subagent-driven-development
Use when executing implementation plans with independent tasks in the current session Execute plan by dispatching fresh subagent per task, w…
⌘K Publish Compliance / risk
Audit, risk assessment · 390 skills
Filter and sort390 results
agent-architecture-audit
Full-stack diagnostic for agent and LLM applications.
pr-review
Review a PR for correctness, security, code quality, and testing issues.
frontend-design
Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.
backend-code-review
Review backend code for quality, security, maintainability, and best practices based on established checklist rules.
backend-code-review
Review backend code for quality, security, maintainability, and best practices based on established checklist rules.
code-reviewer
Reviews code for security vulnerabilities, performance issues, and best practices.
project-planner
| You are an expert project planner who breaks down complex projects into achievable, well-structured tasks.
sprint-planner
| You are an expert scrum master who facilitates effective sprint planning for agile teams.
strategy-advisor
| You are a strategic advisor who provides high-level thinking and business decision guidance.
cso
Chief Security Officer mode.
design-review
Designer's eye QA: finds visual inconsistency, spacing issues, hierarchy problems, AI slop patterns, and slow interactions — then fixes them…
devex-review
Live developer experience audit.
ios-design-review
Visual design audit for iOS apps on real hardware.
plan-design-review
Designer's eye plan review — interactive, like CEO and Eng review.
plan-devex-review
Interactive developer experience plan review.
docs-review
Review, improve, rewrite, author, or plan Storybook documentation in /docs.
caveman-review
> Write code review comments terse and actionable.
seo-review
Perform a focused SEO audit on JavaScript concept pages to maximize search visibility, featured snippet optimization, and ranking potential…
agent-coordination
> Spawn and coordinate agents for complex multi-agent tasks.
agent-planner
Agent skill for planner - invoke with $agent-planner type: coordinator color: "#4ECDC4" description: Strategic planning and task orchestrati…
agent-reviewer
Agent skill for reviewer - invoke with $agent-reviewer color: "#E74C3C" description: Code review and quality assurance specialist priority:…
agent-security-manager
Agent skill for security-manager - invoke with $agent-security-manager name: security-manager color: "#F44336" description: Implements compr…
agent-sparc-coordinator
Agent skill for sparc-coordinator - invoke with $agent-sparc-coordinator name: sparc-coord type: coordination description: SPARC methodology…
agent-trading-predictor
Agent skill for trading-predictor - invoke with $agent-trading-predictor name: trading-predictor description: Advanced financial trading age…
agent-v3-security-architect
Agent skill for v3-security-architect - invoke with $agent-v3-security-architect name: v3-security-architect version: "3.0.0-alpha" updated:…
ci-cd-and-automation
Automates CI/CD pipeline setup.
typescript-review
Review TypeScript and JavaScript code changes for compliance with Metabase coding standards, style violations, and code quality issues.
creating-financial-models
This skill provides an advanced financial modeling suite with DCF analysis, sensitivity testing, Monte Carlo simulations, and scenario plann…
visual-design-foundations
Apply typography, color theory, spacing systems, and iconography principles to create cohesive visual designs.
claude-md
在继续之前，你必须先考虑用户输入（如果不为空）。用户可能会指定： 围绕三个维度组织 CLAUDE.md： 对于较大的项目，建议创建 agent_docs/ 文件夹： |- buildingtheproject.md |- running_tests.md;
claude-md
Create or update CLAUDE.md files following best practices for optimal AI agent onboarding You MUST consider the user input before proceeding…
impeccable
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, e…
impeccable
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, e…
agent-governance
| Patterns for adding safety, trust, and policy enforcement to AI agent systems.
agent-owasp-compliance
| Evaluate AI agent systems against the OWASP Agentic Security Initiative (ASI) Top 10 — the industry standard for agent security posture.
agent-supply-chain
| Generate and verify integrity manifests for AI agent plugins and tools.
agentic-eval
| Patterns for self-improvement through iterative evaluation and refinement.
ai-seo
When the user wants to optimize content for AI search engines, get cited by LLMs, or appear in AI-generated answers.
content-strategy
When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover.
copy-editing
When the user wants to edit, review, or improve existing marketing copy, or refresh outdated content.
seo-audit
When the user wants to audit, review, or diagnose SEO issues on their site.
deep-research
Universal deep research tool — a domain-agnostic 13-agent team for rigorous academic research on any topic.
brainstorm
Activate brainstorming mode for collaborative discovery and creative problem-solving.
agents-md-sync
Analyze code changes on the current branch and recommend updates to AGENTS.md files that have become stale.
skill-test
Validate skill files for structural compliance and behavioral correctness.
accessibility-review
Run a WCAG 2.1 AA accessibility audit on a design or page.
brand-review
Review content against your brand voice, style guide, and messaging pillars, flagging deviations by severity with specific before/after fixe…
comp-analysis
Analyze compensation — benchmarking, band placement, and equity modeling.
compliance-check
Run a compliance check on a proposed action, product feature, or business initiative, surfacing applicable regulations, required approvals,…
legal-risk-assessment
Assess and classify legal risks using a severity-by-likelihood framework with escalation criteria.
skillify
| A feature is "properly skilled" when all 11 checklist items pass.
project-manager
Project management expert for Agile, estimation, risk management, and stakeholder communication A certified project management professional…
trader-hand-skill
Expert knowledge for autonomous market intelligence and trading — technical analysis, risk management, Alpaca API, financial data sources Fo…
skill-security-auditor
> Scan and audit AI agent skills for security risks before installation.
skill-tester
Validate, test, and score the quality of skills within the claude-skills ecosystem.
skill-security-auditor
Security auditing for code, configs, and infrastructure.
implementing-purdue-model-network-segmentation
'Implement network segmentation based on the Purdue Enterprise Reference Classify all network assets and data flows according to the Purdue…
spring-boot-engineer
Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6 authentication flows, sets up Spring Data J…
skill-scanner
Scan agent skills for security issues.
finance-core-analysis
Use when multiple plausible dates exist and "latest" is not implied.
tester
Use when running tests.
skill-manager
> Remove or quiet a community skill after install.
inkos
Autonomous novel writing CLI agent with web workbench (InkOS Studio) - use for creative fiction writing, standalone short-fiction packages,…
portfolio-distribution
Use this skill for making final portfolio allocation decisions, determining optimal position sizing, and providing actionable trading recomm…
trading-strategy
Use this skill for developing and evaluating trading strategies by synthesizing technical analysis, market sentiment, and risk management pr…
agentic-actions-auditor
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex…
algorand-vulnerability-scanner
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validatio…
ask-questions-if-underspecified
Clarify requirements before implementing.
audit-augmentation
> Projects findings from external tools (SARIF) and human auditors (weAudit) onto Trailmark code graphs as annotations and subgraphs.
audit-context-building
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
audit-prep-assistant
Prepares codebases for security review using Trail of Bits' checklist.
burpsuite-project-parser
Searches and explores Burp Suite project files (.burp) from the command line.
c-review
Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilitie…
cairo-vulnerability-scanner
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address c…
code-maturity-assessor
Systematic code maturity assessment using Trail of Bits' 9-category framework.
cosmos-vulnerability-scanner
Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence…
differential-review
> Security-focused code review for PRs, commits, and diffs.
dimensional-analysis
Annotates codebases with dimensional analysis comments documenting units, dimensions, and decimal scaling.
entry-point-analyzer
Analyzes smart contract codebases to identify state-changing entry points for security auditing.
firebase-apk-scanner
Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed clo…
fp-check
Systematically verifies suspected security bugs to eliminate false positives.
graph-evolution
> Builds Trailmark code graphs at two source snapshots and computes a structural diff.
insecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production.
secure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow.
semgrep
>- Run a Semgrep scan with automatic language detection, parallel execution via Task subagents, and merged SARIF output.
sharp-edges
Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes.
solana-vulnerability-scanner
Scans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and…
spec-to-code-compliance
Verifies code implements exactly what documentation specifies for blockchain audits.
substrate-vulnerability-scanner
Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin…
supply-chain-risk-auditor
Identifies dependencies at heightened risk of exploitation or takeover.
token-integration-analyzer
Token integration and implementation analyzer based on Trail of Bits' token integration checklist.
ton-vulnerability-scanner
Scans TON (The Open Network) smart contracts for 3 critical vulnerabilities including integer-as-boolean misuse, fake Jetton contracts, and…
trailmark
Builds and queries multi-language source code graphs for security analysis.
trailmark-structural
Runs full Trailmark structural analysis on Trailmark 0.2.x by building a graph, running `preanalysis()`, and reporting hotspots, taint, blas…
variant-analysis
Find similar vulnerabilities and bugs across codebases using pattern-based analysis.
zeroize-audit
Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-lev…
ads
Multi-platform paid advertising audit and optimization skill.
ads-amazon
Amazon Ads deep analysis covering Sponsored Products, Sponsored Brands (incl.
ads-audit
Full multi-platform paid advertising audit with parallel subagent delegation.
ads-google
Google Ads deep analysis covering Search, Performance Max, AI Max, Display, YouTube, and Demand Gen campaigns.
ads-linkedin
LinkedIn Ads deep analysis for B2B advertising.
ads-meta
Meta Ads deep analysis covering Facebook, Instagram, and Threads advertising in the Andromeda + GEM + Lattice era.
ads-tiktok
TikTok Ads deep analysis covering creative quality, tracking, bidding, campaign structure, and TikTok Shop under the TikTok USDS Joint Ventu…
project-management
GitHub issue and project-board management for the dotnet/msbuild repo.
skill-vetter
Security-first skill vetting protocol for AI agents.
agent-readiness-audit
> Audit the live site, not the source tree alone.
skill-quality-reviewer
This skill should be used when the user asks to "analyze skill quality", "evaluate this skill", "review skill quality", "check my skill", or…
skill-review
Quality review and audit for Claude Code skills.
skill-writing
Write and improve agent skills (SKILL.md files).
skill-audit
Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review Comprehensive, methodical auditing t…
skill-claw
OpenClaw instance administration — manage hosts across macOS, Ubuntu/Debian, Docker, OCI, and Proxmox DETECT PLATFORM FIRST.
skill-code-review
Expert multi-AI code review with inline PR comments — use for thorough quality and security analysis Invokes the code-reviewer persona for t…
skill-coverage-audit
Trace codepaths in diffs, map against tests, auto-generate missing coverage — use before shipping PRs Trace every codepath in a diff, map ea…
skill-debug
Debug issues methodically — use when stuck on errors, test failures, or unexpected behavior NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST…
skill-native-escalation-routing
Route ordinary init, review, and security requests to Claude-native capabilities first;
skill-parallel-agents
Decompose large tasks across parallel agents — use for migrations, multi-file refactors, or batch work DISCOVER DEFINE DEVELOP DELIVER (prob…
skill-security-framing
URL validation and content sanitization for untrusted sources — use when handling external input safely This skill defines security patterns…
skill-ship
Package and finalize completed work for delivery — use when a feature is done and ready to ship Finalize and deliver completed work with Mul…
skill-staged-review
Review code in two passes: spec compliance then quality — use for thorough PR or feature reviews This generated Codex skill preserves an enf…
skill-writing-plans
Create zero-context implementation plans with bite-sized tasks — use for multi-step feature planning Write comprehensive implementation plan…
skill-improver
Trigger: improve skills, audit skills, refactor skills, skill quality.
bc-check
Analyze a qlty pull request (or the current branch) for backwards-incompatible behavior changes.
factory
In-depth guide to Factory, a container-based dependency injection system for Swift and SwiftUI.
apm-usage
> APM (Agent Package Manager) is the open-source package manager for AI coding agents.
skill-install
Install Claude skills from GitHub repositories with automated security scanning.
bug-bounty
Full pipeline: Recon -> Learn -> Hunt -> Validate -> Report.
skill-best-practices
Authors and structures professional-grade agent skills following the agentskills.io spec.
comptable
| Co-pilote comptable, fiscal et facturation pour entreprises françaises.
skill-install-guardian
Inspect third-party Claude/OpenClaw/Codex/OpenCode skills, plugins, repos, npm packages, pip packages, shell installers, and GitHub Actions…
skill-listing-polisher
Improve a skill's public listing before publish.
skill-releaser
Release skills to ClawhHub through the full publication pipeline — auto-scaffolding, OPSEC scan, dual review (agent + user), force-push rele…
skill-vetter
Security vetting protocol before installing any AI agent skill.
skill-vetting
Vet ClawHub skills for security and utility before installation.
paper-spine
Internal orchestrator — users should use /paperspine to start a full workflow.
skillshare-codebase-audit
>- Read-only consistency audit across the skillshare codebase.
skillshare-update-docs
>- Sync website documentation with recent code changes.
skill-judge
Evaluate Agent Skill design quality against official specifications and best practices.
skill-evolve
Refine, create, or retire your own skills based on recurring patterns from past sessions You are evolving your own skills.
wordpress-router
Use when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickl…
spring-boot
Spring Boot 3.x development - REST APIs, JPA, Security, Testing, and Cloud-native patterns.
github-contributor
A phase-based playbook for shipping pull requests that maintainers actually want to merge.
i18n-expert
This skill should be used when setting up, auditing, or enforcing internationalization/localization in UI codebases (React/TS, i18next or si…
marketplace-health-check
>- Run a comprehensive, evidence-based health check of this Claude Code skills marketplace repo using a parallel fan-out Dynamic Workflow.
product-analysis
Multi-path parallel product analysis that combines Claude Code agent teams and Codex CLI for cross-model test-time compute scaling.
qa-expert
This skill should be used when establishing comprehensive QA testing processes for any software project.
weather-safety-guardrails
Keep activity suggestions safe and respect local conditions
skill-authoring
>- Use when creating a new skill, reviewing or auditing skill structure and frontmatter, or debugging skill loading and triggering issues.
skill-authoring
Design, improve, and evaluate reusable agent skills with high-quality SKILL.md files, precise trigger descriptions, progressive disclosure,…
akka-net-testing-patterns
Write unit and integration tests for Akka.NET actors using modern Akka.Hosting.TestKit patterns.
crap-analysis
Analyze code coverage and CRAP (Change Risk Anti-Patterns) scores to identify high-risk code.
dependency-injection-patterns
Organize DI registrations using IServiceCollection extension methods.
OpenTelemetry-NET-Instrumentation
Provides guidance for implementing OpenTelemetry instrumentation in .NET codebases, covering tracing (Activities/Spans), metrics, naming con…
axiom-accessibility
Use when fixing or auditing ANY accessibility issue — VoiceOver, Dynamic Type, color contrast, touch targets, WCAG compliance, App Store acc…
axiom-analyze-crash
Use when the user has a crash log (.
axiom-analyze-swift-performance
Use when the user mentions Swift performance audit, code optimization, or performance review.
axiom-audit-accessibility
Use when the user mentions accessibility checking, App Store submission, code review, or WCAG compliance.
axiom-audit-camera
Use this agent to scan Swift code for camera, video, and audio capture issues including deprecated APIs, missing interruption handlers, thre…
axiom-audit-codable
Use when the user mentions Codable review, JSON encoding/decoding issues, data serialization audit, or modernizing legacy code.
axiom-audit-concurrency
Use when the user mentions concurrency checking, Swift 6 compliance, data race prevention, or async code review.
axiom-audit-core-data
Use when the user mentions Core Data review, schema migration, production crashes, or data safety checking.
axiom-audit-database-schema
Use when the user mentions database schema review, migration safety, GRDB migration audit, or SQLite schema checking.
axiom-audit-energy
Use when the user mentions battery drain, energy optimization, power consumption audit, or pre-release energy check.
axiom-audit-foundation-models
Use when the user mentions Foundation Models review, on-device AI audit, LanguageModelSession issues, @Generable checking, or Apple Intellig…
axiom-audit-grdb-performance
Use when the user mentions GRDB performance review, slow GRDB queries, app-group database setup audit, or pre-release GRDB scan.
axiom-audit-iap
Use when the user mentions in-app purchase review, IAP audit, StoreKit issues, purchase bugs, transaction problems, or subscription manageme…
axiom-audit-icloud
Use when the user mentions iCloud sync issues, CloudKit errors, ubiquitous container problems, or asks to audit cloud sync.
axiom-audit-liquid-glass
Use when the user mentions Liquid Glass review, iOS 26 UI updates, toolbar improvements, or visual effect migration.
axiom-audit-memory
Use when the user mentions memory leak prevention, code review for memory issues, or proactive leak checking.
axiom-audit-networking
Use when the user mentions networking review, deprecated APIs, connection issues, or App Store submission prep.
axiom-audit-spritekit
Use when the user wants to audit SpriteKit game code for common issues.
axiom-audit-storage
Use when the user mentions file storage issues, data loss, backup bloat, or asks to audit storage usage.
axiom-audit-swiftdata
Use when the user mentions SwiftData review, @Model issues, SwiftData migration safety, or SwiftData performance checking.
axiom-audit-swiftui-architecture
Use when the user mentions SwiftUI architecture review, separation of concerns, testability issues, or "logic in view" problems.
axiom-audit-swiftui-layout
Use when the user mentions SwiftUI layout review, adaptive layout issues, GeometryReader problems, or multi-device layout checking.
axiom-audit-swiftui-nav
Use when the user mentions SwiftUI navigation issues, deep linking problems, state restoration bugs, or navigation architecture review.
axiom-audit-testing
Use when the user wants to audit test quality, find flaky test patterns, speed up test execution, or prepare for Swift Testing migration.
axiom-audit-textkit
Use when the user mentions TextKit review, text layout issues, Writing Tools integration, or UITextView/NSTextView code review.
axiom-audit-ux-flow
Use when the user mentions UX flow issues, dead-end views, dismiss traps, missing empty states, broken user journeys, or wants a UX audit of…
axiom-debug-tests
Use this agent for closed-loop test debugging - automatically analyzes test failures, suggests fixes, and re-runs tests until passing.
axiom-design
Use when making design decisions, implementing HIG patterns, Liquid Glass, SF Symbols, typography, or structuring app entry points and authe…
axiom-fix-build
Use when the user mentions Xcode build failures, build errors, or environment issues.
axiom-health-check
Use when the user wants a comprehensive project-wide audit, full health check, or scan across all domains.
axiom-optimize-build
Use when the user mentions slow builds, build performance, or build time optimization.
axiom-performance
Use when app feels slow, memory grows, battery drains, or diagnosing ANY performance issue.
axiom-profile-performance
Use when the user wants automated performance profiling, headless Instruments analysis, or CLI-based trace collection.
axiom-run-tests
Use when the user wants to run XCUITests, parse test results, view test failures, or export test attachments.
axiom-security
Use when storing credentials securely, encrypting data, implementing passkeys, securing AI/agentic features against prompt injection, code s…
axiom-test-simulator
Use when the user mentions simulator testing, visual verification, push notification testing, location simulation, screenshot capture, OR li…
axiom-validate-screenshots
Use when the user mentions App Store screenshot validation, screenshot review, checking screenshots before submission, or verifying screensh…
skill-review
Critically review a workspace skill and suggest improvements.
skill-auditor
A comprehensive auditor for any agent skill — including Manus, OpenClaw/ClawHub, Claude, LobeHub, or custom SKILL.md-based skills.
superpowers-brainstorm
Produces a structured brainstorm: goals, constraints, risks, options, recommendation, and acceptance criteria.
superpowers-plan
Writes an implementation plan with small steps, exact files to touch, and verification commands.
superpowers-workflow
Enforces a disciplined workflow for coding, debugging, refactoring, and automation: brainstorm -> plan -> implement with verification (prefe…
skill-scanner
Scan agent skills for security issues.
skills-manager
Universal consolidation & audit skill for Claude Code skills.
Gold Analysis
Analyze gold, gold-linked ETFs, and gold miners through macro drivers, positioning, and event risk Use this skill when the user asks about g…
skill-health
Audit skill configurations for correctness and freshness Audits all skill configurations, checks for stale or broken skills, and reports on…
skill-scanner
Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them.
skill-vetter
Security-first skill vetting for AI agents.
skillguard
Security scanner for AgentSkill packages.
branding
When the user wants to define, audit, or apply brand strategy—purpose, values, positioning, storytelling, voice, narrative (not only visuals…
carousel
When the user wants to design, optimize, or audit carousel/slider layouts for content display.
skill-benchmark
Benchmark AI skill effectiveness by measuring implementation quality against legacy constraints.
kicad
>- Use when the user says things like "compare designs", "what changed", "diff my schematic", "show changes from main", or "diff base vs hea…
skill-audit
Audit all Claude Code skills for stale references, broken paths, and deprecated tool names Audit .claude/skills/ for drift: broken file path…
Skill Health
Audit skill metrics, file/resolve issues in memory/issues/, and notify on state change only <!-- autoresearch: variation C — more robust: me…
Skill Repair
Diagnose and fix failing or degraded skills automatically — systemic-first triage, per-category playbooks, verification plan <!-- autoresear…
Skill Security Scan
Audit skills, workflows, and companion scripts for injection, exfiltration, traversal, and prompt-override risks with delta tracking, baseli…
skill-analytics
Weekly fleet-level skill-run analytics — ranks skills by 7d run count, surfaces success rates, exit-taxonomy distribution, and anomaly flags…
skill-freshness
Audit every enabled skill's upstream file dependencies for staleness — flags chained skills about to consume yesterday's article or a long-d…
skill-update-check
Check imported skills for upstream changes and security regressions since the version in skills.lock <!-- autoresearch: variation B — sharpe…
skill-author
> Create new agent skills that work across Claude Code (CLI/IDE) and IBM Bob.
skill-trust-auditor
Audit a ClawHub skill for security risks BEFORE installation.
skill-evaluator
Evaluates agent skills against Anthropic's best practices.
skill-best-practices
Authors and structures professional-grade agent skills following the agentskills.io spec.
skill-auditor
Audits skills in this repo for consistency, API drift, and structural gaps.
skill-auditor
'Audit an existing SKILL.md against the unified AgentOps template (15 Use when ` markers OR `metadata.
skill-builder
Scaffold a new SKILL.md.
review
Review code changes against WooCommerce iOS standards Review the current changes for compliance with WooCommerce iOS conventions.
src-hunter
这是一个带强制 checkpoint 的工作流,不是参考手册。每个阶段有 MUST 输出,未通过不进下一阶段。详细 payload / playbook / H1 案例按需 Read,不准凭记忆生成。
skill-scanner
Scan agent skills for security issues before adoption.
safety-monitor
Safety Monitor Agent responsible for compliance and safety checks.
status
Show sprint progress Show current sprint progress with minimal token usage.
skills-audit
Audit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks.
wxmini-security-audit
微信小程序全自动安全审计 Skill。使用 Agent Teams 编排多个 Agent，分阶段完成从反编译到报告生成的全流程静态安全分析。
SA-8(31)_secure-system-modification
Implement the security design principle of secure system modification in [organization-defined].
skill-domain-discovery
> You are extracting domain knowledge for a library to produce a structured domain map.
skill-authoring
Guide creating Claude Code skills with TDD and persuasion principles.
skill-graph-audit
Audit Skill() refs; detect hubs, isolates, and dangling targets.
skills-eval
Evaluate Claude skill quality through auditing.
skill-governance-loop
Use when the user asks to review a skill, analyze skill quality, update a skill version, or run a repeatable keep/disable/archive decision l…
skills-governance
Use when auditing a large local skill collection, identifying duplicate or imported skills, comparing skill roots, or deciding what to keep,…
skill-judge
Evaluate Agent Skill design quality against official specifications and best practices.
skill-auto-improver
Improve a SKILL.md to pass the skill-creator standard (quick_validate, frontmatter audit, ≤500 lines) AND the asm-eval 85/8 floor.
skill-index-updater
Add GitHub skill repos to the ASM index: clone, audit, eval, regenerate index, rebuild catalog, open PR.
skill-security-auditor
基于《OpenClaw 极简安全实践指南》和《安全验证与攻防演练手册》的 Skill 安全审计工具。对 OpenClaw Skill 进行从源码到运行时的全生命周期安全审查，覆盖供应链投毒、Prompt 注入载荷、恶意代码模式、权限越权等威胁向量。
prd-v05-technical-stack-selection
Determine technologies needed to build the product, making build/buy/integrate decisions during PRD v0.5 Red Team Review.
skills-qualitaetspruefung
Qualitaet installierter Skills prüfen: Normaktualitaet, Description-Qualitaet, Struktur-Compliance.
skill-permissions
Skill permission analysis, one-time authorization, analyze skill permissions, batch authorization Automatically analyze permissions required…
skills
Skill management - create, validate, and improve Claude Code skills START(["/skills"]) --> NEED{"What do you need?"} NEED -->|New skill| WOR…
skills:scan
Scan a repository to bootstrap new skills or audit and update existing ones Bootstrap skills for a new repo, or audit and update skills in a…
skills:validate
Validate skill files meet the standard format and naming conventions Skills operate on either sandbox (safe) or management (requires approva…
amazon-listing-optimization
Amazon listing builder and optimizer for sellers.
dropshipping-product-research
Product research for dropshipping businesses.
skill-optimization
Evaluates and optimizes skill file quality using 8 content patterns and 9 editing principles.
skill-security-audit
Audit the agent's own skill library for malicious, misconfigured, or untrusted SKILL.md files.
skill-authoring
Guidelines for writing Agent Skills that comply with the agentskills.io specification.
skill-creation-walkthrough
Step-by-step guide for creating your own Claude Skills, from deciding whether a skill is the right tool to writing the SKILL.md file, struct…
skill-authoring
>- Use when creating a new skill, reviewing or auditing skill structure and frontmatter, or debugging skill loading and triggering issues.
skillshare-codebase-audit
>- Read-only consistency audit across the skillshare codebase.
skillshare-update-docs
>- Sync website documentation with recent code changes.
ring:testing-skills-with-subagents
| Run scenarios without the skill (RED — watch agent fail), write skill addressing those failures (GREEN), then close loopholes (REFACTOR).
skill-sonar
Lifecycle guard.
skill-tester-ci
Validates all CI skills in this repo.
skill-check
Use when the user wants to validate, lint, or audit agent skill files (SKILL.md).
skill-security-auditor
> Scan and audit AI agent skills for security risks before installation.
skill-tester
> The agent validates skill packages for structure compliance, tests Python scripts for syntax and stdlib-only imports, and scores quality a…
CodeReview
AI-powered code review via roborev.
vuln-research
| 从先知社区5600+篇安全文档中提炼的漏洞挖掘核心思维框架。
gen
开始时声明："我正在使用 gen skill 运行代码生成。" 默认运行 API 代码生成（storagev2、iam、media、audit）： 如果用户提到 sandbox，则运行： make generate-sandbox 对比生成前后的变更，列出生成产生的文件差异。
powerpoint
|- <powerpointprofessionalsuite> <highfidelitycreation> The preferred method for precise layout positioning: </highfidelitycreation> <templa…
update-deps
Audit all outdated dependencies with detailed research on changelogs, breaking changes, bug fixes, and deprecations.
powerpoint-slides
| Use when MCP returns no images, or when page-region cropping is needed:.
andrej-karpathy-skills
Minimal, goal-driven, surgical coding workflow adapted from forrestchang/andrej-karpathy-skills for OMK.
pbi-doc
Documenta projeto Power BI (PBIP) inteiro em markdown estruturado + HTML navegável (mini-site de doc).
testcase-writer-plus
Parse requirement and analysis files, then generate high-quality test cases.
prompt-engineering
Universal prompt engineering techniques for any LLM.
lawyer-analyst
| Analyze events through the disciplinary lens of law, applying rigorous legal methodologies (statutory interpretation, case law analysis, l…
audit-docs
Orchestrate sequential documentation audits with checkpointing and resumption.
canonical-data-map
Single source of truth for all paths, naming conventions, and data formats across the OpenClaw Greek Accounting system.
risk-management
Manages financial risks through quantitative analysis, modeling, and mitigation strategies.
sns-patterns
SNS posting patterns and strategy
erne-worker
ERNE — Autonomous ticket execution — polls a provider, picks up ready tickets, and runs the full ERNE pipeline (validate, plan, code, test,…
mlx
Use when working with Apple's MLX or MLX-LM: fact-checking current behavior against upstream source/runtime, patching MLX-based repos, porti…
angular-spa
Angular 21.x SPA development skill with TailwindCSS 4.x and daisyUI 5.5.5.
ai-skill-improve
Improves an existing skill based on real project pain (prior eval corpora under .ai-engineering/evals/, Engram cross-session observations, L…
cc-safe-setup
Safety hooks for Claude Code — 700 pre-built hooks that prevent file deletion, credential leaks, git disasters, and token waste during auton…
hinge-profile-optimizer
Comprehensive, research-backed Hinge dating profile optimization.
hs
ACTIVATE THIS SKILL FOR ANY SHELL COMMAND OR FILE READ.
am-agent-code-refactor
Improve code structure, performance, and maintainability through systematic refactoring.
am-agent-code-security-auditor
Comprehensive security analysis and vulnerability detection for codebases.
vp-audit
Audit state, docs drift, and stack best-practice compliance — works on any project Output this banner as the first thing on every invocation…
cloudflare-agent
Enable ControlKeel governance for Cloudflare Agents with policy gates, budget enforcement, PII detection, and secure execution.
codebaseanalyser
Performs comprehensive deep analysis of entire codebase and deployment pipeline to identify issues in production environment.
defect-detection
Analyze manufacturing defect detection and quality control systems — computer vision inspection pipelines, SPC control charts, Six Sigma pro…
agent-browser
Automates browser interactions for web testing, form filling, screenshots, and data extraction.
accessibility-auditor
Audit interfaces for accessibility issues across semantics, keyboard use, focus management, color contrast, labels, and announcements.
api-regression-guard
Check whether code changes silently broke API contracts, behavior, schemas, or compatibility expectations.
backup-restore-validator
Check whether backup and restore plans are actually restorable, verifiable, and operationally safe.
bom-cost-optimizer
Propose lower-cost bill-of-material substitutions while preserving critical requirements, interfaces, and risk constraints.
capacity-planning-assistant
Estimate scaling risks, bottlenecks, and saturation points before traffic spikes or launches.
citation-checker
Check whether claims are adequately supported by cited sources and flag weak or mismatched citations.
compliance-evidence-collector
Gather code, config, docs, and operational proof points for audits and internal compliance reviews.
cost-hotspot-finder
Identify cloud and platform spend hotspots, waste, and likely optimization wins.
customer-support-triage
Classify support requests, ask the right follow-up questions, choose the correct troubleshooting path, and draft responses in the desired su…
data-analyst-workflow
Clean and inspect datasets, check assumptions, compute summary statistics, find anomalies, and translate results into plain-English takeaway…
dependency-upgrade-scout
Plan safe dependency upgrades by identifying version jumps, breaking changes, migration steps, and validation needs.
design-system-enforcer
Review UI changes against spacing, typography, tokens, component usage, and design-system constraints.
dockerfile-hardener
Improve Dockerfiles for image size, caching, security, reproducibility, and multi-stage build hygiene.
feature-flag-rollout-planner
Design staged feature-flag rollouts, guardrails, monitoring, and rollback logic for risky product changes.
hardware-bringup-checklist
Validate power, buses, firmware, interfaces, and low-level sanity checks during hardware bringup.
incident-postmortem-writer
Turn incident timelines, logs, tickets, and chat snippets into a clear postmortem covering impact, detection, root cause, contributing facto…
k8s-deployment-sheriff
Review Kubernetes manifests, deployment defaults, probes, resources, security context, and rollout safety.
knowledge-base-gap-finder
Identify what documentation is missing by comparing support issues, product behavior, and existing docs.
literature-review-mapper
Map papers by topic, method, findings, gaps, and trends.
meeting-notes-to-action-items
Convert raw meeting notes, transcripts, or chat logs into decisions, action items, owners, due dates, risks, and follow-up questions.
migration-assistant
Plan and carry out technical migrations such as dependency upgrades, framework changes, runtime version bumps, routing changes, schema moves…
mobile-release-checker
Validate mobile release readiness by checking build artifacts, versioning, store requirements, crash risk, config, and pre-ship blockers.
personal-ops-assistant
Run a lightweight personal operating system by reviewing tasks and notes, clustering priorities, drafting weekly plans, surfacing risks, and…
policy-diff-explainer
Explain what changed between old and new policy documents and why the differences matter.
pr-review-enforcer
Review diffs like a senior engineer by checking correctness, architectural fit, style, missing tests, security smells, and migration or oper…
query-optimizer
Review SQL queries, execution plans, schema usage, and indexes to propose safer faster alternatives.
10x-analysis
Build (or refresh) a structured hypothesis on whether a specific company can grow 5x and 10x in valuation over the next 5 years, then track…
agent-audit
Audits Claude Code agent configuration against latest best practices.
agent-definition-auditor
Audit and score an agent-definition markdown such as `AGENTS.md`, `CLAUDE.md`, `SKILL.md`, `SOUL.md`, `.cursorrules`, or a system prompt usi…
agent-instruction-forge
Guide humans through creating effective instruction rules for coding agents (Copilot, Claude Code, Cursor, Windsurf, Aider, AGENTS.md, CLAUD…
agents-md-lint
Audit and trim AI agent instruction files (AGENTS.md, CLAUDE.md, CONVENTIONS.md, .cursorrules, etc.) by testing which facts an AI agent can…
ai-agent-sdd
Write a professional Software Design Document (SDD) for an AI agent or AI-powered product before writing code.
all-marketing
Full-spectrum marketing and SEO skill library with 160+ specialist skills.
analyzing-machine-learning-in-investing
Evaluates ML applications in investment with feature engineering, model selection, and implementation considerations for alpha generation.
authoring-skills
Creates, updates, improves, and audits Agent Skills.
backend-architecture
> Use when this capability is needed.
ceratops-code-consistency-audit
Audit a repository after large refactors, branch merges, or parallel agent threads for contradictions between implementation, docs, configs,…
ci-cd-generator
Scaffold/audit GitHub Actions CI/CD — Go/Rust/TS.
ci-cd-review
CI/CD review for workflows, artifact safety, caching, deployment gates, secrets, permissions, and reproducibility.
ci-cd-ssdf-security
GitHub Actions security hardening, CI/CD pipeline integrity, release security, and SSDF alignment Use when this capability is needed.
claudemd-curator
Audit and improve project-memory artifacts (CLAUDE.md, AGENTS.md, .claude/rules/*.md, .claude.local.md).
clawdfolio
> Quantitative portfolio toolkit for professional investors.
code-review
Review code changes, diffs, commits, branches, or PRs for correctness, regressions, security-sensitive mistakes, maintainability issues, and…
codebase-ai-readiness
| Use when this capability is needed.
codex-oss-maintainer-toolkit
Build Codex-native workflows for open-source maintenance.
create-audit-agent
Creates new Claude Code agent configuration files or audits existing ones in .claude/agents/.
django-smoke-alarm
Run and triage Django/DRF security smoke checks for settings hardening, throttling, safe HTML, ORM race/idempotency patterns, and model inte…
docs-agent-md
Create, refresh, or reconcile the repository root `AGENTS.md` using current branch truth.
dotnet-security
| Use when this capability is needed.
Falco Runtime Security
Use the upstream install or setup path that matches your environment: Requirements and caveats from upstream: Basic usage or getting-started…
fastapi-patterns
FastAPI patterns for async APIs, dependency injection, Pydantic request and response models, OpenAPI docs, tests, security, and production r…
federated-learning-homomorphic
This skill covers the implementation of privacy-preserving machine learning Use when this capability is needed.
fft-demo-holodeck-ops
Drive the FFT_demo_dash holodeck system — scene triggers, agent commentary, canvas presets, and live weather mirroring — to produce impactfu…
fleet-manager
Monitors the fleet of concurrent workflows across every registered domain (api/shared/domains.py).
generate-sandbox-policy
Generate sandbox security policies from plain-language requirements and optional REST API documentation.
golang-troubleshooting
Troubleshoot Golang programs systematically - find and fix the root cause.
health
Verify Codex configuration health — AGENTS.md, hooks, config.toml, agents, skills, secrets scan, and MCP reachability.
hello-auditkit
Use this skill to audit, review, validate, or check the quality of AI assistant configurations including prompt text, prompt files, skills (…
implementing-file-integrity-monitoring-with-aide
Configure AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring including baseline creation, Use when this capabilit…
implementing-network-policies-for-kubernetes
Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control Use when this capability…
instructions-detox
Audit Copilot instruction files for bloat, overlap, stale rules, and weak applyTo scope.
ios-swift
> Use when this capability is needed.
java-security
| Use when this capability is needed.
kubernetes-cloudkube-audit
This skill covers hardening managed Kubernetes clusters on EKS, AKS, and GKE by implementing Pod Security Standards, network policies, workl…
kubernetes-etcd-kubernetes-analyze
Assess the security posture of Kubernetes etcd clusters by evaluating encryption at rest, TLS configuration, access controls, backup encrypt…
kubernetes-general-overview-analyze
Auditing Kubernetes cluster RBAC configurations to identify overly permissive roles, wildcard permissions, dangerous ClusterRoleBindings, se…
kubernetes-hardening-kubernetes-analyze
Audit Kubernetes cluster security posture against CIS benchmarks using kube-bench with automated checks for control plane, worker nodes, and…
kubernetes-hardening-kubesecmanifest-detect
Perform security risk analysis on Kubernetes resource manifests using Kubesec to identify misconfigurations, privilege escalation risks, and…
kubernetes-hardening-podsecurity-exploit
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Securit…
kubernetes-network-k8snetpol-harden
Kubernetes NetworkPolicies provide pod-level network segmentation by defining ingress and egress rules that control traffic flow between pod…
kubernetes-network-kubernetes-analyze
Implement Kubernetes network segmentation using Calico NetworkPolicy and GlobalNetworkPolicy for zero-trust pod-to-pod communication.
kubernetes-operator
Use when building a Kubernetes Operator — custom controllers that reconcile CRD state.
kubernetes-pentest-kubernetes-analyze
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet,…
kubernetes-principles
Kubernetes and Helm standards for manifests, charts, values files, RBAC, workloads, networking, policy, validation, or deployment review.
langchain-audit
Audit LangChain configuration and security Use when: "audit langchain, Use when this capability is needed.
marketing-seo-audit
When the user wants to audit, review, or diagnose SEO issues on their site.
migrate-agents-to-codex
>- Use when this capability is needed.
mugiwara
> Use when this capability is needed.
onboard
Agent-driven cold-start onboarding.
op1-marketing-seo-experiment-stage1
Run and audit OperatorOne Stage1 marketing SEO shadow experiments across input sync, context index, keyword graph, experiment synthesis, and…
owasp-security-standards
Use when reviewing code for security vulnerabilities, implementing authentication/authorization, handling user input, or discussing web appl…
performing-kubernetes-penetration-testing
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against Use when this capability…
project-ployglot-project-scafford
Scaffold a polyglot library project as TypeScript + Python twin packages under `packages/ts/` + `packages/py/`, with a shared `SPEC.md`, cro…
react-native-mobile-hardening
React Native mobile testing, performance, and release hardening for this repo.
researchbuddy-tap-maintainer
Use when publishing or updating the ResearchBuddy Homebrew tap.
rf-legal-specialist
Юрист-профессионал по законодательству РФ.
rule-quality-evaluator
Evaluate the quality of existing agent instruction rule sets — CLAUDE.md, AGENTS.md, .cursorrules, copilot-instructions.md, or any coding-ag…
rust-quality-gates
Set up Rust quality gates (cargo check/build, clippy, rustfmt, dead code, unused deps via cargo-machete, doc build, tests) in any Rust repo,…
rust-security
| Use when this capability is needed.
sast-analysis
Static Application Security Testing (SAST) for multi-language codebases.
security-best-practices
Perform language and framework specific security best-practice reviews and suggest improvements.
senior-backend
This skill should be used when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microser…
sentry-selfhosted
| Use when this capability is needed.
seo-audit
Run a full SEO, AEO, and LLM discoverability audit on cc4.marketing Use when this capability is needed.
ship
Ship current branch — CI, SonarCloud, code review, security review, fix all issues, merge.
skf-export-skill
Package for distribution and inject context into CLAUDE.md/AGENTS.md/.cursorrules.
skill-audit
Audits a Claude Code / Agent SDK skill (or folder of skills) against 10 QA Use when this capability is needed.
spinngo-databingo
When the user/agent works with SpinnGo (Spill 4 / game5 / spillorama-slug), databingo classification, the 30%-til-organisasjoner-regel, the…
sql-database-patterns
Use this skill when the agent is designing schemas, reviewing migrations, tuning queries, modeling NoSQL access patterns, configuring replic…
swift-review
Review Swift/iOS code: SwiftUI, Combine, UIKit, App Store guidelines and iOS architecture Use when this capability is needed.
terraform-patterns
**UTILITY SKILL** — Reusable Azure Terraform patterns: hub-spoke, private endpoints, diagnostics, AVM-TF modules.
terraform-principles
Terraform and OpenTofu standards for .tf, .tfvars, .tofu, modules, providers, state, plans, policy checks, and IaC review.