All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 29,770
- 1,241
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 11,305–11,328 of 29,770 skills
- Api Webhook Security> WEBHOOK SECURITY IS A RECEIVER-SIDE RESPONSIBILITY — SIGNATURE VERIFICATION, TIMESTAMP VALIDATION, AND SECRET ROTATION ARE THE THREE CONTROLS THAT PREVENT SPOOFED DELIVERIES, REPLAY ATTACKS, AND CREDENTIAL EXPOSURE, AND OMITTING ANY ONE OF THEM CREATES AN EXPLOITABLE GAP EVEN IF THE OTHER TWO ARE CORRECTLY IMPLEMENTED.Votes: 0GitHub stars: 20
- Api Oauth2 Flows> OAUTH2 FLOW SELECTION IS DETERMINED BY CLIENT TYPE AND DEPLOYMENT ENVIRONMENT — AUTHORIZATION CODE + PKCE FOR USER-FACING APPS, CLIENT CREDENTIALS FOR MACHINE-TO-MACHINE, DEVICE CODE FOR BROWSERLESS CLIENTS — USING THE WRONG FLOW INTRODUCES CREDENTIAL EXPOSURE VECTORS THAT THE CORRECT FLOW ARCHITECTURALLY ELIMINATES.Votes: 0GitHub stars: 20
- Api Craft> LLM-judgment critique of API design quality — the ceiling counterpart to rule-based API checks (OpenAPI-format compliance and webhook-format validation). A linter can confirm a path is documented and a schema validates; only judgment can tell whether the endpoint sits at the right abstraction, whether the HTTP verb is honest, whether a resource name belongs in the URL or a query param, whether a stranger could predict the response shape, and whether the error tells the consumer what to do. ...Votes: 0GitHub stars: 20
- Api Authentication Patterns> API AUTHENTICATION PATTERNS MAP CLIENT TYPE, TRUST LEVEL, AND TOKEN LIFETIME TO THE CORRECT CREDENTIAL SCHEME — CHOOSING THE WRONG MECHANISM (E.G., API KEYS FOR USER-DELEGATED ACCESS) INTRODUCES AUDIT GAPS, OVER-PRIVILEGED TOKENS, AND REVOCATION FAILURES THAT COMPROMISE EVERY API ENDPOINT DOWNSTREAM.Votes: 0GitHub stars: 20
- Nemoclaw User Configure SecurityPresents a risk framework for every configurable security control in NemoClaw. Use when evaluating security posture, reviewing sandbox security defaults, or assessing control trade-offs. Trigger keywords - nemoclaw security best practices, sandbox security controls risk framework, nemoclaw credential storage, credentials.json, api key security, openclaw security controls, nemoclaw security boundary, prompt injection, tool access control.Votes: 0GitHub stars: 2
- Nemoclaw Maintainer Security Code ReviewPerforms a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.Votes: 0GitHub stars: 2
- Application Security Reviewapplication-security-review — Review application repos for concrete security issues, especially trust-boundary failures, prompt-injection paths, auth/proxy mistakes, validation gaps, and risky dependencies.Votes: 0GitHub stars: 56
- X Twitter ScraperUse when the user needs X (Twitter) data or confirmation-gated X actions through Xquik: tweet search, user lookup, follower extraction, media download, monitoring, webhooks, MCP, SDKs, posting, likes, DMs, and profile updates. Requires a Xquik API key. Never ask for X login material.Votes: 0GitHub stars: 47
- StrixInstall, configure, and operate Strix for AI-driven application security testing. Use when you need to run authorized vulnerability scans against local codebases, GitHub repositories, staging URLs, domains, or CI pipelines; configure Docker and LLM providers; choose quick, standard, or deep scan depth; or pass authenticated testing instructions to Strix. Triggers on: strix, ai pentest, vulnerability scan cli, appsec scan, bug bounty automation, strix ci, strix docker, strix scan mode, strix i...Votes: 0GitHub stars: 47
- Security Best PracticesRouting-first skill for web/application/API hardening. Use when the main job is classifying which security layer is missing — browser/perimeter policy, session/cookie/CSRF, abuse controls, validation/unsafe execution, secrets/runtime config, or verification — and turning vague OWASP/security asks into one concrete hardening brief. Route auth-stack choice to `authentication-setup`, schema work to `database-schema-design`, code-level bug fixing to `debugging` / `code-review`, and environment wi...Votes: 0GitHub stars: 47
- Authentication SetupDesign or refactor product authentication setup for web apps and APIs. Use when choosing hosted/framework-native/platform-native/enterprise-add-on/self-hosted auth, sessions vs JWTs, OAuth/social login, passkeys, org/member models, callback/cookie environment setup, or SSO/SCIM rollout boundaries.Votes: 0GitHub stars: 47
- Agent ReachOperate Panniantong/Agent-Reach, the MIT-licensed installer, doctor, and routing layer for platform-specific internet research tools. Use when the user names Agent Reach, agent-reach, its channel doctor, optional backend setup, OpenCLI integration, cookie configuration, transcription, or an Agent Reach update or uninstall. Choose fit-check, offline preflight, scoped setup, channel routing, credential handoff, transcription, or maintenance. Preserve existing skills: upstream installation can r...Votes: 0GitHub stars: 47
- Securityread-only security audit. Primary owner: secrets, OWASP, CVE and PII findings. Do not use for: security remediation. Use when this role is selected by the Agent-Vorcl-Flow router.Votes: 0GitHub stars: 2
- Security AuditПрактический security-аудит Node/React — OWASP Top 10 с grep-паттернами и точками поиска, разбор npm audit (severity, false positives, overrides), чек-лист заголовков/CORS/cookie, severity-шкала и принципы доказательного отчёта. Use для аудита уязвимостей кода, проверки зависимостей на CVE и оформления security-findings.Votes: 0GitHub stars: 2
- Secrets DetectionОбнаружение секретов в коде и git-истории — паттерны ключей (sk-, ghp_, AKIA, xox., private keys, user:pass@), поиск в рабочем дереве и git log -p --all, gitleaks/trufflehog и grep-альтернативы, фильтр ложных срабатываний (env-подстановки, плейсхолдеры), протокол реагирования с обязательной ротацией. Use для поиска утёкших ключей/токенов/паролей и проверки перед пушем.Votes: 0GitHub stars: 2
- SecurityRead-only Security Auditor: secrets, OWASP, dependency CVE и PII/GDPR findings с evidence и severity.Votes: 0GitHub stars: 2
- Security VorclSecurity-цель через Task Master — аудит → findings → задачи на фиксы → делегирование исполнителям (роль security, read-only). Use when аудит должен закончиться задачами и циклом починки, а не отчётом.Votes: 0GitHub stars: 2
- Security SecretsПоиск секретов в рабочем дереве И git-истории — паттерны ключей, connection strings, git log -p по всем веткам (роль security, read-only). Use при подозрении на утечку ключей/токенов/паролей.Votes: 0GitHub stars: 2
- Security Pre PushБыстрый комплексный чек изменённых файлов перед пушем — секреты + очевидные инъекции + PII; зелёный/красный вердикт с доказательствами (роль security, read-only). Use when нужно быстро решить «можно ли пушить».Votes: 0GitHub stars: 2
- Security OwaspOWASP Top 10 в коде — injection, XSS, broken auth, sensitive exposure, CORS, cookie-флаги в Node/React (роль security, read-only). Use для аудита уязвимостей кода.Votes: 0GitHub stars: 2
- Security AuditПрактический security-аудит Node/React — OWASP Top 10 с grep-паттернами и точками поиска, разбор npm audit (severity, false positives, overrides), чек-лист заголовков/CORS/cookie, severity-шкала и доказательный отчёт. Use для аудита уязвимостей кода и CVE в зависимостях.Votes: 0GitHub stars: 2
- Skill DeconflictDetect and resolve naming collisions, overlapping intent triggers, and insufficient intent diversity across the skill library. Load when a new skill is created (called by universal-skill-creator), during improvement passes (called by improve-skills), or when the user asks to deconflict skills, check for naming collisions, audit trigger overlap, review intent coverage, find duplicate triggers, check skill names, or says "are any skills too similar", "which skills overlap", "deconflict the libr...Votes: 0GitHub stars: 3
- Shipping And LaunchPrepare safe production launches — pre-launch checklist, monitoring, staged rollout, and rollback. Load when deploying to production, releasing a major change, opening beta access, or the user asks for a launch checklist, go-live plan, rollout strategy, or rollback plan. Not for local-only prototypes. Pairs with ci-cd-and-automation and app-security-hardening.Votes: 0GitHub stars: 3
- Secure SkillSecurity audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for inje...Votes: 0GitHub stars: 3