Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Scan installed skills for security risks and audit platform configuration. When to use: user requests security scan, security analysis, skill audit, OpenClaw health check, config audit, security baseline check, pre-install, safety check, supply chain security check, or asks "is this skill safe". Trigger phrases: "security scan", "安全扫描", "安全分析", "风险评估", "安全体检", "skill audit", "配置审计", "安全基线", "skill安全扫描", "检查skill风险", "这个skill安全吗", "安装前检查", "能不能装这个skill".
Use when storing credentials, tokens, or secrets securely, debugging SecItem errors (errSecDuplicateItem, errSecItemNotFound, errSecInteractionNotAllowed), managing keychain access groups, or choosing accessibility classes. Covers SecItem API mental model, uniqueness constraints, data protection, biometric access control, sharing between apps, and Mac keychain differences.
Validate plans, designs, and implementations before execution to prevent costly mistakes. Cover architecture review, security audit, scalability assessment, cost analysis, compliance check, and risk identification. Produce go/no-go decisions with specific remediation steps. Triggers on "review this plan", "validate architecture", "check for mistakes", "is this production ready", "audit this design", "what could go wrong", "pre-flight check", "build review", "quality gate", "risk assessment", "cost estimate", or "compliance check".
Integrates Clerk authentication in React/Vite, Next.js App Router, and Cloudflare Workers apps. Covers ClerkProvider setup, clerkMiddleware and createRouteMatcher for protected routes, token verification with @clerk/backend verifyToken, custom JWT templates and session claims (user.public_metadata, org_id, org_role) for RBAC, Hono integration via @hono/clerk-auth, shadcn/ui auth components, and Playwright E2E testing with @clerk/testing, +clerk_test emails and the 424242 OTP. Documents 11 pitfalls: Missing Clerk Secret Key, JWKS cache races, missing authorizedParties CSRF risk, Core 2 import path changes, JWT size limits, ClerkProvider cannot be used as a JSX component, async auth() confusion, and Vite dev 431 header errors. Use when adding Clerk to a project, protecting routes, verifying tokens, shaping JWT claims, testing auth flows, or debugging Clerk authentication errors.
A hard pre-adoption gate for every third-party dependency, in any language. Before a new package — or a major version bump — is added in js, go, python, kotlin, rust, ruby, java, anything: resolve its exact identity, scan it for known CVEs, review its supply-chain behaviour on socket.dev and snyk, then install it inside a disposable, network-isolated Docker container with no host mounts to inspect its full transitive dependency tree and what it runs at install time. Nothing enters the project until it passes.
Use when the user asks to update, bump, or migrate Java, Kotlin, Gradle, Maven, Node, or TypeScript dependencies; audit direct or transitive dependencies for CVEs or security advisories; or remediate a dependency vulnerability. Preserves the package manager, applies small verified upgrades, and checks vulnerability, release-age, and supply-chain risk.
Harden GitHub Actions and Dependabot: create or modify workflow YAML, reusable workflows, or .github/dependabot.yml; configure dependency updates, alerts, graphs, private registries, and pull-request automation; audit security, correctness, reliability, cost, or performance.
Use when managing Google Play developer account users, permissions, grants, or testers. Make sure to use this skill whenever the user mentions gpc users, gpc testers, gpc grants, developer account permissions, user roles, invite user, remove user, permission grants, per-app permissions, per-app grants, standalone grants, tester groups, beta testers, internal testers, alpha testers, Google Group testers, tester CSV import, team management, access control, user audit — even if they don't explicitly say 'user management.' Also trigger when someone wants to invite team members to their Play Console, update permissions for existing users, manage per-app grants independently from users, manage who can test their app, import testers from a CSV file, or audit who has access to their developer account. For authentication setup, see gpc-setup. For release track management, see gpc-release-flow.
Guides security assessment of embedded and cyber-physical systems on hardware-in-the-loop (HIL) test benches—bench setup, ECU/ECM or PLC targets, bus interfaces (CAN/CAN-FD, LIN, automotive Ethernet, Modbus at high level), fault injection and stimulus design, simulated plant/environment integration, attack-surface monitoring on real hardware, reproducible test cases, lab safety interlocks, and evidence capture for firmware and vehicle security teams. Use for HIL security testing, ECU security assessment, CAN bus security, PLC HIL test, fault injection lab, embedded hardware security—not web/API pentest (web-pentester), network-only pentest (network-pentester), malware/binary RE only (reverse-engineer), SOC operations (soc-analyst), AI red team (ai-redteam), classified ISSO paperwork (information-systems-security-officer-classified-specialist), or pure software CI without hardware (build-validator).
Add Face ID / Touch ID / fingerprint authentication to an Ionic Capacitor app via @aparajita/capacitor-biometric-auth. Trigger when adding biometric login, app lock, secure reauthentication, or Face ID/Touch ID gating to a sensitive feature.
JSON Web Tokens for authentication. Covers token structure, signing, and validation. Use for stateless authentication. USE WHEN: user mentions "JWT", "token authentication", "access token", "refresh token", asks about "stateless auth", "token signing", "token validation" DO NOT USE FOR: session-based auth (use session management), OAuth flows (use oauth2 skill), NextAuth.js (use nextauth skill)
Nginx configuration, reverse proxy, SSL/TLS, load balancing, and performance tuning. Use for: nginx, reverse proxy, load balancer, proxy_pass, ssl certificate, lets encrypt, web server, location block, upstream, server block, nginx config, certbot, hsts, gzip, rate limiting.
Diagnose why Claude Code is (or isn't) prompting for permission. By default reads only repo-local layers (CLI project, CLI project-local, VSCode workspace). Host-global layers (CLI user `~/.claude/`, VSCode user settings) are read ONLY when the user explicitly confirms — those files may contain unrelated paths or secrets. Use when user says "why is it asking me to approve?", "permission check", "why am I getting prompts?", "bypass isn't working", "check my permissions". Read-only diagnostic.
Build, review, debug, configure, migrate, teach, or plan Permix type-safe permissions with current docs and a full usage guide. Use for permix, createPermix, setup, check, template, dehydrate, hydrate, isReady, isReadyAsync, ~all/~any, ValidateDefinition, Rules, ReBAC closures, permix/react, permix/vue, permix/solid, permix/svelte, permix/next, permix/tanstack-start, createSetupHandler, permix/express, permix/hono, permix/elysia, permix/fastify, permix/node, permix/server, permix/trpc, permix/orpc, permix/nest, permix.guard, @Check, permix/drizzle, permix/effect, and Permix v3 to v4 migration.
Diff newly enacted or amended regulations against current personal information handling rules and practices — outputting a gap list and a remediation plan with owners and dates. Use when a new regulation lands and the user asks "does [regulation] affect us", "[regulation] gap analysis", "compliance check against [regulation]", or pastes regulation text.
Blockchain smart contract specialist for Solidity, EVM, security patterns, and gas optimizationUse when "smart contract, solidity, ethereum, evm, contract, web3, gas optimization, upgradeable contract, reentrancy, solidity, ethereum, smart-contracts, evm, web3, blockchain, defi, nft, security, gas" mentioned.
Guides SOC operations—alert triage, SIEM/EDR investigation, enrichment, playbook execution, false-positive closure, escalation decisions, and detection tuning feedback. Use when working SOC queues, investigating suspicious alerts, correlating events, documenting analyst notes, or deciding escalate vs close—not for declared incident command, timelines, evidence preservation, or regulatory comms (incident-responder), incident program design (incident-management-engineer), binary/firmware RE (reverse-engineer), red team operations (red-team-specialist), or enterprise security strategy (cybersecurity).
This skill should be used when user asks to "query Supabase", "list Supabase tables", "get Supabase schema", "search Supabase records", "check Supabase database", "Supabase auth", "Supabase authentication", "RLS policy", "row level security", "Supabase foreign key", "table relationships", "Supabase join", "Supabase filter", "Supabase pagination", or needs guidance on Supabase database patterns, auth flows, RLS policies, or query best practices.
This skill should be used when managing Tailscale mesh VPN networks. Use when the user asks to "check tailscale status", "list tailscale devices", "ping a device", "send file via tailscale", "tailscale funnel", "tailscale serve", "create auth key", "check who's online", "tailscale exit node", "Magic DNS", or mentions Tailscale network management, tailnet operations, or VPN connectivity.
Implements compliance with Turkey's Personal Data Protection Law (Kisisel Verilerin Korunmasi Kanunu, KVKK, Law No. 6698). Covers data controller obligations, data subject rights, VERBIS registration, cross-border transfer restrictions, Board decisions, and administrative fines. Keywords: KVKK, Turkey, VERBIS, data controller registry, Board decision, cross-border.
Security research meta-thinking methodology — a vulnerability hunting methodology framework distilled from 5,600+ security documents in the Xianzhi community. Use this skill when: - You need a systematic thinking framework for vulnerability hunting and security research - Analyzing attack paths for specific vulnerability types (web injection, deserialization, binary, domain penetration, etc.) - You need mental models for bypassing protections (WAF, EDR, sandbox) - You need a Source-Sink analysis methodology for code auditing - You need full attack chain planning for red team operations - You need fast solving approaches for CTF competitions - You need methodological guidance for reverse engineering malware Triggers: vulnerability hunting, security research, penetration testing, code auditing, red team operations, CTF, reverse engineering, WAF bypass, AV evasion, privilege escalation, lateral movement, domain penetration, deserialization, binary security, fuzzing
Enterprise WLAN for mobile users—RF/site surveys, AP placement, 802.11 (Wi-Fi 5/6/6E/7), channel/power planning, SSID/VLAN segmentation, WPA3/802.1X/RADIUS, guest/captive portal, roaming (802.11k/r/v, band steering), high-density and mesh/outdoor, LAN/SD-WAN edge integration, troubleshooting (SNR, DFS, CCI). This skill should be used when the user asks about Wi-Fi, wireless mobility, WLAN design, wireless survey, AP placement, 802.11, Wi-Fi 6, Wi-Fi 6E, roaming, 802.11k, 802.11r, band steering, WPA3, 802.1X, enterprise wireless, high density Wi-Fi, channel planning, RF interference, wireless troubleshooting, Aruba, Meraki wireless, or Cisco wireless—not cellular RAN/5G core, MPLS/BGP backbone (network-backbone-architect), SD-WAN overlay (sd-wan-engineer), cloud VPC only (cloud-architect), MDM-only, or OT ISA wireless (scada-ics-cyber-security-specialist).
Alibaba Cloud Cloud Firewall ACL rule read-only diagnostic assistant. **Trigger Scenarios**: Diagnose ACL rules not taking effect, troubleshoot Internet/NAT/VPC firewall traffic issues, query traffic logs, check matched rules, get configuration guidance (console manual operation). **Supported firewall types**: Internet Firewall, NAT Boundary Firewall, VPC Boundary Firewall **Keywords**: Cloud Firewall rules not taking effect, Internet Firewall ACL diagnosis, NAT Firewall policy not working, VPC Boundary Firewall rule diagnosis, firewall rule diagnosis ⚠️ **DO NOT use** for WAF issues - use alibabacloud-waf-rule-management skill instead. TEXT-ONLY console guidance. Queries and diagnosis only, no configuration changes.
Use this skill when users ask about SASE terminal device management, user account queries, inactive device analysis, or device locking on Alibaba Cloud SASE (product code: csas). Trigger scenarios: "查下哪些设备长期离线", "某部门有多少 终端设备", "锁定闲置设备", "查看用户被授权了哪些应用". Capabilities: flexible device querying with 20+ filters (department, device type, OS, SASE feature status, etc.), user listing, user application authorization queries, inactive device analysis, and locking inactive devices. Deletion or irreversible operations are NOT supported — users are guided to the SASE console. Note: user activity analysis is currently not supported (the API does not provide the user's last active time, and device bindings change).
Check for updates to installed community skills. Show the diff and require explicit approval before applying. Use when the user says "check for updates", "update my skills", "what's new for installed skills", or when called from the registry-sync agent.
Use when SecItem calls fail — errSecDuplicateItem from unexpected uniqueness, errSecItemNotFound despite item existing, errSecInteractionNotAllowed in background, keychain items disappearing after app update, access group entitlement errors, or Mac keychain shim issues. Covers systematic error diagnosis with decision trees.
Use when needing SecItem function signatures, keychain attribute constants, item class uniqueness constraints, accessibility level details, SecAccessControlCreateFlags, kSecReturn behavior per class, LAContext keychain integration, or OSStatus error codes. Covers complete keychain API surface.
botlearn-healthcheck — BotLearn autonomous health inspector for OpenClaw instances across 5 domains (hardware, config, security, skills, autonomy); triggers on system check, health report, diagnostics, or scheduled heartbeat inspection.
Designs and executes tabletop breach simulation exercises for testing organizational breach response capabilities. Covers scenario creation with realistic inject timelines, participant role assignment, communication testing across internal and external channels, decision-point evaluation, and after-action report generation. Keywords: tabletop exercise, breach simulation, incident response testing, scenario design, after-action report.
Implements profiling restrictions for children under GDPR Recital 71, Article 22, UK AADC Standard 12, and COPPA. Covers prohibition of behavioural advertising to children, recommendation algorithm limitations, nudge technique prohibition, and automated decision-making safeguards. Keywords: profiling, children, behavioural advertising, recommendation algorithm, AADC, automated decision.
Review code for bugs, security vulnerabilities, performance issues, and maintainability. Trigger with "review this code", "check this PR", "look at this diff", "is this code safe?", or when the user shares code and asks for feedback.
Research-backed code review skill with OWASP Top 10 security checks, SAST tool integration (SonarQube, CodeQL, Snyk), performance pattern detection, and automated quality standards enforcement. Auto-invoked for code review, security audit, PR analysis, and bug checking. Implements 2025 best practices with 92% faster vulnerability remediation.
Performs systematic code review with universal best practices and repo-specific standards. Auto-activates after significant code changes. Use when reviewing code, auditing files, checking PRs, examining staged changes, or when asked to "review", "check", "audit", or "examine" code. Enforces design principles (SOLID, DRY, KISS), security (OWASP), performance, concurrency safety, cross-platform compatibility, and codebase patterns.
Guides managing conflicting privacy requirements across jurisdictions. Covers data localisation vs transfer freedom, consent standards variation, age thresholds, breach timelines, and resolution frameworks for incompatible obligations. Keywords: conflicting laws, data localisation, consent variation, age thresholds, resolution framework.
Implement the Kantara Initiative consent receipt specification including machine-readable receipt structure, JWT-based verification mechanisms, receipt lifecycle management, and integration patterns for consent management platforms. Supports ISO/IEC 27560 consent record information structure.
Methodology for auditing A/B testing of consent banners to ensure compliance with equal ease of acceptance and rejection. Covers CNIL enforcement patterns including the EUR 150M Google fine, dark pattern detection methodology, manipulative design identification, and regulatory-compliant experimentation boundaries.
Evaluating and implementing cookie-less tracking alternatives for a post-cookie era. Covers the Privacy Sandbox APIs (Topics, Attribution Reporting, Protected Audiences), server-side analytics, and privacy-preserving measurement techniques.
Handles GDPR Art. 10 criminal conviction and offence data classification including official authority requirements, national law derogations, and comprehensive register restrictions. Covers controller obligations for criminal background checks and offence records. Keywords: criminal data, Art 10, conviction data, offence records, criminal background, DBS check.
Implementing cookie compliance across multiple jurisdictions including EU ePrivacy Directive, UK PECR, US California CCPA/CPRA opt-out model, and Brazil LGPD. Provides a requirements matrix and geolocation-based implementation approach.
Builds comprehensive data inventory per GDPR Art. 30 Records of Processing Activities. Covers system-by-system discovery, data flow diagramming, third-party identification, and legal basis per category. Keywords: data inventory, data mapping, Art 30, RoPA, data flow, processing activities.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.