, or audit AgentSkills. Use when creating a new skill from scratch or when asked to improve, review, audit, tidy up, or clean up an existing skill or SKILL.md file. Also use when editing or restructuring a…

• Windows Safety Guide

  by @SafeAI-Lab-X

  One-click deployment Skill for Windows security policies, daily security audits, behavior auditing, file baselines, logging and nightly audit task management

• Feishu Safety Guide

  by @SafeAI-Lab-X

  One-click deployment Skill for Feishu security governance and message anti-data-leakage guide, responsible for Feishu message security, credential protection, permission auditing, interaction logging and periodic security…

• Model Usage

  by @SafeAI-Lab-X

  Use CodexBar CLI local cost usage to summarize per-model usage for Codex or Claude, including the current (most recent) model or a full model breakdown. Trigger when asked for model-level usage/cost data from codexbar, or when…

• Openclaw Test Heap Leaks

  by @SafeAI-Lab-X

  Investigate `pnpm test` memory growth, Vitest worker OOMs, and suspicious RSS increases in OpenClaw using the `scripts/test-parallel.mjs` heap snapshot tooling. Use when Codex needs to reproduce test-lane memory growth, collect…

• Himalaya

  by @SafeAI-Lab-X

  CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).

• 1password

  by @SafeAI-Lab-X

  Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.

• Tmux

  by @SafeAI-Lab-X

  Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output.

• Feishu Doc

  by @SafeAI-Lab-X

  Feishu document read/write operations. Activate when user mentions Feishu docs, cloud docs, or docx links.

• Openai Whisper Api

  by @SafeAI-Lab-X

  Transcribe audio via OpenAI Audio Transcriptions API (Whisper).

• Video Frames

  by @SafeAI-Lab-X

  Extract frames or short clips from videos using ffmpeg.

• Coding Agent

  by @SafeAI-Lab-X

  Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (spawn in temp dir), (3) refactoring large codebases, (4) iterative coding…

• Github

  by @SafeAI-Lab-X

  GitHub operations via `gh` CLI: issues, PRs, CI runs, code review, API queries. Use when: (1) checking PR status or CI, (2) creating/commenting on issues, (3) listing/filtering PRs or issues, (4) viewing run logs. NOT for:…

• Clawkeeper

  by @SafeAI-Lab-X

  Install, configure, verify, and debug the Clawkeeper watcher stack in this workspace. Use when a user asks to set up `clawkeeper`, initialize `remote` or `local` mode, enable `clawkeeper-watcher`, wire `clawkeeper-bands`,…

• Openclaw Pr Maintainer

  by @SafeAI-Lab-X

  Maintainer workflow for reviewing, triaging, preparing, closing, or landing OpenClaw pull requests and related issues. Use when Codex needs to validate bug-fix claims, search for related issues or PRs, apply or recommend…

• Node Connect

  by @SafeAI-Lab-X

  Diagnose OpenClaw node connection and pairing failures for Android, iOS, and macOS companion apps. Use when QR/setup code/manual connect fails, local Wi-Fi works but VPS/tailnet does not, or errors mention pairing required,…

• Gh Issues

  by @SafeAI-Lab-X

  Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo]…

• Openclaw Parallels Smoke

  by @SafeAI-Lab-X

  End-to-end Parallels smoke, upgrade, and rerun workflow for OpenClaw across macOS, Windows, and Linux guests. Use when Codex needs to run, rerun, debug, or interpret VM-based install, onboarding, gateway smoke tests,…

• Healthcheck

  by @SafeAI-Lab-X

  Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic…

• Acp Router

  by @SafeAI-Lab-X

  Route plain-language requests for Pi, Claude Code, Codex, OpenCode, Gemini CLI, or ACP harness work into either OpenClaw ACP runtime sessions or direct acpx-driven sessions ("telephone game" flow). For coding-agent thread…

• Openclaw Ghsa Maintainer

  by @SafeAI-Lab-X

  Maintainer workflow for OpenClaw GitHub Security Advisories (GHSA). Use when Codex needs to inspect, patch, validate, or publish a repo advisory, verify private-fork state, prepare advisory Markdown or JSON payloads safely,…

• Openclaw Release Maintainer

  by @SafeAI-Lab-X

  Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check…

• Clawhub

  by @SafeAI-Lab-X

  Use the ClawHub CLI to search, install, update, and publish agent skills from clawhub.com. Use when you need to fetch new skills on the fly, sync installed skills to latest or a specific version, or publish new/updated skill…

• Things Mac

  by @SafeAI-Lab-X

  Manage Things 3 via the `things` CLI on macOS (add/update projects+todos via URL scheme; read/search/list from the local Things database). Use when a user asks OpenClaw to add a task to Things, list inbox/today/upcoming, search…

• Weather

  by @SafeAI-Lab-X

  Get current weather and forecasts via wttr.in or Open-Meteo. Use when: user asks about weather, temperature, or forecasts for any location. NOT for: historical weather data, severe weather alerts, or detailed meteorological…

• Xurl

  by @SafeAI-Lab-X

  A CLI tool for making authenticated requests to the X (Twitter) API. Use this skill when you need to post tweets, reply, quote, search, read posts, manage followers, send DMs, upload media, or interact with any X API v2 endpoint.

• Security Triage

  by @SafeAI-Lab-X

  Triage GitHub security advisories for OpenClaw with high-confidence close/keep decisions, exact tag and commit verification, trust-model checks, optional hardening notes, and a final reply ready to post and copy to clipboard.

• Apple Notes

  by @SafeAI-Lab-X

  Manage Apple Notes via the `memo` CLI on macOS (create, view, edit, delete, search, move, and export notes). Use when a user asks OpenClaw to add a note, list notes, search notes, or manage note folders.

• Goplaces

  by @SafeAI-Lab-X

  Query Google Places API (New) via the goplaces CLI for text search, place details, resolve, and reviews. Use for human-friendly place lookup or JSON output for scripts.

• Bluebubbles

  by @SafeAI-Lab-X

  Use when you need to send or manage iMessages via BlueBubbles (recommended iMessage integration). Calls go through the generic message tool with channel="bluebubbles".

• Mcporter

  by @SafeAI-Lab-X

  Use the mcporter CLI to list, configure, auth, and call MCP servers/tools directly (HTTP or stdio), including ad-hoc servers, config edits, and CLI/type generation.

• Parallels Discord Roundtrip

  by @SafeAI-Lab-X

  Run the macOS Parallels smoke harness with Discord end-to-end roundtrip verification, including guest send, host verification, host reply, and guest readback.

• Slack

  by @SafeAI-Lab-X

  Use when you need to control Slack from OpenClaw via the slack tool, including reacting to messages or pinning/unpinning items in Slack channels or DMs.

• Apple Reminders

  by @SafeAI-Lab-X

  Manage Apple Reminders via remindctl CLI (list, add, edit, complete, delete). Supports lists, date filters, and JSON/plain output.

• Summarize

  by @SafeAI-Lab-X

  Summarize or extract text/transcripts from URLs, podcasts, and local files (great fallback for “transcribe this YouTube/video”).

• Diffs

  by @SafeAI-Lab-X

  Use the diffs tool to produce real, shareable diffs (viewer URL, file artifact, or both) instead of manual edit summaries.

• Feishu Perm

  by @SafeAI-Lab-X

  Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

• Wacli

  by @SafeAI-Lab-X

  Send WhatsApp messages to other people or search/sync WhatsApp history via the wacli CLI (not for normal user chats).

• Oracle

  by @SafeAI-Lab-X

  Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).

• Feishu Wiki

  by @SafeAI-Lab-X

  Feishu knowledge base navigation. Activate when user mentions knowledge base, wiki, or wiki links.

• Feishu Drive

  by @SafeAI-Lab-X

  Feishu cloud storage file management. Activate when user mentions cloud space, folders, drive.

• Songsee

  by @SafeAI-Lab-X

  Generate spectrograms and feature-panel visualizations from audio with the songsee CLI.

• Imsg

  by @SafeAI-Lab-X

  iMessage/SMS CLI for listing chats, history, and sending messages via Messages.app.

• Ordercli

  by @SafeAI-Lab-X

  Foodora-only CLI for checking past orders and active order status (Deliveroo WIP).

• Gifgrep

  by @SafeAI-Lab-X

  Search GIF providers with CLI/TUI, download results, and extract stills/sheets.

• Obsidian

  by @SafeAI-Lab-X

  Work with Obsidian vaults (plain Markdown notes) and automate via obsidian-cli.

• Session Logs

  by @SafeAI-Lab-X

  Search and analyze your own session logs (older/parent conversations) using jq.

• Gog

  by @SafeAI-Lab-X

  Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.

• Spotify Player

  by @SafeAI-Lab-X

  Terminal Spotify playback/search via spogo (preferred) or spotify_player.

• Blogwatcher

  by @SafeAI-Lab-X

  Monitor blogs and RSS/Atom feeds for updates using the blogwatcher CLI.

• Nano Pdf

  by @SafeAI-Lab-X

  Edit PDFs with natural-language instructions using the nano-pdf CLI.

• Eightctl

  by @SafeAI-Lab-X

  Control Eight Sleep pods (status, temperature, alarms, schedules).

• Notion

  by @SafeAI-Lab-X

  Notion API for creating and managing pages, databases, and blocks.

• Trello

  by @SafeAI-Lab-X

  Manage Trello boards, lists, and cards via the Trello REST API.

• Blucli

  by @SafeAI-Lab-X

  BluOS CLI (blu) for discovery, playback, grouping, and volume.

• Sonoscli

  by @SafeAI-Lab-X

  Control Sonos speakers (discover/status/play/volume/group).

• Openhue

  by @SafeAI-Lab-X

  Control Philips Hue lights and scenes via the OpenHue CLI.

• Tavily

  by @SafeAI-Lab-X

  Tavily web search, content extraction, and research tools.

• Sherpa Onnx Tts

  by @SafeAI-Lab-X

  Local text-to-speech via sherpa-onnx (offline, no cloud)

• Gemini

  by @SafeAI-Lab-X

  Gemini CLI for one-shot Q&A, summaries, and generation.

• Openai Whisper

  by @SafeAI-Lab-X

  Local speech-to-text with the Whisper CLI (no API key).

• Bear Notes

  by @SafeAI-Lab-X

  Create, search, and manage Bear notes via grizzly CLI.