1.9K skills · sorted by relevance
Scans repository structure and generates comprehensive architecture documentation including system overview, entry points, module relationships, data flow diagrams, and "edit here for X" guides. Creates ARCHITECTURE.md for onboarding and navigation. Use when users request "document the codebase", "explain the architecture", "create onboarding docs", or "map the system".
The English summary is being prepared. Showing the original description.
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of 'Criticals' completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an 'app'/'console'/'dashboard'/'portal' subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.
The English summary is being prepared. Showing the original description.
Speed-optimized offensive checklist for rapid assessment: quick-win vulnerability patterns, fast recon shortcuts, automated scanner configurations, and triage shortcuts. Use for time-boxed assessments, CTF-speed engagements, or initial rapid surface mapping.
The English summary is being prepared. Showing the original description.
Systematic bug identification methodology: source code review patterns, black-box testing strategies, taint analysis, dangerous function hunting, data flow tracing, and automated scanning setup. Use for code audits, bug bounty triage, or building vulnerability identification pipelines.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.
The English summary is being prepared. Showing the original description.
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
The English summary is being prepared. Showing the original description.
Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase.
The English summary is being prepared. Showing the original description.
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.
The English summary is being prepared. Showing the original description.
Weekly churn risk detection across active client accounts. Scans for signals like decreased engagement, missed meetings, delayed payments, and competitor mentions. Scores risk 1-10 and outputs prioritized alert list.
The English summary is being prepared. Showing the original description.
Full pipeline from signal detection to scored lead in CRM. Chains signal-scanner, lead-scorer, and crm-writer into one flow.
The English summary is being prepared. Showing the original description.
End-of-day response check and pipeline update. Run at 6 PM via cron. Checks all channels for replies via Chrome DevTools MCP + Zoho MCP, updates lead statuses, pauses cadence for responded leads, sends EOD report via Telegram.
The English summary is being prepared. Showing the original description.
Full daily sales pipeline execution. Run at 9 AM via cron. Scans for signals, enriches company leads, auto-applies to gigs, runs multi-channel outreach, processes follow-ups. All delivery automated via Chrome DevTools MCP.
The English summary is being prepared. Showing the original description.
Search the web for companies showing buying signals matching the agency ICP. Enforces 75/25 geo split and 20 gig + 5 company daily targets.
The English summary is being prepared. Showing the original description.
Use when closing out a feature, tidying developing/ documentation, or asked to check docs health — runs the lifecycle linter and applies the README deletion rules.
The English summary is being prepared. Showing the original description.
Use when the user requests React Doctor or a React code-health audit, or when a concrete React diagnostic question would benefit from its scan. Not a default step after React changes or before committing.
The English summary is being prepared. Showing the original description.