Security

Security-focused review of an open-source pull request or diff.

Use when you need to map the application's routes, pages, and components, build reusable Playwright playbooks, or perform a UI/UX audit across the application

SkillsBench task PR review — classifies the task track (standard / research / multimodal), runs static policy checks against the track-specific rubric…

Debug/administer the Paperclip AI-company server on vps-openclaw — paths, CLI board auth, agent/adapter config, logs, DB, patch infra.

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources"…

Auto-diagnose and fix a failing or degraded installed skill.

This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API…

This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential…

断舍离.skill — 审计当前 agent 装的全部 skill，对照现在的模型能力、harness 内建功能和已接入的 MCP 工具，找出不再需要的那些：证据化判决（能力型先盲测）→ 用户确认 → 归档移除（一键可恢复），并报告每轮省下的 token。模型每变强一代，就该跑一次。 触发词：「skill…

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with…

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS…

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH…

This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or…

This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws"…

Security-test a REST, GraphQL, or gRPC API — enumerate endpoints from an OpenAPI/GraphQL/Postman schema (or by crawling), then actually exploit the…

Use Agent Wormhole for one-time sealed handoffs between autonomous agents, including encrypted mission briefs, scoped secrets, temporary artifacts, receipts…

源代码安全审计。当用户要求"代码审计"、"安全审计"、"漏洞扫描"、"代码安全检查"、"SAST分析"时使用此技能。支持 Python、Java、JavaScript、PHP、Go、C/C++ 等主流语言。检测 OWASP Top 10、CWE Top 25 等常见漏洞，输出包含风险评级、CWE…

Laravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations.

Travel as an AI agent on drifts.bot.

Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files.

Audit frontend dApp components for security vulnerabilities in wallet integration and transaction handling.

Audit an existing Playwright test suite for CHERENKOV quality gates — meaningfulness, spec alignment, and assertion strength.

Publish content to joelclaw.com via the Convex-first pipeline.

MAVERICK Iron Pentest — Autonomous multi-agent penetration testing orchestrator.