papers

Protects your credential lifecycle — not just finding secrets in source code (that's what Sentry does), but tracking how credentials are exposed through services, permissions, history, configs, contai

Monitors your workspace files for unauthorized modifications and prompt injection attacks. Existing security tools scan *skills* before installation — this tool watches the *workspace itself* after in

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns. Auto-blocks high-risk skills.

Configure DeepInfra model routing with provider auth, model selection, fallback chains, and cost-aware defaults for stable open-source and frontier model workflows.

Turn long documents, reports, proposals, and email threads into decision-ready memos with key points, risks, open questions, and next steps.

Scan AI agent skills for malware, credential theft, prompt injection, and dangerous permissions before installing them

>

Captures and logs choices, options, or prompts that the agent evaluated and decided NOT to execute. Use whenever you skip a task, reject an approach, or choose one method over another to provide transparency into your reasoning.

Simulate a full Chinese civil court hearing with 4 role-based agents (clerk, plaintiff, defendant, judge) orchestrated by deterministic Lobster workflow.

管理微信公众号从选题到发布的完整内容的固定流程，路由到各子能力。任何新任务执行时必须严格按这个流程顺序推进，选题 → 写稿 → 审稿(内容审) → 排版 → 配图 → 审稿(终审) →发布 ，且每一步完成是进入下一步的前提。当用户提到「公众号运营」「自动运营」「发篇文章」「内容规划」「怎么运营」「一条龙」「完整流程」「从头做」「帮我发一篇」「今天发什么」或需要了解整体流程时使用。

`loop-engine-governance` adds policy enforcement to OpenClaw workflows by routing decisions through Loop Engine transitions and guards.

Search YouTube videos, channels, and trends through the AISA YouTube SERP client. Use when: the user asks for content research, competitor tracking, or trend discovery without managing Google credentials. Supports curl queries and the bundled Python client with locale and filter controls.

A runtime security watchdog for OpenClaw agents. Its purpose is to give users clear visibility into what their installed skills are actually doing — catching unexpected file access, suspicious network

Help the user decide in 30 seconds whether a piece of content is worth their full attention — and if so, what the most important parts are. The summary should be a faithful compression, not a reinterp

Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.

>-

Analyzes git commit patterns to monitor autonomous operation health. Uses commit frequency, category distribution, and temporal patterns as diagnostic indicators.

Structured protocol for fixing bugs with AI agents. Prevents hallucinations and fix loops by enforcing step-by-step diagnosis before code changes.

listenhub

>

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

Use when a security incident has been detected or declared and needs classification, triage, escalation path determination, and forensic evidence collection. Covers SEV1-SEV4 classification, false positive filtering, incident taxonomy, and NIST SP 800-61 lifecycle.

Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry. Covers hypothesis-driven threat hunting, IOC sweep generation, z-score anomaly detection, and MITRE ATT&CK-mapped signal prioritization.

Env & Secrets Manager

Use when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), implement secret rotation, or audit secret access patterns.

Agile product ownership for backlog management and sprint execution. Covers user story writing, acceptance criteria, sprint planning, and velocity tracking. Use for writing user stories, creating acceptance criteria, planning sprints, estimating story points, breaking down epics, or prioritizing backlog.

Agent coordination, orchestration, and multi-agent workflow management scripts

[32] ANALYZE. Ensure every critical claim has verifiable evidence with confidence levels. Each fact must have source + confidence percentage. If confidence <85%, enter Loop150 to find more sources. Use for critical decisions, factual claims, legal/compliance work, or any situation where unverified claims are dangerous.

**Core Principle:** Commit to excellence. Work at 150% — 100% core delivery + 50% strengthening through verification, alternatives, and risk awareness.

[62] VALIDATE. Final self-check before delivery. Verify goal alignment, completeness, correctness, and identify residual risks. Produces quality score (0-100) and delivery status. Use when completing any significant work, before handoff, or when you need confidence that work is ready.

[70] CLOSE. Manage task lifecycle with correct statuses and no duplicates. Ensure each task has one status, artifacts match claims, and no task appears in multiple places. Use when managing task lists, updating progress, or ensuring task tracking integrity across systems.

9D product development framework

name: "AppleFoundationModels"

Structured 8D problem solving for customer complaints and quality issues. D0-D8 phases with containment, root cause analysis, and escape point identification. USE WHEN user says '8D', 'eight disciplines', 'customer complaint', 'corrective action', 'root cause analysis', 'containment', 'escape point', or 'problem solving report'.

Toyota-style A3 problem solving with embedded priority hierarchy: Safety First, then Customer Value, then Shareholder Value. Structured thinking framework for manufacturing decisions, root cause analysis, and countermeasure development. USE WHEN user says 'A3', 'problem solving', 'root cause', 'countermeasure', '5 whys', 'fishbone', 'ishikawa', 'priority decision', 'safety first', 'critical thinking', or needs structured analysis of manufacturing problems. Integrates with AutomotiveManufacturing and HoshinKanri skills.

Complete workflow for heat transfer analysis - steady-state and transient thermal. Use when user asks about temperature distribution, conduction, convection, or heat flow.

Helps create, analyze, and maintain Architecture Decision Records

Validate code changes against Architecture Decision Records (ADRs)

Multi-tool orchestration patterns for complex Bluera Knowledge operations. Teaches progressive library exploration, adding libraries with job monitoring, handling large result sets, multi-store searches, and error recovery workflows.

Detects when user requests warrant critical analysis via /advise command

Analyze changes and create a meaningful commit with agent authorship. Internal skill for evolve_loop.

**用途**: 定义 Agent（Subagent）的职责、擅长领域和配置

Dependency management, updates, and security advisory handling. Use when adding, updating, or auditing project dependencies.

Conduct structured interviews with the user. Use when multiple decisions need user input: ask ONE question at a time, wait for response, record answer, then proceed to next question.

Produce a thorough plan before implementation. Use for planning tasks: clarify unknowns, create plan iterations based on confidence level, validate each, then finalize.

Pre-commit and pre-merge validation checks. Use before committing changes or declaring work complete to ensure all quality gates pass.

Evaluate how well a codebase supports autonomous agent execution based on the "How to Get Out of Your Agent's Way" principles.

A two-phase repair skill that analyzes errors and suggests fixes before executing repairs. Phase one: user describes error, agent analyzes and proposes solution. Phase two: upon approval, executes the repair action.

Create and structure Claude Code agent skills. Use when the user wants to create a new skill, write an agent skill, make a claude skill, or asks about SKILL.md files.