[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M719RT9C8H58PRFS279GGDEG":3,"skill-same:01M719RT9C8H58PRFS279GGDEG":74},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":14,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":59,"install":60,"resources":73},"01M719RT9C8H58PRFS279GGDEG","security-audit",null,"Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fsecurity-audit\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"security","audit","security audit","2026","testing","penetration","bundle","security auditing","api security","scanning","security hardening","api","vulnerability","hardening","penetration testing","vulnerability scanning","web","workflow","safe","personal","2026-11-10 10:12:30",false,"---\nname: security-audit\ndescription: \"Comprehensive security auditing workflow covering web application testing, API security, penetration testing, vulnerability scanning, and security hardening.\"\ncategory: workflow-bundle\nrisk: safe\nsource: personal\ndate_added: \"2026-02-27\"\n---\n\n# Security Auditing Workflow Bundle\n\n## Overview\n\nComprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Performing security audits on web applications\n- Testing API security\n- Conducting penetration tests\n- Scanning for vulnerabilities\n- Hardening application security\n- Compliance security assessments\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `shodan-reconnaissance` - Shodan searches\n- `top-web-vulnerabilities` - OWASP Top 10\n\n#### Actions\n1. Identify target scope\n2. Gather intelligence\n3. Map attack surface\n4. Identify technologies\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform initial reconnaissance\n```\n\n```\nUse @shodan-reconnaissance to find exposed services\n```\n\n### Phase 2: Vulnerability Scanning\n\n#### Skills to Invoke\n- `vulnerability-scanner` - Vulnerability analysis\n- `security-scanning-security-sast` - Static analysis\n- `security-scanning-security-dependencies` - Dependency scanning\n\n#### Actions\n1. Run automated scanners\n2. Perform static analysis\n3. Scan dependencies\n4. Identify misconfigurations\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities\n```\n\n```\nUse @security-scanning-security-dependencies to audit dependencies\n```\n\n### Phase 3: Web Application Testing\n\n#### Skills to Invoke\n- `top-web-vulnerabilities` - OWASP vulnerabilities\n- `sql-injection-testing` - SQL injection\n- `xss-html-injection` - XSS testing\n- `broken-authentication` - Authentication testing\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n- `burp-suite-testing` - Burp Suite testing\n\n#### Actions\n1. Test for injection flaws\n2. Test authentication mechanisms\n3. Test session management\n4. Test access controls\n5. Test input validation\n6. Test security headers\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection vulnerabilities\n```\n\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 4: API Security Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Enumerate API endpoints\n2. Test authentication\u002Fauthorization\n3. Test rate limiting\n4. Test input validation\n5. Test error handling\n6. Document API vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API endpoints\n```\n\n### Phase 5: Penetration Testing\n\n#### Skills to Invoke\n- `pentest-commands` - Penetration testing commands\n- `pentest-checklist` - Pentest planning\n- `ethical-hacking-methodology` - Ethical hacking\n- `metasploit-framework` - Metasploit\n\n#### Actions\n1. Plan penetration test\n2. Execute attack scenarios\n3. Exploit vulnerabilities\n4. Document proof of concept\n5. Assess impact\n\n#### Copy-Paste Prompts\n```\nUse @pentest-checklist to plan penetration test\n```\n\n```\nUse @pentest-commands to execute penetration testing\n```\n\n### Phase 6: Security Hardening\n\n#### Skills to Invoke\n- `security-scanning-security-hardening` - Security hardening\n- `auth-implementation-patterns` - Authentication\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Implement security controls\n2. Configure security headers\n3. Set up authentication\n4. Implement authorization\n5. Configure logging\n6. Apply patches\n\n#### Copy-Paste Prompts\n```\nUse @security-scanning-security-hardening to harden application security\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document findings\n2. Assess risk levels\n3. Provide remediation steps\n4. Create executive summary\n5. Generate technical report\n\n## Security Testing Checklist\n\n### OWASP Top 10\n- [ ] Injection (SQL, NoSQL, OS, LDAP)\n- [ ] Broken Authentication\n- [ ] Sensitive Data Exposure\n- [ ] XML External Entities (XXE)\n- [ ] Broken Access Control\n- [ ] Security Misconfiguration\n- [ ] Cross-Site Scripting (XSS)\n- [ ] Insecure Deserialization\n- [ ] Using Components with Known Vulnerabilities\n- [ ] Insufficient Logging & Monitoring\n\n### API Security\n- [ ] Authentication mechanisms\n- [ ] Authorization checks\n- [ ] Rate limiting\n- [ ] Input validation\n- [ ] Error handling\n- [ ] Security headers\n\n## Quality Gates\n\n- [ ] All planned tests executed\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Risk assessments completed\n- [ ] Remediation steps provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `development` - Secure development practices\n- `wordpress` - WordPress security\n- `cloud-devops` - Cloud security\n- `testing-qa` - Security testing\n","# Security Auditing Workflow Bundle\n\n## Overview\n\nComprehensive security auditing workflow for web applications, APIs, and infrastructure. This bundle orchestrates skills for penetration testing, vulnerability assessment, security scanning, and remediation.\n\n## When to Use This Workflow\n\nUse this workflow when:\n- Performing security audits on web applications\n- Testing API security\n- Conducting penetration tests\n- Scanning for vulnerabilities\n- Hardening application security\n- Compliance security assessments\n\n## Workflow Phases\n\n### Phase 1: Reconnaissance\n\n#### Skills to Invoke\n- `scanning-tools` - Security scanning\n- `shodan-reconnaissance` - Shodan searches\n- `top-web-vulnerabilities` - OWASP Top 10\n\n#### Actions\n1. Identify target scope\n2. Gather intelligence\n3. Map attack surface\n4. Identify technologies\n5. Document findings\n\n#### Copy-Paste Prompts\n```\nUse @scanning-tools to perform initial reconnaissance\n```\n\n```\nUse @shodan-reconnaissance to find exposed services\n```\n\n### Phase 2: Vulnerability Scanning\n\n#### Skills to Invoke\n- `vulnerability-scanner` - Vulnerability analysis\n- `security-scanning-security-sast` - Static analysis\n- `security-scanning-security-dependencies` - Dependency scanning\n\n#### Actions\n1. Run automated scanners\n2. Perform static analysis\n3. Scan dependencies\n4. Identify misconfigurations\n5. Document vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @vulnerability-scanner to scan for OWASP Top 10 vulnerabilities\n```\n\n```\nUse @security-scanning-security-dependencies to audit dependencies\n```\n\n### Phase 3: Web Application Testing\n\n#### Skills to Invoke\n- `top-web-vulnerabilities` - OWASP vulnerabilities\n- `sql-injection-testing` - SQL injection\n- `xss-html-injection` - XSS testing\n- `broken-authentication` - Authentication testing\n- `idor-testing` - IDOR testing\n- `file-path-traversal` - Path traversal\n- `burp-suite-testing` - Burp Suite testing\n\n#### Actions\n1. Test for injection flaws\n2. Test authentication mechanisms\n3. Test session management\n4. Test access controls\n5. Test input validation\n6. Test security headers\n\n#### Copy-Paste Prompts\n```\nUse @sql-injection-testing to test for SQL injection vulnerabilities\n```\n\n```\nUse @xss-html-injection to test for cross-site scripting\n```\n\n```\nUse @broken-authentication to test authentication security\n```\n\n### Phase 4: API Security Testing\n\n#### Skills to Invoke\n- `api-fuzzing-bug-bounty` - API fuzzing\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Enumerate API endpoints\n2. Test authentication\u002Fauthorization\n3. Test rate limiting\n4. Test input validation\n5. Test error handling\n6. Document API vulnerabilities\n\n#### Copy-Paste Prompts\n```\nUse @api-fuzzing-bug-bounty to fuzz API endpoints\n```\n\n### Phase 5: Penetration Testing\n\n#### Skills to Invoke\n- `pentest-commands` - Penetration testing commands\n- `pentest-checklist` - Pentest planning\n- `ethical-hacking-methodology` - Ethical hacking\n- `metasploit-framework` - Metasploit\n\n#### Actions\n1. Plan penetration test\n2. Execute attack scenarios\n3. Exploit vulnerabilities\n4. Document proof of concept\n5. Assess impact\n\n#### Copy-Paste Prompts\n```\nUse @pentest-checklist to plan penetration test\n```\n\n```\nUse @pentest-commands to execute penetration testing\n```\n\n### Phase 6: Security Hardening\n\n#### Skills to Invoke\n- `security-scanning-security-hardening` - Security hardening\n- `auth-implementation-patterns` - Authentication\n- `api-security-best-practices` - API security\n\n#### Actions\n1. Implement security controls\n2. Configure security headers\n3. Set up authentication\n4. Implement authorization\n5. Configure logging\n6. Apply patches\n\n#### Copy-Paste Prompts\n```\nUse @security-scanning-security-hardening to harden application security\n```\n\n### Phase 7: Reporting\n\n#### Skills to Invoke\n- `reporting-standards` - Security reporting\n\n#### Actions\n1. Document findings\n2. Assess risk levels\n3. Provide remediation steps\n4. Create executive summary\n5. Generate technical report\n\n## Security Testing Checklist\n\n### OWASP Top 10\n- [ ] Injection (SQL, NoSQL, OS, LDAP)\n- [ ] Broken Authentication\n- [ ] Sensitive Data Exposure\n- [ ] XML External Entities (XXE)\n- [ ] Broken Access Control\n- [ ] Security Misconfiguration\n- [ ] Cross-Site Scripting (XSS)\n- [ ] Insecure Deserialization\n- [ ] Using Components with Known Vulnerabilities\n- [ ] Insufficient Logging & Monitoring\n\n### API Security\n- [ ] Authentication mechanisms\n- [ ] Authorization checks\n- [ ] Rate limiting\n- [ ] Input validation\n- [ ] Error handling\n- [ ] Security headers\n\n## Quality Gates\n\n- [ ] All planned tests executed\n- [ ] Vulnerabilities documented\n- [ ] Proof of concepts captured\n- [ ] Risk assessments completed\n- [ ] Remediation steps provided\n- [ ] Report generated\n\n## Related Workflow Bundles\n\n- `development` - Secure development practices\n- `wordpress` - WordPress security\n- `cloud-devops` - Cloud security\n- `testing-qa` - Security testing\n",{"name":5,"risk":45,"source":46,"category":52,"date_added":53,"description":7},"workflow-bundle","2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fglobal\u002Fsecurity-audit","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":61,"prompt":71,"zipAvailable":72},[62,65,68],{"tool":63,"command":64},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill security-audit",{"tool":66,"command":67},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill security-audit",{"tool":69,"command":70},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fglobal\u002Fsecurity-audit\u002FSKILL.md",true,[],[75,98,123,133,146,163],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":79,"categories":80,"keywords":86,"publishedAt":47},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[81],{"categoryNo":82,"categoryName":83,"taxonomyType":84,"taxonomyTypeDesc":85},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[87,88,89,90,91,92,93,94,43,95,96,97],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","official","fetch","with",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":47},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[105,106,107,108,109,110,89,111,112,113,114,115,116,117,118,119,120,121,122,38],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":47},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[130,131,105,116,117,118,119,109,89,121,132,122,38,115,113,112,111,120,110,108],"trend radar","radar","pulse",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":47},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[140,141,142,143,144,145],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":155,"publishedAt":47},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[152],{"categoryNo":153,"categoryName":154,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",[148,43,156,157,158,97,116,159,160,161,107,162,120],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":169,"publishedAt":47},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[165,170,171,172,120,173,160,174,175,176,177,178],"status","play","go","latest","github","discover","control","cmd","volume"]