Skill UI

A comprehensive framework for conducting authorized security assessments on Large Language Models (LLMs) and AI agents. It covers critical vulnerabilities including advanced prompt injection (OWASP Top 10), tool abuse, RAG data poisoning, memory manipulation, and system prompt extraction. Ideal for red teaming, security auditing, and ensuring the robustness of AI systems in production environments.

Comprehensive workflow for analyzing suspected malware via static, dynamic, and behavioral techniques. Covers IOC extraction, YARA/Sigma rule generation, sandbox automation, and anti-analysis bypassing.

A comprehensive guide for installing, configuring, and validating the local long-term memory plugin (`memory-tencentdb`) within the OpenClaw environment. This guide covers everything from environment pre-checks to advanced configuration for data capture, information extraction, context recall, and vector embedding, ensuring robust, self-contained memory capabilities for RAG applications.

This skill processes clinical text to interpret laboratory results. It parses reference ranges (e.g., "135-145", "<5") and derives structured abnormal flags (low, normal, high, critical) for a given numeric value. It is unit-agnostic and respects explicit flags provided by the originating lab, making it crucial for structured clinical data extraction and interpretation workflows.

Utilize zero-shot NER to extract custom entity types (e.g., Drug, Symptom, Device) from complex clinical or biomedical text without requiring any labeled training data or fine-tuning. OpenMed wraps GLiNER/GLiNER2, allowing users to define labels on the fly. The workflow involves building a model index and then running inference via CLI or Python API, making it ideal for rapid prototyping or unstable schemas.

Provides a hardened FastAPI endpoint for OpenMed's core functionalities: clinical Named Entity Recognition (NER), Personally Identifiable Information (PII) extraction, and de-identification. Designed for self-hosted microservices, it handles inference requests, model lifecycle management, and supports dynamic batching, ensuring secure, on-device processing of sensitive clinical data.

A specialized downstream skill designed for solving encrypted ZIP/PKZIP challenges, particularly those using the legacy ZipCrypto method in CTF competitions. This workflow utilizes known-plaintext attacks (via tools like bkcrack) to recover internal encryption keys, enabling decryption and extraction without resorting to brute-force password guessing. Use this when a predictable plaintext fixture is available.

One-shot chat completion against DeepSeek's deepseek-chat model via the OpenAI-compatible chat completions endpoint. Designed for non-reasoning tasks such as summarization, extraction, and quick classification, with JSON output, environment-based API key handling, and graceful degradation when the API is unavailable.

A comprehensive firmware and IoT penetration testing skill following OWASP FSTM. Covers firmware acquisition, static analysis, file system extraction with binwalk/unblob, automated EMBA scanning, system emulation via Firmadyne/QEMU, dynamic debugging, and binary exploitation for ARM/MIPS devices. Ideal for auditing routers, cameras, smart home devices, reproducing IoT CVEs, and discovering embedded 0-days.

A vendor-neutral, benchmark-grounded advisor that routes complex legal tasks to the optimal Large Language Model (LLM). It analyzes the specific legal vertical (e.g., contract drafting, legal research, info extraction) and user constraints (cost, speed, accuracy, jurisdiction) to recommend a primary model, a fallback, and crucial human verification steps. This tool provides decision support, not legal advice.

A specialized skill designed to convert complex legal materials—such as contracts, matter descriptions, corporate structures, timelines, or compliance processes—into context-appropriate, structured Mermaid diagrams. It utilizes a multi-step process involving structured data extraction, LLM enrichment, and mandatory gates to ensure accuracy. Ideal for visualizing relationships, obligations, and flows in legal documents, but strictly limited to legal or legal-adjacent diagrams.

A comprehensive methodology for offensive security, detailing how to systematically extract secrets from Continuous Integration/Continuous Deployment (CI/CD) pipelines. Techniques covered include dumping environment variables, exploiting misconfigurations in HashiCorp Vault, AWS Secrets Manager, and cloud platform tokens (GitHub, GitLab, etc.). It also guides attackers on OIDC federation abuse, build log analysis, and advanced exfiltration methods, mapping to MITRE ATT&CK T1552.