Skill UI

A comprehensive guide for installing, configuring, and validating the local long-term memory plugin (`memory-tencentdb`) within the OpenClaw environment. This guide covers everything from environment pre-checks to advanced configuration for data capture, information extraction, context recall, and vector embedding, ensuring robust, self-contained memory capabilities for RAG applications.

This tool performs a rapid, heuristic security assessment focused on identifying common vulnerabilities listed in the OWASP Top 10. It scans source code for hardcoded secrets, SQL injection risks, XSS vectors, insecure dependencies, and authentication flaws. It is ideal for pre-commit checks or code reviews before merging sensitive changes.

This tool simulates a senior application security engineer, performing a comprehensive, multi-phase audit. It checks for exposed secrets, prompt injection vectors, dependency vulnerabilities (supporting multiple languages), and critical configuration misconfigurations. It provides a scored, prioritized remediation report, ensuring a robust security posture before deployment.

This comprehensive guide outlines a structured methodology for conducting authorized security testing on desktop thick clients (Win/macOS/Linux). It covers critical attack vectors, including local storage analysis, Inter-Process Communication (IPC) vulnerabilities, network traffic interception, client-side trust boundaries, and advanced reverse engineering techniques using tools like IDA and Ghidra.

A comprehensive guide detailing advanced, authorized techniques for Active Directory security testing and red teaming. It covers critical attack vectors such as Kerberos exploitation, BloodHound path analysis, NTLM relay, and domain privilege escalation. Designed for security professionals to systematically map and exploit domain weaknesses.

Enumerate cloud storage buckets, confirm dangling-CNAME takeover risks, recover AWS account IDs offline from leaked access keys, validate npm/PyPI dependency-confusion vectors, and fingerprint cloud-native/Kubernetes/CI exposure for authorized recon.

A comprehensive guide for creating and maintaining an atomic, index-driven knowledge base (KB) using Markdown. This method enables AI agents to bypass traditional vector search limitations by reading a central index file (INDEX.md) and opening only the most relevant, highly signaled notes, drastically improving context efficiency.

This framework moves beyond simple storage solutions (like vector databases) to treat memory as a complex metabolic system. It provides tools and methodologies to audit, price, and govern an agent's memory, focusing especially on the forgetting policy. Key functions include cost profiling (construction vs. query energy), classifying stored records (fact/skill/log), and ensuring a mandatory forgetting policy to prevent state bloat and maintain performance.

A comprehensive methodology for exploiting modern Continuous Integration/Continuous Delivery (CI/CD) pipelines. This skill covers advanced attack vectors across major platforms, including GitHub Actions expression injection, Jenkins RCE, GitLab YAML abuse, and Azure DevOps compromise. Techniques focus on privilege escalation, credential theft, and supply chain poisoning, mapping to MITRE ATT&CK T1195.002.

A comprehensive guide for authorized red team and penetration testing engagements, detailing techniques that exploit human trust and psychological vulnerabilities. Coverage includes pretexting, vishing, smishing, physical access attacks (e.g., badge cloning, tailgating), USB payload delivery, and OSINT-driven targeting. This methodology maps to key MITRE ATT&CK T-numbers, simulating real-world, multi-vector adversaries to test organizational defenses at the human layer.