安全
安全审查、认证、权限和风险检查
Skills 列表
capacitor-security
Comprehensive security guide for Capacitor apps using Capsec scanner. Covers 63+ security rules across secrets, storage, network, authentication, cryptography, and platform-specific vulnerabilities. Use this skill when users need to secure their mobile app or run security audits.
cap-gocapacitor-push-notifications
Complete guide to implementing push notifications in Capacitor apps using Firebase Cloud Messaging (FCM) and Apple Push Notification Service (APNs). Covers setup, handling, and best practices. Use this skill when users need to add push notifications.
cap-go
openclaw-secure-linux-cloud
当您在云服务器上自托管 OpenClaw、加固远程 OpenClaw 网关、选择 SSH 隧道、Tailscale 或反向代理暴露方式，或审查 Podman、配对、沙箱、令牌认证和工具权限默认设置以确保安全个人部署时使用。
xixu-meopensource-guide-coach
Use when a user wants guidance on starting, contributing to, growing, governing, funding, securing, or sustaining an open source project, or asks about contributor onboarding, community health, maintainer burnout, code of conduct, metrics, legal basics, or open source project adoption.
xixu-merunning-claude-code-via-litellm-copilot
当需要通过本地 LiteLLM 代理将 Claude Code 路由到 GitHub Copilot、减少直接 Anthropic 开销、配置 ANTHROPIC_BASE_URL 或 ANTHROPIC_MODEL 覆盖，或排查 Copilot 代理设置失败（如模型未找到、无本地流量、GitHub 401/403 认证错误）时使用。
xixu-me
feishu-calendar
飞书日历。创建日程、查询日程、更新日程。
alextangson
skill-vetter
面向OpenClaw技能的安全优先审查工具。在从ClawHub、GitHub或其他来源安装任何技能前使用。
useai-pro
clerk-swift
Implement Clerk authentication for native Swift and iOS apps using ClerkKit
clerkclerk-android
使用 Kotlin 和 Jetpack Compose 为原生 Android 应用实现 Clerk 身份验证，遵循 clerk-android 源码引导模式。可用于预构建的 AuthView/UserButton 或自定义 API 驱动的认证流程。不适用于 Expo 或 React Native 项目。
clerkcapacitor-best-practices
Best practices for Capacitor app development including project structure, plugin usage, performance optimization, security, and deployment. Use this skill when reviewing Capacitor code, setting up new projects, or optimizing existing apps.
cap-go
qianwen-video-generation
[QianWen] Generate videos using Wan models. Supports text-to-video, image-to-video, first+last frame, reference-based role-play, and video editing (VACE). TRIGGER when: user wants to create, generate, or edit video content, mentions video generation/animation/video clips/Wan models, or explicitly invokes this skill by name (e.g. use qianwen-video-generation). DO NOT TRIGGER when: user wants to generate images (use qianwen-image-generation), understand/analyze existing videos (use qianwen-vision), text-only tasks.
qianwen-aiqianwen-ops-auth
[QianWen] Configure authentication (API keys, endpoints). TRIGGER when: setting up QIANWEN_API_KEY, troubleshooting 401/auth errors, when another skill reports missing credentials, or user explicitly invokes this skill by name (e.g. use qianwen-ops-auth). DO NOT TRIGGER when: non-auth Qwen tasks, general API usage questions.
qianwen-ai
ui-design-review
Comprehensive visual design and aesthetics evaluation. Analyzes typography, color, spacing, hierarchy, consistency, branding, and current product-category conventions for polished, professional interfaces.
mastepanoskiwcag-accessibility-audit
Comprehensive web accessibility audit using WCAG 2.1/2.2 guidelines. Evaluate compliance across 4 POUR principles (Perceivable, Operable, Understandable, Robust) with A, AA, AAA conformance levels.
mastepanoski
10x-cli-setup
ALWAYS invoke this skill when the user mentions 10x-cli, @przeprogramowani/10x-cli, the 10xDevs CLI, or the 10xDevs course environment in a setup context. This skill fetches the live README — Claude does not know 10x-cli's current install steps without it. Applies to: installing, updating, reconfiguring for different AI tools (Cursor, Copilot, Claude Code), permission/npm errors, authentication, and onboarding after 10xDevs enrollment. Excludes: developing 10x-cli source code, contributing to the repo, building similar CLIs, or general project setup.
przeprogramowani
arize-admin
Manages Arize users, organizations, spaces, projects, roles, role bindings, resource restrictions, and API keys via the ax CLI. Use for enterprise admin workflows: inviting and offboarding users, onboarding new teams, creating custom roles for SAML/SSO mappings, assigning roles to users, restricting project-level access, and managing service keys for multi-tenant architectures. Covers ax users, ax organizations, ax spaces, ax projects, ax roles, ax role-bindings, and ax api-keys.
arize-ai
longbridge-market-data
Real-time quotes, K-line charts, order book, trade ticks, intraday capital flow, market sentiment temperature, trading session schedule, security lists, exchange rates, and IPO calendar for HK/US/A-share/SG via Longbridge. Also covers ADR premium and FX carry frameworks. Triggers: "股价", "行情", "K线", "走势", "盘口", "资金流", "市场温度", "汇率", "IPO", "打新", "隔夜股", "ADR溢价", "外汇套息", "K線", "盤口", "資金流", "市場溫度", "匯率", "ADR溢價", "外匯套息", "现在多少钱", "多少钱", "stock price", "quote", "kline", "chart", "depth", "orderbook", "capital flow", "market sentiment", "exchange rate", "IPO calendar", "security list", "ADR premium", "fx carry", "market open", "trading hours", "开市", "溢价", "NVDA.US", "700.HK", "600519.SH", "股價", "走勢", "開盤", "今天開市"
longbridgearize-compliance-audit
INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance. Covers EU AI Act, GPAI Code of Practice, GDPR, NIST AI RMF, Colorado AI Act, HIPAA, and ISO 42001. Scans the codebase for compliance gaps, cross-references Arize instrumentation for audit trail coverage, and produces an actionable remediation checklist tailored to the selected frameworks.
arize-ai
windows-ui-automation
Expert in Windows UI Automation (UIA) and Win32 APIs for desktop automation. Specializes in accessible, secure automation of Windows applications including element discovery, input simulation, and process interaction. HIGH-RISK skill requiring strict security controls for system access.
martinholovskylongbridge-portfolio
通过长桥（Longbridge）管理账户资产、股票和基金持仓、盈亏、现金流记录、账户对账单、保证金比例、购买力估算、订单管理以及定投（DCA）定期投资（大部分需要交易权限）。框架：组合诊断、再平衡、资产配置、风险分析（VaR/CVaR）、绩效归因和税损收割。 触发词："持仓", "账户", "盈亏", "资产", "对账单", "下单", "买入", "卖出", "撤单", "定投", "组合诊断", "再平衡", "资产配置", "风险分析", "绩效归因", "税损收割", "持倉", "賬戶", "盈虧", "對賬單", "下單", "買入", "賣出", "組合診斷", "再平衡", "稅損收割", "positions", "portfolio", "P&L", "order", "buy", "sell", "DCA", "statement", "risk analysis", "rebalancing", "tax harvesting", "我的风险", "持仓风险", "风险敞口", "資產", "資產配置", "風險分析", "績效歸因", "撤單"
longbridgelongbridge-watchlist
通过 Longbridge 管理自选股分组（列出/创建/重命名/删除/添加/移除股票）、价格提醒（列出/添加/删除）以及社区股票清单（sharelist：列出/详情/创建/删除/管理）。变更操作需要用户明确确认（dry-run 协议）。 触发词："自选股", "添加自选", "删除自选", "创建分组", "价格提醒", "提醒", "股票清单", "自選股", "新增至自選", "建立分組", "價格提醒", "watchlist", "add to watchlist", "create group", "rename group", "price alert", "sharelist", "community list", "刪除自選", "股票清單", "重命名分組", "重新命名"
longbridge
qodo-pr-resolver
Use when the user wants to review Qodo PR feedback or fix code review comments. Capabilities: view issues by severity, apply fixes interactively or in batch, reply to inline comments, post fix summaries (GitHub, GitLab, Bitbucket, Azure DevOps, Gerrit)
qodo-ai
shannon
自主AI渗透测试工具，用于Web应用和API。使用Shannon进行白盒安全评估——分析源代码、识别攻击向量，并执行真实漏洞利用以证明漏洞存在。通过'shannon'、'pentest'、'security audit'、'vuln scan'触发。
unicodeveloper
vtex-io-app-settings
Apply when defining, validating, or consuming VTEX IO app settings. Covers settingsSchema, app-level configuration boundaries, and how backend or frontend code should depend on settings safely. Use for merchant-configurable behavior, settings forms, or reviewing whether settings belong in app configuration rather than hardcoded logic or custom data entities.
vtex