Scan web servers for vulnerabilities with Nikto. Use when a user asks to audit web server configuration, find outdated software, detect dangerous files, check for misconfigurations, or perform web server security scanning.

Protect servers with CrowdSec collaborative security. Use when a user asks to block malicious IPs, detect brute force attacks, protect web servers, or set up a community-driven firewall and intrusion detection system.

Audit project dependencies for vulnerabilities, license risks, upgrade planning, and ecosystem health across multiple languages.

Tool discovery and shell one-liner reference for sysadmin, DevOps, and security tasks. AUTO-CONSULT this skill when the user is: troubleshooting network issues, debugging processes, analyzing logs, working with SSL/TLS, managing DNS, testing HTTP endpoints, auditing security, working with containers, writing shell scripts, or asks 'what tool should I use for X'. Source: github.com/trimstray/the-book-of-secret-knowledge

Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.

Audit OpenClaw token usage, purge stale sessions, and optimize inference speed. Use when the user sends /optimize, /audit, asks to purge sessions, or wants a token/workspace audit.

Implement static code analysis with linters, formatters, and security scanners to catch bugs early. Use when enforcing code standards, detecting security vulnerabilities, or automating code review.

You are a compliance expert specializing in regulatory requirements for software systems including GDPR, HIPAA, SOC2, PCI-DSS, and other industry standards. Perform compliance audits and provide im...

# Compliance & Audit Readiness Engine

Audit rapidly generated or AI-produced code for structural flaws, fragility, and production risks.

Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).

Run internal compliance audits against major governance and security frameworks, highlighting gaps, risks, and remediation priorities.

Prepare for internal and external audits with SOX 404 control testing, sample selection, workpaper documentation, and deficiency evaluation. Use for SOX compliance, control testing methodology, audit sample selection, audit workpaper preparation, control deficiency classification, material weakness evaluation, ITGC testing, remediation tracking, or audit evidence standards.

Prepare structured escalation packages for engineering, product, security, or leadership with reproduction steps, business impact, and full context. Activate when a support issue needs to go beyond the support team, when writing an escalation document, when evaluating whether a problem warrants escalation, or when tracking follow-through after handing off an issue.

Validate and test Doppler secrets. TRIGGERS - add to Doppler, store secret, validate token, test credentials.

Send Pushover notifications with UUID-linked verbatim JSONL audit trail. TRIGGERS - pushover notify, send pushover, observability alert, verbatim notification, fleet alert, pushover-lookup, audit log notification, push notification with UUID

Validate plugin structure and silent failures. TRIGGERS - plugin validation, check plugin, hook audit.

Diagnose the po Pushover plugin and check remaining monthly quota. Runs a full self-test (credential resolution via 1Password/Keychain, /users/validate.json, quota, expected custom sounds present, deps bun/uv/chrome, audit log) and reports message quota remaining. Use when the user asks if Pushover is working, why a notification failed, how many messages are left, or wants a health/diagnostic check. TRIGGERS - pushover health, po doctor, pushover not working, pushover quota, messages left, diagnose pushover.

Liznr platform help — AI meeting assistant with real-time transcription, contextual intelligence, and task sync to Jira/Slack/Notion. Use when setting up Liznr Chrome extension or Teams app for meeting recording, Liznr transcription not capturing speakers correctly, Liznr action items not syncing to Jira or Slack, choosing Liznr vs Fathom or Fireflies or tl;dv for budget meeting notes, evaluating Liznr for recruiting interviews or legal meetings, Liznr multilingual transcription accuracy, or Liznr privacy and data security questions. Do NOT use for comparing note-takers broadly without mentioning Liznr (use /sales-note-taker) or reviewing a specific call for coaching (use /sales-call-review).

This skill should be used when bootstrapping, auditing, or reviewing the community-health and repository-cornerstone files in a code repository: README, LICENSE, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, SUPPORT, issue / PR templates, CODEOWNERS, FUNDING, CITATION, and REUSE / SPDX metadata. PROACTIVELY activate on "set up new repo docs", "community health files", "what should my README contain", "do I need a code of conduct", "audit repo bootstrap docs", "repository documentation cornerstones", "pick a license", "CONTRIBUTING.md", "SECURITY.md", "vulnerability reporting", "SUPPORT.md", "CODEOWNERS", "issue templates", "PR templates", "CITATION.cff", "REUSE", "SPDX headers", "Standard Readme", "Contributor Covenant". Provides: four-question diagnostic per cornerstone, Standard Readme structure, license routing (no picking), CONTRIBUTING / CODE_OF_CONDUCT / SECURITY / SUPPORT canons, template files, and REUSE 3.3 / SPDX routing.

Git security best practices for 2025-2026 (signed commits, zero-trust, secret scanning). PROACTIVELY activate for: (1) configuring signed commits (GPG, SSH, S/MIME), (2) verifying commit signatures, (3) zero-trust Git workflows, (4) secret scanning (GitHub Advanced Security, gitleaks, trufflehog), (5) preventing secret leaks via pre-commit hooks, (6) protected branches and required reviewers, (7) CODEOWNERS for sensitive paths, (8) Sigstore-style attestations, (9) detecting and remediating leaked credentials, (10) supply-chain security (provenance, SBOM, SLSA). Provides: signed commit setup, secret-scanning integration, pre-commit hook templates, branch protection patterns, and incident-response checklist for credential exposure.

This skill should be used to retroactively record an architectural decision that was made in the past but never written up as an ADR — typically surfaced by a doc audit or by a user realising a long-ago shipped change should have been documented. PROACTIVELY activate on "backfill ADR", "retroactive ADR", "post-hoc ADR", "reconstruct an ADR from history", "write up a past decision", "we never documented this decision", "decision was made but no ADR exists", "we decided years ago", "back when", "before my time", or "the audit surfaced a backfill candidate." Tense rule: `adr-drafting` claims "we decided / we're deciding"; `adr-backfill` claims "we decided years ago / back when / before my time / never wrote it down." Refuses when reconstruction confidence is `low` -- routes to `open-questions.md`. Requires evidence in two independent locations and a verbatim honesty clause in the record. Provides: backfill ADR template, confidence rubric, evidence corroboration, honesty-clause boilerplate.

This skill should be used when the user asks to work with Modal.com persistence or shared state. PROACTIVELY activate for: Modal Volumes, vol.commit, Dict, Queue, CloudBucketMount, S3 or GCS mounts, secret-backed storage credentials, model cache persistence, dataset staging, shared queues, distributed state, volume consistency, and storage troubleshooting. Provides: storage primitive selection matrix, commit/consistency patterns, mount configuration recipes, and troubleshooting checklists.

This skill should be used when the user asks to run isolated or untrusted code on Modal.com. PROACTIVELY activate for: modal.Sandbox, safe user code execution, coding playgrounds, named sandboxes, PTY sessions, filesystem snapshots, timeout and resource limits, egress policies, sandbox lifecycle cleanup, terminate(), and security review for code execution. Provides: sandbox security checklist, lifecycle and cleanup patterns, egress/resource-limit recipes, and snapshot/PTY usage examples.

Modern PowerShell security practices for 2025 — SecretManagement, JEA, WDAC, credential protection. PROACTIVELY activate for: (1) Microsoft.PowerShell.SecretManagement and SecretStore for credential storage, (2) Just Enough Administration (JEA) endpoints, (3) Windows Defender Application Control (WDAC) for PowerShell, (4) credential protection (PSCredential, SecureString, DPAPI), (5) module signing and Authenticode signatures, (6) ConstrainedLanguage mode, (7) audit logging (transcription, ScriptBlock logging, module logging), (8) AMSI integration, (9) AppLocker rules for PowerShell, (10) supply-chain security (PSGallery trust, package hash verification). Provides: SecretManagement setup, JEA configuration, WDAC policy templates, signing workflow, and audit-logging configuration.

Security-first bash scripting patterns for 2025 (mandatory validation, zero-trust). PROACTIVELY activate for: (1) reviewing or writing security-sensitive bash scripts, (2) preventing command injection via input validation, (3) safely handling untrusted input (URLs, filenames, env vars), (4) protecting HISTFILE and avoiding secret leakage, (5) safe temporary file creation (mktemp), (6) absolute paths and PATH hardening, (7) avoiding eval and dynamic command construction, (8) signal handling for cleanup, (9) ShellCheck SC2068 / SC2086 compliance. Provides: mandatory-validation patterns, secret-handling rules, mktemp recipes, signal-safe cleanup, and a security review checklist.

Senior ISMS Audit Expert for internal and external information security management system auditing. Provides ISO 27001 audit expertise, security audit program management, security control assessment, and compliance verification. Use for ISMS internal auditing, external audit preparation, security control testing, and ISO 27001 certification support.

Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

Comprehensive code review skill for TypeScript, JavaScript, Python, Swift, Kotlin, Go. Includes automated code analysis, best practice checking, security scanning, and review checklist generation. Use when reviewing pull requests, providing code feedback, identifying issues, or ensuring code quality standards.

Senior QMS Audit Expert for internal and external quality management system auditing. Provides ISO 13485 audit expertise, audit program management, nonconformity identification, and corrective action verification. Use for internal audit planning, external audit preparation, audit execution, and audit follow-up activities.

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Implement PCI DSS compliance requirements for secure handling of payment card data and payment systems. Use when securing payment processing, achieving PCI compliance, or implementing payment card security measures.

Pre-commit security validation and secret detection via gitleaks. Use when scanning for secrets, setting up gitleaks, or configuring .gitleaks.toml pre-commit security.

Audit user stories against codebase and tests for tier-ranked coverage gaps. Use when running story audit, PRD reconciliation, or surfacing PRD-code drift.

Analyze a codebase for anti-patterns using ast-grep. Use when finding magic numbers, console.logs, var usage, excessive any, eval/innerHTML security issues, or deep nesting.

Android app that detects VPN/proxy servers (VLESS/xray/sing-box) via local SOCKS5 vulnerability, exposing exit IPs and server configs without root

Reconcile PRD requirements with a story-audit drift report. Use when marking PRD entries implemented/partial/missing, or promoting code-only stories into the PRD.

Audit skill tree for overlap, split-pressure, and consolidation candidates. Use when finding confusing skill clusters or surfacing REFERENCE.md extraction candidates.

Local-first, security-first control center for OpenClaw agents — visibility dashboard with readonly defaults, token attribution, collaboration tracing, and safe write operations.

Run all infrastructure standards checks and fixes. Use when onboarding a new project, doing a full compliance audit, or batch-fixing with --fix.

AI model safety scanner built on NVIDIA garak for testing LLMs against 179 security probes across 35 vulnerability families

Bun lockfile update (bun.lockb): bun update, regeneration, security audits. Use when updating dependencies, resolving lockfile conflicts, or regenerating bun.lockb.

Detector and proof-of-concept LPE toolkit for CVE-2026-31431 ("Copy Fail"), a Linux kernel algif_aead page-cache scratch-write vulnerability enabling local privilege escalation.

Audit skills, commands, and agents for agentic output compliance — optimization tables, bare CLI commands. Use when batch-checking skill documentation quality.

Analyze test results and create a fix plan with subagents. Use when triaging failing tests, analyzing JUnit XML, planning fixes for accessibility/security, or categorizing flaky/E2E failures.

Skill for working with the BlueHammer vulnerability proof-of-concept repository, covering build, usage, and code patterns.

Go implementation of CVE-2026-31431 (CopyFail), a Linux local privilege escalation exploit targeting the AF_ALG iov_iter kernel vulnerability affecting kernels v4.14–April 2026.

macOS EndpointSecurity/EDR high CPU & battery drain. Use when Kandji ESF / XProtect pegs a core; trace the exec storm via powermetrics + eslogger.

Audit Claude subagent configs for completeness, security, and best practices. Use when reviewing agents/ for missing frontmatter, overprivileged tools, or bad model choices.

Obsidian vault search: full-text/grep, tag listing, link traversal, outline, orphan/dead-end detection, broken wikilink audit. Use when exploring backlinks.

Audit dependencies for security vulnerabilities, outdated packages, and license compliance. Use when checking supply chain security, preparing releases, or responding to CVEs.

Code review for quality, security, performance, and architecture. Use when reviewing code, auditing OWASP, checking SOLID, or finding perf bottlenecks and test gaps.

Checklist for security, correctness, and performance review. Use when reviewing PRs, checking for secrets/injection, verifying error handling, or auditing N+1 queries.

Route to specialized agents (security, test, refactor, docs) based on codebase health attributes by severity. Use when the user has attribute data and wants automated remediation.

Audit and improve CLAUDE.md files in repositories. Use when user asks to check, audit, update, improve, or fix CLAUDE.md files. Scans for all CLAUDE.md files, evaluates quality against templates, outputs quality report, then makes targeted updates. Also use when the user mentions "CLAUDE.md maintenance" or "project memory optimization".

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Spring AOP (Aspect-Oriented Programming) per Spring Boot 3.x. Copre @Aspect, pointcut expressions, @Around/@Before/@After advice, custom annotations, logging, security, caching, e transaction patterns. Usa per cross-cutting concerns. USE WHEN: user mentions "aspect", "AOP", "cross-cutting", "logging aspect", "pointcut", asks about "how to intercept methods", "apply logic to multiple methods", "@Around advice" DO NOT USE FOR: security configuration - use `spring-security` instead, transaction management - use `spring-data-jpa` instead

Spring Authorization Server for building OAuth 2.1 and OpenID Connect providers. USE WHEN: user mentions "OAuth2 server", "authorization server", "OIDC provider", "token endpoint", asks about "how to implement OAuth2", "create authorization server", "issue JWT tokens", "custom OAuth provider" DO NOT USE FOR: OAuth2 client configuration - use `spring-security` instead, resource server JWT validation - use `spring-security` instead

Go security patterns for web applications. Covers dependency auditing, secure coding practices, crypto, and OWASP for Go ecosystem. USE WHEN: user works with "Go", "Golang", "Gin", "Fiber", "Echo", asks about "Go vulnerabilities", "Go modules security", "Go injection", "Go authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, other language security - use language-specific skills

.NET code quality with Roslyn analyzers, StyleCop, and dotnet format. Covers linting, formatting, and best practices for C#/.NET. USE WHEN: user works with "C#", ".NET", "ASP.NET Core", asks about "Roslyn analyzers", "StyleCop", "dotnet format", ".NET linting", "C# best practices" DO NOT USE FOR: SonarQube - use `sonarqube` skill, testing - use .NET test skills, security - use `dotnet-security` skill

Open source license compliance and SPDX standards. Covers license types, compatibility, auditing with license-checker, and SBOM generation. USE WHEN: user mentions "license", "SPDX", "GPL", "MIT", "Apache", asks about "license compatibility", "license-checker", "copyleft", "proprietary compliance", "OSI approved" DO NOT USE FOR: dependency vulnerabilities - use `supply-chain`, security scanning - use `owasp-top-10`, secrets - use `secrets-management`

Spring Security JWT authentication for Spring Boot 3. Covers SecurityFilterChain, JWT filter, authentication, authorization, CORS, rate limiting, and security headers. USE WHEN: user mentions "security", "JWT", "authentication", "authorization", asks about "login", "token", "CORS", "roles", "permissions", "@PreAuthorize" DO NOT USE FOR: Spring Boot basics (use `spring-boot`), OAuth2 details (use OAuth2 skill if available), general encryption (use security-expert)

C++ memory and concurrency safety: AddressSanitizer (ASan), UndefinedBehaviorSanitizer (UBSan), ThreadSanitizer (TSan), MemorySanitizer (MSan), MSVC `/sdl` and `/guard:cf`, CERT C++ secure coding rules, integer-overflow safe arithmetic, and Control Flow Integrity. USE WHEN: user mentions "ASan", "AddressSanitizer", "UBSan", "TSan", "MSan", "use-after-free", "buffer overflow", "undefined behavior", "data race", "CERT C++", "secure C++", "/sdl", "/GS", "ASLR", "DEP", "stack canary" DO NOT USE FOR: Web/app security (use `owasp`), .NET security (`dotnet-security`), cryptography APIs (use `cryptography`)

Bean Validation (JSR-380) with Spring Boot. Covers request validation, custom validators, validation groups, and error handling. USE WHEN: user mentions "spring validation", "@Valid", "@NotNull", "@NotBlank", "bean validation", "request validation", "custom validator", "validation groups", "ConstraintValidator", "@Pattern" DO NOT USE FOR: business rule validation - use service layer, security validation - use `spring-security` skill

Go code quality with golangci-lint, staticcheck, and go vet. Covers linting, formatting, and best practices. USE WHEN: user works with "Go", "Golang", "Gin", "Fiber", "Echo", asks about "golangci-lint", "staticcheck", "go vet", "Go linting", "Go best practices" DO NOT USE FOR: SonarQube - use `sonarqube` skill, testing - use Go test skills, security - use `go-security` skill

TypeScript/JavaScript code quality with ESLint, Biome, and strict TypeScript. Covers linting, formatting, type safety, and best practices. USE WHEN: user works with "TypeScript", "JavaScript", "ESLint", "Biome", asks about "TS strict mode", "type safety", "linting rules", "code formatting" DO NOT USE FOR: SonarQube - use `sonarqube` skill, testing - use Vitest/Jest skills, security - use security skills

OWASP Top 10:2025 security vulnerabilities. Covers access control, injection, supply chain, cryptographic failures, and more. Use for security reviews. USE WHEN: user mentions "OWASP 2025", "Top 10", "security review", "vulnerability assessment", asks about "broken access control", "injection", "supply chain", "cryptographic failures", "exception handling" DO NOT USE FOR: general OWASP (2021) - use `owasp` instead, secrets - use `secrets-management`, dependencies - use `supply-chain`

Cyber-physical / industrial control system (ICS-SCADA) architecture in general: the Purdue model levels, control loops, IT/OT convergence, OT security (IEC 62443, segmentation, zero-trust for OT), safety, determinism, and redundancy. Architect-level, beyond any specific DCS/PLC product. USE WHEN: designing/evaluating industrial control, SCADA, robotics, energy, automotive, or IoT-at-scale systems, "OT security", "Purdue model", "PLC/RTU/ SCADA architecture", "IT/OT convergence", "IEC 62443", "control loop", safety instrumented systems. DO NOT USE FOR: specific DCS platforms / IEC 61131 / ISA formats (use the `industrial/*` skills); pure RTOS scheduling (use `embedded-rtos`); app security (use `security-architecture`).

Universal code quality principles applicable to all languages. Covers Clean Code, SOLID, complexity metrics, and quality standards. USE WHEN: user mentions "clean code", "SOLID", "code smells", "refactoring", "complexity", asks about "cyclomatic complexity", "cognitive complexity", "code review", "maintainability" DO NOT USE FOR: language-specific linting - use ESLint/Biome skills, security - use OWASP skills, testing - use testing skills

WebAuthn/FIDO2 passwordless authentication. Passkeys, registration and authentication ceremonies, SimpleWebAuthn library, resident credentials, and platform/cross-platform authenticators. USE WHEN: user mentions "WebAuthn", "FIDO2", "passkey", "passwordless", "biometric login", "security key", "fingerprint login", "SimpleWebAuthn" DO NOT USE FOR: password-based auth - use `jwt` or `oauth2`; magic links - different flow; OAuth social login - use `oauth2`

Audit logging for compliance and security. Structured audit events, immutable logs, user action tracking, database change tracking, and regulatory compliance (SOC2, HIPAA, GDPR). USE WHEN: user mentions "audit log", "audit trail", "activity log", "change tracking", "compliance logging", "who changed what", "SOC2 logging" DO NOT USE FOR: application logging - use logging skills; error tracking - use observability skills

Adaptor signatures: pre-signature paired with a "secret" such that publishing a valid signature reveals the secret, and vice versa. Foundational for atomic swaps, scriptless scripts, DLCs, Submarine Swaps trustless variants, PTLCs (Point Time-Locked Contracts). USE WHEN: designing atomic swaps, evaluating PTLCs vs HTLCs, building DLCs, understanding scriptless scripts.

CORS configuration and HTTP security headers. CORS middleware, preflight requests, Content-Security-Policy, CSRF protection, Helmet.js, and secure cookie configuration. USE WHEN: user mentions "CORS", "cross-origin", "CSP", "Content-Security-Policy", "CSRF", "security headers", "Helmet", "preflight", "Access-Control" DO NOT USE FOR: authentication tokens - use `jwt` or `oauth2`; encryption - use `cryptography`

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

Bitcoin Core release engineering: Guix reproducible builds, signed release tarballs, deterministic outputs, code-signing keys, the release process, security disclosure. USE WHEN: building Bitcoin Core from source for verification, understanding release security, contributing to consensus-critical code.

Multi-vendor multisig: combining HW wallets from different vendors (Trezor + Ledger + Coldcard) for diversification. Coordinator-mediated setup, descriptor sharing, threat model. USE WHEN: designing multi-vendor custody, implementing 2-of-3 multisig with diverse hardware.

BIP47 reusable payment codes (PayNyms): notification transactions, derived per-counterparty addresses, Diffie-Hellman shared-secret derivation. Privacy-preserving alternative to address rotation. USE WHEN: implementing PayNyms / Sparrow / Samourai-compatible payment codes, evaluating BIP47 vs Silent Payments.

Multi-Path Payments (MPP) — split a payment across multiple parallel routes; same payment hash, payment_secret binds parts. AMP (Atomic Multipath) — variant where each part has different hash; receiver derives shared secret. USE WHEN: implementing payment splitting, debugging "couldn't route full amount", evaluating MPP vs AMP.

Replacement cycling attack on Lightning (Riard 2023): exploits BIP125 rule 5 to indefinitely delay an honest HTLC-timeout, costing the victim. Mitigated by TRUC v3 + ephemeral anchors. USE WHEN: auditing LN security posture, evaluating fee-bumping strategies, understanding why TRUC was activated.

BitVM, BitVM2, BitVM3: off-chain computation framework using optimistic challenge games on Bitcoin script. Foundation for trust-minimized bridges to L2s and PoS chains. USE WHEN: building trust-minimized bridges, understanding ZK rollup peg-out mechanisms, evaluating bridge security models.

Stratum V1: TCP/JSON protocol between mining pool and miners. Subscribe, authorize, mining.notify, mining.submit. Most-used protocol but security/decentralization weaknesses. USE WHEN: integrating mining hardware, building pool / proxy software, debugging hash submission.

# Kotlin Security Skill

Channel jamming attacks: slow-jam (long-held HTLCs exhaust slots), fast-jam (rapid hold/release exhausts liquidity). Mitigations: upfront fees, reputation, hold-fee proposals. USE WHEN: assessing LN security model, designing reputation systems, evaluating jamming-resistant routing.

Pinning attacks: low-fee descendant txs block honest fee-bumping by exploiting mempool descendant policy. Anchor outputs (BOLT-3), TRUC v3 (BIP431), and ephemeral anchors as defenses. USE WHEN: auditing fee-bump robustness, evaluating channel security, reviewing post-2024 LN deployments.

Statechains: off-chain UTXO ownership transfer via Statechain Operator (SO) signing. Mercury Layer (CommerceBlock) is the main implementation. 1-of-N security model. USE WHEN: evaluating off-chain UTXO transfer, comparing with Spark/ Ark, designing 1-of-N security models.

# Infrastructure as Code Security Skill

# TypeScript Security Skill

BOB (Build on Bitcoin): hybrid Bitcoin/Ethereum L2 using OP Stack + Bitcoin security. Bridges to Bitcoin via threshold signatures + zk-proofs. USE WHEN: building cross-chain Bitcoin/Ethereum apps, evaluating BOB hybrid model.

# Container Security Skill

# PHP Security Skill

# AI-Generated Code Security Skill