Tools tagged with "Security Review"

Pre-commit review: security scan, quality gates, auto-fix.

Audit Microsoft Copilot Studio labs end-to-end for any event or workshop. Resolves the mcs-labs repo location dynamically (clones/updates it as needed), enumera

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

Read, search, and manage Confluence Cloud pages, spaces, blog posts, comments, attachments, and labels. Use this whenever the user wants to find a page, read a

Write up vulnerabilities from disclosure documents, rough notes, supplied findings, PoCs, source code, or Codex Security scan output into polished, self-contain

Authorized web application penetration testing — reconnaissance, vulnerability analysis, proof-based exploitation, and professional reporting. Adapts Shannon's

User-invocable audit skill for detecting and surfacing AI-slop in documents and code: content that sounds AI-generated, is useless, generic, overconfident, fake

Use when drafting, sending, or preserving email correspondence for an existing ClawHub content rights case.

Search, read, create, update, export, and share files in Google Drive. Use this whenever the user wants to find a file in Drive, read a Google Doc or Sheet, upl

Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or d

Shopify Admin & Storefront GraphQL APIs via curl. Products, orders, customers, inventory, metafields.

Audit top-level documentation (README, SPEC, PRODUCT) against recent git history to find drift — shipped features missing from docs or features listed as upcomi

Add a blockchain explorer transaction to the TRES Finance ledger. Use when the user provides a blockchain explorer URL (Etherscan, Polygonscan, Arbiscan, Basesc

Launch Readiness Orchestrator skill for Datasite deal rooms. Use this skill whenever a deal team wants a single pre-go-live readiness check across their data ro

PAO workflow for scanning, drafting, and presenting community responses with human review gate

Analyze any TRES Finance report XLSX and produce an automatic findings summary. Trigger this skill whenever a user uploads a .xlsx file that came from TRES Fina

Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), se

Handle a GitHub Security Advisory response for Paperclip, including confidential fix development in a temporary private fork, human coordination on advisory-thr

Validate wallet balances in TRES Finance against DeBank and generate a discrepancy report. Use this skill whenever the user asks to validate, verify, cross-chec

Score a repository's agentic legibility from repo-visible evidence only. Use when Codex needs to audit how easy a codebase is for coding agents to discover, boo

Interactively BUILD a new Microsoft Copilot Studio lab for the mcs-labs repo, end-to-end. Get a workshop test account, drive Playwright to the Copilot Studio Ho

Use only when the user explicitly asks for a TestDino audit of Playwright automated test code. Routes through the audit tools the TestDino MCP server exposes (g

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent dis

Domain patterns for event-driven and message-based systems — pub/sub, event sourcing, CQRS, sagas, delivery guarantees, schema evolution, and failure modes. Use

<!-- Copyright 2026 Anthropic PBC -- <!-- SPDX-License-Identifier: Apache-2.0 --

Analyze main branch implementation and configuration to find missing, incorrect, or outdated documentation in docs/. Use when asked to audit doc coverage, sync

Plan broad or risky Nacelle work. Use for architecture changes, migrations, release or production-readiness assessments, security hardening, performance baselin

Review vendor AI terms — agreement, addendum, or ToS AI provisions — against your governance positions; flag training-on-data, liability, model changes, and AI

Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories

User-invocable audit skill for detecting and surfacing AI-slop in documents and code: content that sounds AI-generated, is useless, generic, overconfident, fake

Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory o

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings ar

Convert a lab's findings.json into a GitHub issue body and file it against the active instance's lab repo (microsoft/mcs-labs by default). Checks for an existin

Build a threat model for a target codebase. Three modes: "interview" walks an application owner through the four-question framework and produces a threat model

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, pa

Review hackathon content (challenges, module docs, resources) for correctness, pacing, hallucinations, and staleness, and cross-check claims against official do