Skill UI

Secure OpenClaw deployments with preflight hardening checks, CI/CD guardrails, container runtime restrictions, and post-deploy verification. This skill provides a repeatable security workflow for build pipelines, container runtime lockdown, production promotion gates, data protection, and incident-ready rollback patterns.

Delegate bounded coding tasks to the Pi coding agent CLI while the orchestrator keeps review and landing duties. Covers writing briefs, dispatching runs, verifying diffs and gates, and committing the result.

Create repository-based execution contracts for multi-session implementation work, with stable task IDs, evidence gates, checkpoints, and exact resume state for fresh agents.

This skill covers the setup and configuration of Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL. It guides users on creating custom security rules, integrating scans into CI/CD pipelines, and managing quality gates. The process includes optimizing scan performance, reducing false positives, and ensuring compliance with security policies across multiple programming languages.

Perform static application security testing to identify vulnerabilities in source code before deployment. Use tools like Semgrep, CodeQL, and SonarQube to integrate security gates into CI/CD pipelines and ensure compliance with secure SDLC practices.

This skill generates a concise and enforceable security policy document for applications handling sensitive data. It creates a single coherent Blue Book using MUST, SHOULD, and CAN language, defining explicit assumptions, scope, and security gates. The workflow includes gathering context, drafting the policy, enforcing guardrails against secrets, and performing quality checks on threat models and data handling rules.

This skill enables comprehensive software supply chain security assessment, covering SBOM generation, SCA scanning, CI/CD pipeline review, and container image auditing. It involves verifying build integrity, dependency provenance, and vulnerability reachability. Key activities include auditing upstream repositories, integrating security gates in CI/CD, ensuring artifact integrity, and monitoring CVEs for actual exploitability to mitigate supply chain attacks.

Send messages, files, and alerts via Telegram bot API. Supports inline button questions for approvals and CI/cron notifications. Ideal for workflow automation, long-running task updates, and interactive approval gates without complex installation.

Build production-grade procedural meshes in Three.js: profile extrusion, lofts, revolve, sweep, solidify, bevels and apertures, plus topology, coplanar, clash and semantic quality gates for hard-surface assemblies and humanoid robots.

Aggregates Uncle Bob’s Clean Code, Architecture, Coder, Agile, and design-pattern guidance to evaluate reviews, refactors, and architecture decisions, and to surface professionalism heuristics without replacing your linter or formatter.

Enables authorized offensive security assessments on Windows Active Directory environments. Covers Kerberos abuse, AD CS escalation, BloodHound path analysis, NTLM relay, and domain privilege escalation techniques. Requires explicit written permission and strict authorization gates before execution. Designed for educational purposes or authorized security assessments only.

This skill provides guidance for implementing tasks using structured workflow patterns, specifically following Conductor's TDD (Test-Driven Development) workflow. It helps manage phase checkpoints, organize git commits, and execute rigorous verification protocols. Use it when adhering to a defined development plan, ensuring quality gates are passed, and managing the entire lifecycle from initial planning to final validation.