Security & Auth Skills

Website security and performance audit. Checks for vulnerabilities, accessibility issues, SEO problems, and performance bottlenecks.

Authentication best practices using Better Auth library. Session management, OAuth providers, RBAC, and security hardening.

Designs and outputs n8n workflow JSON with robust triggers, idempotency, error handling, logging, retries, and human-in-the-loop review queues. Use when you need an auditable automation that won’t silently fail.

Implements OAuth 2.0 and OIDC flows (authorization code, PKCE, client credentials) with provider-specific configurations for Google, GitHub, and more.

Implements secure JWT creation, validation, and rotation with proper algorithm selection, claim validation, and key management.

Implements comprehensive server-side input validation and sanitization for APIs and web forms to prevent injection attacks and data corruption.

Apply security best practices to code and infrastructure

Scan codebases for OWASP Top 10 vulnerabilities, insecure dependencies, and hardcoded secrets. Produces a prioritized vulnerability report with CVE references and remediation code examples.

Deep architectural context via ultra-granular code analysis before auditing

Parse BurpSuite project files for security analysis

Analyze code for timing side-channel vulnerabilities

Security-focused differential code review between versions

Analyze DWARF debug information in compiled binaries

Map application entry points for attack surface analysis

Check for false positives in security scanning results

Scans codebases, configuration files, and git history for exposed credentials, API keys, tokens, and other sensitive secrets that should not be committed.

Analyzes project dependencies for known vulnerabilities (CVEs), license compliance issues, outdated packages, and supply chain security risks.

Audit codebases and infrastructure configurations against GDPR, SOC 2, PCI-DSS, and HIPAA requirements. Produces gap analysis reports with remediation steps prioritized by risk.

Conducts automated security assessments including reconnaissance, vulnerability scanning, exploitation verification, and penetration testing report generation.

Designs and validates RBAC (Role-Based) and ABAC (Attribute-Based) access control policies, generates policy code, and audits existing authorization logic.

Validates Cross-Origin Resource Sharing (CORS) and Content Security Policy (CSP) configurations to prevent data leakage and cross-origin attacks.

Manage ClickUp tasks, docs, time tracking, comments, chat, and search via official MCP. OAuth authentication required.

Audit existing Google Analytics implementation. Checks for common issues, missing configurations, and optimization opportunities.

Audit workspace structure and memory files against OpenClaw conventions. Use when asked to "review workspace", "audit files", "check structure", or during periodic self-maintenance. Helps catch drift from standard patterns.

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guida...

Deterministically coordinates autonomous planning and execution across available skills under strict guardrails. Use only when the user explicitly activates this skill by name to run autonomously until a stop command is issued. Trigger keywords include: "use autonomous-skill-orchestrator", "activate autonomous-skill-orchestrator", "start autonomous orchestration".

Integrate HODLXXI as a Bitcoin-native identity provider that bridges OAuth2/OIDC and Lightning LNURL-Auth for client registration, authorization flows, JWT verification, and health monitoring.

PDF.co API integration with managed OAuth. Convert, merge, split, edit PDFs and extract data. Use this skill when users want to convert PDFs to/from other fo...

Security engineering workflow for OpenClaw privilege governance and hardening. Use for least-privilege execution, approval-first privileged actions, idle tim...

Manage and enforce least-privilege execution, approval-based elevation, port and egress monitoring, and ISO 27001/NIST compliance reporting for OpenClaw secu...

GitHub repository trust scoring and due diligence. Use when asked to analyze, audit, score, or evaluate any GitHub repo — especially for crypto/DeFi project...

Audit and harden OpenClaw configuration for security. Scans openclaw.json for vulnerabilities, exposed credentials, insecure gateway settings, overly permiss...

Configures and manages Cloudflare DNS, caching, security rules, rate limiting, and Workers

Access Ahrefs SEO data for site analysis, keyword research, backlink and competitor insights, rank tracking, and technical SEO audits via MCP integration.

Security audit and quarantine system for third-party OpenClaw skills. Use when evaluating, reviewing, or installing any skill from ClawHub or external source...

Design Gmail, Drive, Sheets, and Calendar automations with scope-aware plans. Use for repeatable daily task automation with explicit OAuth scopes and audit-r...

OAuth token refresh management for Google APIs via gog CLI.

Comprehensive code security audit covering OWASP Top 10, secrets detection, dependency vulnerabilities, and language-specific attack patterns. Built by Taylo...

Map application security findings to OWASP Top 10 categories and generate remediation checklists. Use for normalized AppSec review outputs and category-level...

When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analyt...

TypeScript advanced patterns — branded types, discriminated unions, template literals, generics, type guards, tsconfig optimization, and migration strategies

Run browser automation through @playwright/mcp over UXC stdio MCP, with daemon-friendly session reuse and safe action guardrails. Use when tasks need determi...

Intelligent code security scanner with hybrid local-cloud detection. Fingerprints packages, runs static behavioral analysis, and consults cloud threat intell...

Real-time, audit-ready logging integration for ClawControl.space. Ensures deterministic, per-action observability.

Security Audit Hand — security & auth tool.

Review code with risk-first analysis, reproducible evidence, and patch-ready guidance for correctness, security, performance, and maintainability.

Advanced security audit pack covering secrets lifecycle, path canonicalization, exec plan freeze, hook routing, config includes, prototype pollution, safeBin...

7-phase security audit pipeline — reconnaissance, dependency scan, application tests, API security, hardening check, OWASP verification, report. Use before p...