Agent Skill 目录与安装教程 — ClawHub、SkillsMP 与开源 Skill

io.github.affaan-m/ECC/security-bounty-hunter

在仓库中寻找可利用、值得赏金的安全问题。专注于远程可访问的漏洞，这些漏洞符合实际报告的条件，而不是嘈杂的仅本地发现。

io.github.Yeachan-Heo/oh-my-codex/security-review

Deprecated standalone security review skill

io.github.LeoYeAI/openclaw-master-skills/security-sentinel-skill

Detect prompt injection, jailbreak, role-hijack, and system extraction attempts. Applies multi-layer defense with semantic analysis and penalty scoring.

io.github.LeoYeAI/openclaw-master-skills/security-scanner-plus

Scan AI agent skills for security vulnerabilities, dangerous code patterns, and undeclared permissions. Three-layer analysis: dependency CVE scanning, static code analysis, and permission auditing. Returns structured JSON risk report. Use when the user asks to scan a skill for security issues, check for vulnerabilities, audit permissions, or assess skill safety.

io.github.LeoYeAI/openclaw-master-skills/agent-security-hardening

Security hardening patterns for production AI agents. Covers prompt injection defense (7 rules), data boundary enforcement, read-only defaults for external integrations, WAL protocol for data integrity, health check scripts, integrity gates, rule escalation ladder, and session memory security. Use when hardening agent deployments against adversarial inputs, data leaks, or operational failures. NOT for network security, infrastructure hardening, or penetration testing.

io.github.AgentFlocks/flocks/performing-docker-bench-security-assessment

Docker Bench for Security is an open-source script that checks dozens of common best practices around deploying Docker containers in production. Based on the CIS Docker Benchmark, it audits host confi

io.github.xrplevm/node/security-audit

Run a full security audit across all focus areas in parallel, reporting findings to peersyst/security

io.github.xrplevm/node/security-issue

Create a security finding in the private peersyst/security repo with proper labels and format. Use when reporting a security vulnerability, concern, or observation found during audits or ad-hoc review.

io.github.Jeffallan/claude-skills/security-reviewer

Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance. Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews, dependency audits, secrets scanning, or compliance checks. Produces vulnerability reports, prioritized recommendations, and compliance checklists.

io.github.microsoft/onnxruntime/python-kwargs-setattr-security

When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access.

io.github.foryourhealth111-pixel/Vibe-Skills/security-reviewer

Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.

io.github.wgpsec/AboutSecurity/mcp-security

MCP (Model Context Protocol) 协议安全测试方法论。当目标环境使用 MCP Server 集成外部工具、 需要评估 MCP 工具描述安全性、或测试 Agent 通过 MCP 调用工具时的安全边界时触发。 覆盖: 工具描述投毒、地毯式骗局(动态篡改)、指令覆盖(Shadow Tool)、隐藏指令(ANSI/Unicode)、 跨 Server 攻击、Token 窃取、Schema 操纵、上下文溢出。

io.github.HoangNguyen0403/agent-skills-standard/typescript-security

Validate input, secure auth tokens, and prevent injection attacks in TypeScript. Use when validating input, handling auth tokens, sanitizing data, or managing secrets and sensitive configuration.

io.github.nearai/ironclaw/security-review

Security audit for code changes and PRs — OWASP top 10, auth flows, data handling, secrets exposure, supply chain risks. Writes findings as actionable items.

io.github.gsd-build/gsd-2/security-review

Threat-model-driven security review of a change, feature, or subsystem. Runs a STRIDE-style pass (Spoofing, Tampering, Repudiation, Info disclosure, Denial of service, Elevation of privilege), examines the actual code, and produces a filing-ready report with severity, exploit scenario, and concrete remediation. Use when asked to "security review", "threat model", "check for vulnerabilities", "audit this for security", "secure this", or before shipping any change that touches auth, input handling, data access, or external surfaces.

skillsmp.s7safe-android-h1-skill-md

移动安全漏洞挖掘知识库，基于HackerOne公开报告提供Android和iOS应用的漏洞挖掘手法、技术细节和代码模式分析；用于安全研究人员和漏洞挖掘者学习参考、代码审计和漏洞检测指导。

io.github.webiny/webiny-js/security

API — Security & Auth — 53 abstractions. Authentication, API keys, roles, users, teams event handlers and use cases.

io.github.sickn33/antigravity-awesome-skills/mobile-security-coder

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns.

io.github.sickn33/antigravity-awesome-skills/backend-security-coder

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

io.github.sickn33/antigravity-awesome-skills/frontend-mobile-security-xss-scan

You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection poi

io.github.sickn33/antigravity-awesome-skills/frontend-security-coder

Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns.

io.github.sickn33/antigravity-awesome-skills/security-scanning-security-sast

Static Application Security Testing (SAST) for code vulnerability analysis across multiple languages and frameworks