642 skills · sorted by relevance
Set up the 1Password CLI and use stored passwords or API keys in commands and configuration templates. Choose an authentication method, retrieve secret references, and pass credentials to processes through environment variables.
Move memories, persona files, skills, and compatible settings from OpenClaw into Hermes. Preview the migration, choose how to handle conflicts and supported secrets, and receive a report of migrated, archived, and skipped items.
Review a Homecore server operation plan before startup. Check authentication, restoration order, feature tests, speech provider configuration, and handling of pairing secrets. The skill reviews the plan without starting the server.
Review page source, browser JavaScript, and Git history for exposed API keys, passwords, and tokens. Identify potential leaks and guide fixes, including moving secrets to the server, replacing compromised credentials, and adding checks before commits.
Analyze running containers in a CTF sandbox by comparing declared configuration with live processes, mounts, and routes. Trace how secrets and helper containers affect behavior, then document the earliest mismatch and a minimal evidence chain.
Generate Kubernetes YAML files that define how applications run, connect, receive configuration, and use persistent storage. Include resource limits, health checks, security settings, labels, and validation guidance for production-oriented deployments.
Review MCP configurations for exposed credentials, risky command patterns, and package versions that can change unexpectedly. Produce a report with severity levels and suggested fixes without running the commands defined in the configuration.
Ask plain-language questions about AWS resources, settings, and costs, and receive readable tables using read-only AWS CLI commands. Inspect services and filter results by region, state, or tags without creating, changing, or deleting resources.
Create, review, migrate, or troubleshoot Azure Developer CLI projects. Align application settings, infrastructure definitions, deployment environments, secrets, and automated delivery workflows while checking that configuration files and deployment requirements agree.
Audit GitHub Actions workflows and CI/CD configurations for supply chain risks. Use Python and YAML parsing to identify unpinned actions, unsafe event expressions, excessive permissions, dependency confusion, and potential exposure of secrets in build pipelines.
Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.
Define the documentation needed to review and hand over an AI-built app. Map architecture, permissions, configuration, secrets, and test coverage, adding relevant operational documents so reviewers can compare intended behavior with implementation and identify verification gaps.
Audit and strengthen security for applications running on GKE. Configure pod traffic restrictions, sandbox isolation, namespace security standards, and Secret Manager volume mounts to protect workloads at the application and namespace level.
Review source code, dependencies, and infrastructure settings for security issues. Find exposed credentials, unsafe input handling, and access control gaps, then organize findings into a report with severity levels, affected locations, and recommended fixes.
Request a new API key or login through a single-use, expiring link. The submitted credential is encrypted and saved to the person's keychain, keeping secrets out of chat and making them available to the task.
Audit C/C++ and Rust code for secrets left in memory. It checks missing or incomplete wipes, examines compiler output for removed cleanup operations, and produces reports with evidence and suggested fixes.
Plan security testing for IoT and embedded devices, from circuit board inspection and firmware analysis to wireless links, companion apps, and cloud APIs. Includes tools, investigation checklists, and guidance for documenting findings.
Assess AWS, Azure, and GCP environments by identifying identities, permissions, and paths to broader access or data exposure. Covers cloud storage, secrets, cross-account trust, and CI/CD, the automated systems used to build and deploy software.
Guides security testing of Android and iOS apps through file inspection and observation while the app runs. Covers network traffic, stored secrets, external app interfaces, authentication, and backend APIs, with tool examples and a testing checklist.
Develop and deploy Cloudflare Workers, manage related storage and services, and troubleshoot configuration with Wrangler. The skill checks official documentation and configuration definitions before preparing commands, with guidance for local development, environments, secrets, and logs.
Deploy n8n on a Linux server using Docker Compose and Caddy for automatic HTTPS. Choose a single instance or queue workers, configure secrets and Python task runners, and follow procedures for updates, backups, and recovery.
Plan and configure Kubernetes deployments, Git-based continuous delivery, and cloud resources defined in code. Covers Helm, Kustomize, ArgoCD, Flux, Terraform, Pulumi, and AWS CDK, with patterns for environment separation, secrets, validation, updates, and rollback.