Find the skill for your next task.

Browse reusable Agent Skills, each with a clear purpose and practical guidance.

retire-add-library

Add a new JavaScript library to the retire.js vulnerability database. Given a library name, looks it up on CDNs, downloads multiple versions, finds version strings, generates detection regexes with (§§version§§) placeholder, adds entries to jsrepository-master.json and testcases.json, and runs validate/test-detection. Use this skill whenever adding a new library to retire.js, generating filecontent/filename/uri extractors, or finding version detection patterns for a JS library.

4.16k repo starsObserved in 1 repos
Development

app-server-events-sync

Maintain CodexMonitor and Codex app-server protocol parity. Use when asked to audit supported or missing app-server notifications/requests, trace event routing, diagnose schema drift in app-server payloads, or update docs/app-server-events.md after upstream Codex changes.

4.15k repo starsObserved in 3 repos
Development

edgeone skill scanner

Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your device. Compatible with CodeBuddy, Cursor, Windsurf, Claude Code, OpenClaw and more. Triggers on: `这个 skill 安全吗`, `skill 安全扫描`, `检查 skill 安全`, `audit skill`, `scan skill`, `check skill safety`, `analyze skill`, `inspect skill`, `verify skill`, `skill security`, `skill supply chain`. Do NOT trigger for general agent usage, full system health checks, project debugging, or normal development.

4.13k repo starsObserved in 3 repos
Agent Building

aig-agent-redteam

当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试,或需要生成类似渗透测试报告的 Markdown/HTML 时,必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家,面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据,而不是机械跑 payload 库;脚本只用于 HTTP 指纹识别、证据聚合、报告渲染等确定性辅助任务。

4.13k repo starsObserved in 1 repos
DevOps & Security

authorization-bypass-detection

Detect privilege escalation and unauthorized access via dialogue. Use when the agent has roles, admin functions, or multi-user data.

4.13k repo starsObserved in 1 repos
DevOps & Security

direct-injection-detection

Detect direct prompt injection or instruction override via user message (no external content). Focuses on system/role override attempts.

4.13k repo starsObserved in 1 repos
DevOps & Security

edgeone-clawscan

The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills, scans skills before installation, and performs a full OpenClaw security health check to prevent data leaks and privacy risks. Backed by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). Use when the user asks to start a security health check or security scan for the current OpenClaw environment, such as `开始安全体检`, `做一次安全体检`, `开始安全扫描`, `全面安全检查`, or `检查 OpenClaw 安全`; also use when the user asks to audit a specific skill before installation, review installed skills for supply chain risk, or investigate whether a skill is safe. Do not trigger for general OpenClaw usage, project debugging, environment setup, or normal development requests. Optional cloud mode: set AIG_CLOUD_LOOKUP=off for zero outbound HTTPS; when enabled, only skill_name, source label, and OpenClaw version are sent to A.I.G (never skill bodies, chats, or workspace files).

4.13k repo starsObserved in 1 repos
DevOps & Security

file-path-traversal-detection

Detect unsafe file handling and path traversal in upload/save/extract flows. Focuses on user-controlled paths or filenames, not data leakage.

4.13k repo starsObserved in 1 repos
DevOps & Security

hardcoded-secret-detection

Detect hardcoded secrets in code or configuration accessible to the target agent. Focuses on secrets embedded in source, configs, or IaC, not runtime leaks.

4.13k repo starsObserved in 1 repos
DevOps & Security

indirect-injection-detection

Detect indirect prompt injection (goal hijack). Instructions hidden in "external" content (documents, RAG, web) that the agent processes. Use when the agent has document/RAG/web/file input.

4.13k repo starsObserved in 1 repos
DevOps & Security