All categories
Security
Security audits, vulnerabilities, compliance, auth, secrets, and safe automation
- 31,845
- 1,327
Security grades appear on each card once the skill has been scanned. Newly imported skills may briefly show without a grade until the backfill job runs.
Open in full browserBrowse security skills
Showing 19,849–19,872 of 31,845 skills
- LlmUse when an application embeds a language model — chat endpoints, model SDK calls, prompt templates, retrieval or document context, agent loops — and especially when untrusted text is concatenated into a prompt, when tools or functions exposed to the model perform real actions or run with service credentials, or when model output is rendered into a page, executed, or used to build a query, command, or outbound request.Votes: 0GitHub stars: 2
- JwtUse when a codebase issues or accepts JSON Web Tokens — bearer credentials, session cookies holding a signed token, identity tokens from a login provider, key-set endpoints, or kid, jwk and jku header handling — or when asked about token forgery, algorithm confusion, alg none, weak signing secrets, or missing claim checks.Votes: 0GitHub stars: 2
- Information DisclosureUse when reviewing error handling, debug or diagnostic endpoints, framework debug flags, server banners, directory listing, what a build copies into a served directory, developer comments or credentials in shipped client code, or responses that differ by internal state — or when asked about leaked stack traces, exposed version-control directories, backup files, or verbose errors.Votes: 0GitHub stars: 2
- GraphqlUse when a codebase serves a GraphQL endpoint — schema or SDL files, resolver maps, code-first type definitions, Apollo or similar server setup, a playground, or subscriptions — and especially when introspection or suggestions may be enabled in production, resolvers fetch objects straight from a client-supplied argument, private fields sit on client-facing types, or no depth, complexity, alias, or operation limits are configured.Votes: 0GitHub stars: 2
- DeserializationUse when the application rebuilds objects from bytes it received — serialized session cookies, hidden form state, cached or queued payloads, uploaded files, binary or type-carrying blobs — or when reviewing native object readers and polymorphic type handling, and when asked to find insecure deserialization, object injection, gadget chains, or untrusted pickle, marshal, or binary formatter usage.Votes: 0GitHub stars: 2
- CsrfUse when state-changing endpoints authenticate with session cookies — email or password change, role updates, transfers, deletions — or when anti-forgery middleware is disabled, exempted or unevenly mounted, tokens are compared against a cookie, `Referer` checks or method-override parameters appear, or cookies are set without `SameSite`; also when asked about CSRF or forged requests.Votes: 0GitHub stars: 2
- CryptoUse when a codebase hashes passwords, encrypts or decrypts stored data, generates tokens, salts, nonces or session identifiers, compares a signature or a MAC, derives a key from a passphrase, or sets certificate options on an HTTP client — or when asked about weak or missing encryption, ECB mode, reused IVs, insecure randomness, fast password hashes, timing-unsafe comparison, home-made ciphers, or disabled certificate checks.Votes: 0GitHub stars: 2
- CorsUse when a server sets `Access-Control-Allow-Origin` from the request `Origin`, pairs it with `Access-Control-Allow-Credentials: true`, matches allowed origins with `startsWith`/`endsWith`/`includes` or loose regex, trusts the `null` origin or an `http://` origin, or wildcards authenticated or internal endpoints; also when asked to review cross-origin sharing configuration.Votes: 0GitHub stars: 2
- Business LogicUse when reviewing an application whose rules involve money, quantity, discounts, coupons, limits, quotas, refunds, credits, loyalty points, entitlements, or multi-step flows — or when prices, totals, or eligibility arrive from the client, when one endpoint changes behaviour depending on which parameters are present, or when asked to find logic flaws, workflow bypasses, price manipulation, or abuse-of-function bugs.Votes: 0GitHub stars: 2
- AuthenticationUse when reviewing login, registration, logout, password reset or change, remember-me tokens, multi-factor challenges, or session and cookie configuration — or when asked about brute force, account lockout, credential stuffing, username enumeration, 2FA bypass, weak password hashing, forgeable session tokens, or session fixation.Votes: 0GitHub stars: 2
- AnalysisUse when starting a security review of a web application codebase, when a detection skill reports that architecture.md is missing, or when the codebase has changed enough that the existing architecture summary is stale.Votes: 0GitHub stars: 2
- ForensifyCross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory files across Claude Code, Codex, OpenClaw, and NanoClaw. Produces a structured inventory and narrative briefing with cross-ecosystem risk analysis. Use when the user asks to audit their own setup, check what they have installed, review their agent stack security posture, or understand cross-tool interactions. Use when a user has accumulated skills/plugins/MCP serve...Votes: 0GitHub stars: 205
- Aif Security ChecklistSecurity audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".Votes: 0GitHub stars: 1,145
- Section 11Evidence-based endurance cycling coaching protocol (v11.10). Use when analyzing training data, reviewing sessions, generating pre/post-workout reports, planning workouts, answering training questions, or giving cycling coaching advice. Always fetch athlete JSON data before responding to any training question.Votes: 0GitHub stars: 33
- BlindoracleBlindOracle - Privacy-First Agent InfrastructureVotes: 0GitHub stars: 33
- GomailSend emails via the gomail sender CLI with attachments, templates, and recipient management. Use when sending or testing email delivery from OpenClaw.Votes: 0GitHub stars: 33
- UrlcheckCompanion skill for @cybrlab/urlcheck-openclaw. Requires URLCheck plugin tools to assess URLs for threats and intent alignment before navigation.Votes: 0GitHub stars: 33
- Wakapi SyncDaily Wakapi (WakaTime-compatible) summary → local CSV files. Fetch today stats and append/update CSVs for totals, top projects, and top languages.Votes: 0GitHub stars: 33
- Skill Security ScannerSecurity scanner for OpenClaw skills. Use when installing, updating, or auditing skills to detect malicious backdoors, suspicious code patterns, data exfiltration risks, and security vulnerabilities. Automatically analyzes Python/JavaScript/Shell code for dangerous functions (eval, exec, system calls), network requests, file operations, environment variable access, obfuscation patterns, and known attack signatures. Provides security score and installation recommendations.Votes: 0GitHub stars: 33
- Apex Crypto IntelligenceAI-powered multi-exchange crypto market analysis, arbitrage detection, and hedge fund-quality trading reports using live data from major exchanges.Votes: 0GitHub stars: 33
- GithubQuery and manage GitHub repositories - list repos, check CI status, create issues, search repos, and view recent activity.Votes: 0GitHub stars: 33
- PodcastindexPodcastIndexVotes: 0GitHub stars: 33
- Govee ControlScript-free Govee OpenAPI setup and control guide. Use when the user wants to get a Govee API key, connect Govee, list devices, check state, or send power/brightness/color commands with secure key handling.Votes: 0GitHub stars: 33
- Secure GmailSecure Gmail skill using Composio brokered OAuth — no raw tokens stored locally. Reads, searches, and drafts emails with least-privilege enforcement. Blocks send and delete at the Composio API gateway level, not just in code. Use when user asks to check inbox, find specific emails by sender or subject, summarize unread threads, or create reply drafts without sending. Requires COMPOSIO_API_KEY in .env and Gmail connected at app.composio.dev. Do NOT use for sending emails — use a send-confirmed...Votes: 0GitHub stars: 33