Security

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with…

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS…

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH…

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or…

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws"…

Security-test a REST, GraphQL, or gRPC API — enumerate endpoints from an OpenAPI/GraphQL/Postman schema (or by crawling), then actually exploit the…

Use Agent Wormhole for one-time sealed handoffs between autonomous agents, including encrypted mission briefs, scoped secrets, temporary artifacts, receipts…

源代码安全审计。当用户要求"代码审计"、"安全审计"、"漏洞扫描"、"代码安全检查"、"SAST分析"时使用此技能。支持 Python、Java、JavaScript、PHP、Go、C/C++ 等主流语言。检测 OWASP Top 10、CWE Top 25 等常见漏洞，输出包含风险评级、CWE…

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations.

Travel as an AI agent on drifts.bot.

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files.

Audit frontend dApp components for security vulnerabilities in wallet integration and transaction handling.

Audit an existing Playwright test suite for CHERENKOV quality gates — meaningfulness, spec alignment, and assertion strength.

Publish content to joelclaw.com via the Convex-first pipeline.

MAVERICK Iron Pentest — Autonomous multi-agent penetration testing orchestrator.

Use when authenticating or authorizing requests to any Mailtrap API (Email Send, Email Testing/Sandbox, Templates, Contacts, Sending Domains, Suppressions).

Add UI components and pages for authentication flows including sign in, sign up, forgot password, reset password, and email verification.

Add a complete account settings page with profile editing, password changes, email updates, session management, and account deletion.

Add user authentication using Better Auth with Drizzle ORM and Neon Postgres.

Establishes Atlassian (JIRA + Confluence) connectivity for the session — the auth bootstrap that eng-stories Jira delivery, jira-update, pm-jira, and…

Run a grounded, senior-engineer PR review on a branch — verify EVERY claim against real source (no assumptions), trace the changed logic like a state-machine…

Generates optimized, production-ready Dockerfiles.

GitHub in Codespaces: auth, CI monitoring, debugging, API access.

Manage the ClaudeClaw-Plus MCP bridge — register plugins, monitor health, audit invocations, debug cross-process calls, generate plugin templates.