安全

Identify and report potentially malicious software repositories masquerading as legitimate security tools

wxmini-security-audit

Automated WeChat mini-program security auditing framework using Claude Code Agent Teams with 7 specialized agents for comprehensive static analysis

security-awareness-malicious-repository-detection

Detect and analyze potentially malicious repositories disguising as legitimate software cracks or pirated tools

avast-security-analysis

Analyze and understand Avast antivirus security mechanisms, behavior shields, and protection components for security research

qqmusic

10security

QQ Music — search songs, albums, playlists, music videos, artists; daily recommendations; music charts & rankings; AI-powered playlists; personalized listening reports & music insights. QQ音乐助手：搜索、每日推荐、排行榜、AI歌单、听歌报告、AI解读。

tencentmusic

hermes-marketing-dashboard

10security

Open-source marketing operations control center for AI agent teams with CRM, outreach, content ops, and analytics powered by OpenClaw + SQLite

ai-music

8security

通过 `runcomfy` CLI 在 RunComfy 上生成 AI 音乐——一个智能路由到音乐模型目录的工具。路由到 ElevenLabs AI Music Generation（高级 44.1 kHz 立体声人声曲目，5 秒–5 分钟，$0.0083/秒）和 ACE Step / ACE Step 1.5（StepFun-AI 开放权重，标签驱动作曲，多语言歌词，$0.0002–0.0003/秒，约便宜 27 倍），以及 ACE Step 音频修补（在现有曲目内重新生成时间范围）和 ACE Step 音频扩展（在曲目前或后扩展）。根据用户的实际意图选择正确的模型——高级人声片段、廉价背景音乐库、多语言流行歌曲、修复糟糕的副歌、将 30 秒草稿延长为 2 分钟剪辑——并提供每个模型文档化的提示模式以及最小的 `runcomfy run` 调用。触发词包括“生成音乐”、“制作歌曲”、“AI 音乐”、“背景音乐”、“器乐曲目”、“配乐”、“广告曲”、“主题音乐”、“免版税音乐”、“作曲”、“带歌词的音乐”、“扩展音乐”、“修复这首歌”、“修补音乐”或任何明确的生成或编辑音乐的请求。

skills-collective

emblem-ai-agent-wallet

Connect to EmblemVault and manage crypto wallets via EmblemAI. Supports Solana, Ethereum, Base, BSC, Polygon, Hedera, and Bitcoin. Use when the user wants to trade crypto, check balances, swap tokens, interact with blockchain wallets, or create and use profile-scoped agent wallets.

emblemcompany

meticulous-cli-update

检查 Meticulous CLI（@alwaysmeticulous/cli）是否已安装且为最新版本，若未安装或不是最新则进行安装/更新。该技能在每个其他 Meticulous 技能开始时调用，因为 CLI 正在积极开发中，频繁发布变更和改进。

alwaysmeticulous

sumsub-api-auth

Authenticate to the Sumsub API with an App Token + secret key (HMAC-SHA256 request signing). TRIGGER when the user asks to "call / sign / authenticate Sumsub API requests", debugs `401 Unauthorized` / signature errors against `api.sumsub.com`, or needs a working request example with `X-App-Token` / `X-App-Access-Sig` / `X-App-Access-Ts` headers. SKIP only when a more specific skill in this repo (questionnaire/level/workflow/POA-preset/generic) already covers the user's actual task — those skills sign requests the same way and only need this one for auth deep dives.

sumsub

sumsub-check-permissions

Fetch the current tenant's allowed entitlements (BackgroundCheckTarget list). Returns JSON `{"allowedChecks":{key:label}}` — a map whose keys are the enabled entitlement keys. Called by sumsub-create-level (and other create-* skills) before building a payload to gate entitlement-required features.

sumsub

grimoire-polymarket

通过 Grimoire 场所 CLI 包装器（基于官方 Polymarket CLI）查询 Polymarket 市场数据和 CLOB 状态，并管理 CLOB 订单。

franalgaba

integration-privy

Add Privy authentication to a Solana Expo Android app on top of Mobile Wallet Adapter, using Sign-In-With-Solana. Use when installing @privy-io/expo, mounting PrivyProvider, logging a user in with useLoginWithSiws, linking a wallet to an existing Privy account, reading the Privy access token from a backend, or debugging a Privy plus MWA setup.

solana-mobile

cursor-spec-interviewer

Turn ambiguous coding requests into verified Cursor Agent implementation specs. Use when the user wants requirements, an implementation plan, or a spec before coding; include source checks, needed ADRs, and agreed delivery. Do not use for already specified direct implementation or memory cleanup.

codex-spec-interviewer

Turn ambiguous coding requests into verified Codex implementation specs. Use when the user wants requirements, an implementation plan, or a spec before coding; include source checks, needed ADRs, and agreed delivery. Do not use for already specified direct implementation or memory cleanup.

architecture-compass

Set up ADR governance, audit architecture and drift, or plan and execute bounded ADR-guided refactors. Use when work needs binding architecture decisions, provider-to-local mapping, architecture PR review, and durable runtime or source-boundary changes.

jev-capability-advisor

Recommend available skills or MCP tools using TypeSafe Jev, or explicitly choose one next skill. Use when the user requests capability advice, candidate inspection, selection evaluation, or reusable host integration. Native client selection remains the default and fallback.

claude-spec-interviewer

Turn ambiguous coding requests into verified Claude Code implementation specs. Use when the user wants requirements, an implementation plan, or a spec before coding; include source checks, needed ADRs, and agreed delivery. Do not use for already specified direct implementation or memory cleanup.

dependencies-audit

MUST be used whenever fixing dependency issues in a Flows app. This skill finds AND fixes vulnerabilities, outdated packages, deprecated dependencies, and license issues — it does not just report them. Triggers: dependencies, packages, fix dependencies, update packages, fix vulnerabilities, npm audit fix, pnpm audit fix, CVE fix, outdated, deprecated, supply chain, license.

cognitedata

security

MUST be used whenever fixing security issues in a Flows app, or before shipping any feature that handles credentials, user input, or external data. This skill finds AND fixes security problems — it does not just report them. Do NOT skip this when the user asks for a security fix, security hardening, or vulnerability remediation — run every step in order. Triggers: security, security fix, security hardening, vulnerability, XSS, injection, credentials, secrets, auth, authentication, authorization, token, sensitive data, input validation, CORS, CSP, dependency audit.

cognitedata

migrate-app-to-flows

MUST be used when migrating a legacy Dune app to the new Flows app hosting infrastructure. Orchestrates the full migration: audits current state, updates app.json to appsApi infra, delegates auth wiring to setup-flows-auth, creates or updates manifest.json network permissions, and updates deploy scripts to @cognite/cli. Use this whenever a user says 'migrate to Flows', 'migrate to new infra', 'move from dune to flows', 'migrate legacy app', or wants to move their existing app to the new Flows app hosting.

cognitedata

clawhub-skill-vetting

Vet ClawHub skills before installation. Use when the user asks about evaluating, auditing, or safely installing OpenClaw/ClawHub skills, or when a skill’s trustworthiness is in question.

hugomrtz

yt-dlp