Skill UI

This skill performs a comprehensive, read-only, multi-agent review of a git diff or file scope. It launches four specialized sub-agents—covering Regression, Security, Performance, and Contracts—in parallel. The main agent then aggregates, filters, and summarizes critical findings, ensuring the code change is robust, secure, and maintainable. Ideal for pre-commit or Pull Request review workflows.

A comprehensive, multi-stage skill designed to simulate a professional Continuous Integration (CI) pipeline. It guides users through critical quality gates, including build verification, type checking, linting, running test suites (with coverage checks), security scanning for secrets, and final diff review. Use this skill before creating a Pull Request or finalizing any significant feature to ensure code robustness and adherence to best practices.

The Ship command provides a comprehensive, multi-stage checklist for ensuring code readiness before production deployment. It verifies critical quality gates, including running full unit tests, performing security audits, checking for hardcoded secrets, and verifying documentation updates. Use this tool to guarantee the stability and quality of every software release.

This skill manages the complex, multi-step workflow for updating the company's threat intelligence database. It delegates the core research and content updates to the dedicated AgentSec system. The process involves reading AgentSec's source material, executing rigorous testing in an isolated workspace, synchronizing the validated security feed, and finally ensuring data integrity by validating the updates across the guide and landing mirrors.

A deterministic method for placing signature, date, and text fields in a web e-signature composer via browser automation. It uses fixed signature pages and numeric coordinates instead of drag-and-drop. This skill ensures repeatable field positions, correct recipient ownership, and security gates before sending. Ideal for automating envelope preparation for generated agreements when API access is unavailable.

Secure AI coding agents with permission boundaries, secret protection, code review gates, and safe sandbox configurations for team environments. Covers Claude Code, Cursor, Copilot, and Codex security implementations including CLAUDE.md configuration, command allowlists, filesystem access controls, and pre-commit hooks for secret scanning.

Offensive security skill for hunting insecure deserialization flaws in Java, PHP, Python, .NET and Ruby. Covers ysoserial gadget chains, PHP object injection, pickle payloads, ViewState and JNDI/Log4Shell, with strict authorization gates.

Secure OpenClaw deployments with preflight hardening checks, CI/CD guardrails, container runtime restrictions, and post-deploy verification. This skill provides a repeatable security workflow for build pipelines, container runtime lockdown, production promotion gates, data protection, and incident-ready rollback patterns.

This skill covers the setup and configuration of Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL. It guides users on creating custom security rules, integrating scans into CI/CD pipelines, and managing quality gates. The process includes optimizing scan performance, reducing false positives, and ensuring compliance with security policies across multiple programming languages.

Perform static application security testing to identify vulnerabilities in source code before deployment. Use tools like Semgrep, CodeQL, and SonarQube to integrate security gates into CI/CD pipelines and ensure compliance with secure SDLC practices.

This skill generates a minimal yet enforceable security policy document for applications handling sensitive data. It creates a coherent Blue Book using MUST/SHOULD/CAN language, defining explicit assumptions, scope, and security gates. It helps establish threat models, data classification, trust boundaries, and incident response guidelines tailored to specific operational security defaults.