Security & Testing Agent Skills

Derive security requirements from threat models and business context.

Run security scans including SAST, dependency scanning, and secret detection

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application…

Test automate security vulnerability testing covering OWASP Top 10,

Triage OpenClaw security advisories, drafts, and GHSA reports with shipped-tag and trust-model proof.

Automate Securitytrails tasks via Rube MCP (Composio).

Seed reproducible local Langfuse data in ClickHouse and Postgres.

Use when about to claim work is done / verified / working — empirical verification is required, not model-based confidence.

Honestly evaluate AI work quality using a two-axis scoring system.

Demonstrate self-hosted CI runner abuse (CICD-SEC-7, insecure system configuration) during an authorized assessment — abusing a…

Generate or revise Chinese software self-test reports in genuine DOCX format from Git commits, code diffs, requirements, or described…

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns.

Senior CAPA Officer specialist for managing Corrective and Preventive Actions within Quality Management Systems.

Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance.

Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies.

Generates unit tests, integration tests, and E2E tests for React/Next.js applications.

Senior QMS Audit Expert for internal and external quality management system auditing.

Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices.

Use when the user asks for STRIDE threat modeling, DREAD risk scoring, data-flow-diagram threat analysis, or a quick secret scan — or when…

Sets a machine up with agentbox — a single bwrap wrapper that runs any coding-agent CLI (Claude Code, Pi, Codex) with the host environment…