690 skills · sorted by relevance
Analyze Solidity smart contracts with Slither and Mythril before Ethereum deployment. Combine code inspection with execution path analysis, review potential vulnerabilities, remove duplicate findings, and produce an audit report with severity ratings and suggested fixes.
Review dependency manifests and lockfiles to find outdated packages and known security vulnerabilities. Group proposed updates by version change, report current and suggested versions, and identify updates that need human review.
Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.
Run an AI vulnerability scan on uncommitted changes, changes against main, or an entire codebase. Filter candidate files, investigate potential security issues, and review findings with severity ratings, with options to revalidate and export results.
Reviews Algorand smart contracts written in TEAL or PyTeal for 11 vulnerability patterns. Produces a complete coverage table and findings with code references, severity ratings, and suggested fixes, with optional automated checks using Tealer.
Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.
Creates custom Semgrep rules to detect vulnerabilities, bug patterns, or coding standard violations. Builds tests for unsafe and safe examples, then validates and refines each rule to check for false alarms and missed cases.
Review Cosmos SDK modules and CosmWasm contracts for vulnerabilities that could halt a chain, cause fund loss, or produce inconsistent state. Findings are checked against consensus execution paths and saved as individual Markdown reports with severity and fixes.
Assess Docker, containerd, and Podman environments for weaknesses that could expose the host system. The skill organizes checks for excessive permissions, exposed runtime sockets, and known vulnerabilities, alongside indicators defenders can monitor.
Build a threat model that identifies valuable assets, attack entry points, potential threats, and mitigation priorities. Use source code and past vulnerabilities, an interview with the application owner, or a combination of both.
Review source code without running it to identify potential security vulnerabilities. Findings include severity, confidence, attack scenarios, and suggested fixes, delivered as JSON for further triage and Markdown for human review.
Examines code or code changes for plausible security vulnerabilities by tracing attacker-controlled input to dangerous operations or failed safeguards. Records candidate issues with affected locations, supporting evidence, potential impact, and controls that need further validation.
Turn vulnerability notes, proof-of-concept code, source code, or security findings into self-contained reports. The skill checks claims against evidence, explains prerequisites and demonstrated impact, and supports both individual vulnerabilities and collections of disclosure reports.
Review web code for security, browser compatibility, and code quality. Covers HTTPS, dependency vulnerabilities, security headers, outdated APIs, HTML structure, error handling, and cleanup of event listeners, with examples and audit checklists to guide improvements.
Check an OpenClaw environment for risky settings, unsafe skills, known software vulnerabilities, and privacy exposure. It combines local checks with optional online threat lookups and also supports reviewing individual skills before installation.
Assess internet-exposed VMware management services by identifying versions, matching known vulnerabilities, and checking authentication settings and information exposure. Use the findings to document affected services, supporting evidence, and the potential impact on virtual infrastructure.
Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.
Investigate Next.js security issues across Server Actions, middleware, image optimization, and cached pages. Provides testing workflows for authentication bypass and data exposure, with checks to distinguish actual vulnerabilities from normal responses.
Assess externally exposed enterprise SSL VPN gateways by identifying products, checking known vulnerabilities, and reviewing authentication backends and SAML settings. The skill provides vendor-specific checks and a staged workflow that starts with less disruptive identification before deeper testing.
Investigate browser-side security flaws in DOM handling, cross-window messages, Service Workers, and CSS. Trace untrusted input to sensitive operations and verify observable impact, helping distinguish reproducible vulnerabilities from harmless signals.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
The English summary is being prepared. Showing the original description.