bug-echo

After fixing a bug, find and rate other instances of the same pattern in the codebase. Two modes: described, or inferred from a recent fix with self-validation. Triggers: "run bug-echo", "echo this fix", "scan for similar bugs", "find other instances", "after-fix scan".

AI Tells — Structural Review

A judgment-based pass that catches the subtle tells the surface scan misses. Cite each finding, name the family, suggest a fix-direction. Then offer to rewrite.

Io.Github.JnMetaCode/Shellward

AI agent security: 7 MCP tools for injection detection, PII scanning, command safety, DLP.

Tickory MCP

Tickory MCP server for Binance scans, alert events, and explainability.

Io.Github.Inkog Io/Inkog

Scan AI agents for security vulnerabilities. Audit MCP servers before installation.

ScanMalware.com URL Scanner

MCP server for ScanMalware.com URL scanning, malware detection, and analysis.

Io.Github.Lordbasilaiassistant Sudo/Base Flash Arb Mcp

MCP server for AI agents to detect flash loan arbitrage opportunities across DEXes on Base. Scan Uni

narsil

Use narsil-mcp code intelligence tools effectively. Use when searching code, finding symbols, analyzing call graphs, scanning for security vulnerabilities, exploring dependencies, or performing static analysis on indexed repositories.

fleet-triage

Cognitive triage of fleet audit findings. Read issue content, evaluate labeling accuracy, and determine open/close/dispatch/relabel actions for fleet-managed issues. Use when triaging undispatched issues or reviewing audit scan results.

vibe-ship

Generates a complete, production-ready deployment setup for any app in one pass -- Dockerfile, docker-compose.yml, .dockerignore, CI/CD (GitHub Actions), scalability config (health checks, resource limits, K8s on request), and security hardening (non-root user, secrets, dependency scanning). Auto-detects the stack from repo files (package.json, requirements.txt, go.mod, pom.xml, Gemfile, etc.) and writes real working files, not just advice. Also audits an EXISTING Dockerfile/compose/CI setup with a static scoring script and reports concrete findings. Use whenever the user asks to "dockerize", "containerize", "make this deployable", "production-ready", "vibe ship this", "add CI/CD", "set up deployment", "ship this app", requests a Dockerfile/docker-compose/GitHub Actions workflow, or wants a deployment setup reviewed -- even for just one piece (e.g. "add a Dockerfile"), since the full set is interdependent.

Orca Account Health Skill

Answers the question: **"Is every account connected, recently synced, and fully scanned — so we can trust the data we're about to act on?"**

关闭 Code Scanning 告警

idea-check

Pre-build reality check. Scans GitHub, HN, npm, PyPI, and Product Hunt for existing competitors before you build. Use when starting a new project, evaluating a side project idea, or doing a build-vs-buy decision.

translate-retro-game

Playbook and tested tools for fan-translating Japanese retro games (SNES, GBA, NDS, PS1, PSP) into English. Covers tool setup, ROM recon, text extraction and insertion, fonts and VWF, text drawn as graphics, batch translation with parallel agents, headless emulator QA (MesenCE, DeSmuME, PCSX-Redux, PPSSPP), leftover-Japanese scans and BPS/xdelta releases. Use it for any work in a ROM-hacking or game-translation repo, including starting a new game, translating script batches, fixing overflowing, garbled or untranslated text, testing a build in an emulator and packaging a patch, even when the user doesn't name the skill.

nestjs-doctor

Scan a NestJS project with nestjs-doctor, present a health report, and fix issues interactively

broken-link-checker

Scans a website to find broken links (404s, 500s). Crawls internal pages, identifies broken outbound links, and reports source pages for easy fixing. Use this when the user asks to "check for broken links", "find 404s", "audit my links", or "is my site healthy".

Io.Github.Es617/Ble Mcp Server

Let AI agents interact with real BLE hardware — scan, connect, read, write, and subscribe.

SBOMApp - SBOM Generator & Vulnerability Scanner

Generate SBOMs, scan vulnerabilities, and analyze dependencies from local projects or Git repos.

Io.Github.Aguantar/Vibescan Mcp Server

MCP server for VibeScan — scan projects for leaked secrets and security issues

career-ops-plugin-apify

How to scan a job source through an Apify actor as a keyed provider.

board-scanner

Board scanning and dispatch procedure for GitHub Projects v2. Scans the project board for mgr:* statuses and dispatches work to the executor hat via priority table. Auto-injected into coordinator prompts.

Framework for building Agent Factories. CLI Native. Everything you will need!

Security audit of a codebase via parallel agents — one per vulnerability class. Reads code fast with Explore agents, cross-checks against current advisories via web search, filters false positives hard. Triggers on 'security scan', 'security audit', 'vulnerability scan', 'check for leaked secrets', 'scan for injection', or scheduled security checks.

tokf-discover

Find missed token savings by scanning AI coding session files for commands that ran without tokf filtering.

clawhub-skill-lint

Use this skill before publishing any ClawHub skill from this repo, or after editing a SKILL.md, to verify the skill won't be flagged or rejected by ClawHub's server-side moderation pipeline. The skill re-implements every static-scanner rule from openclaw/clawhub's `convex/lib/moderationEngine.ts` plus the frontmatter spec from `docs/skill-format.md` and runs them locally. Triggers: "lint the claws skills", "check the claws/openclaw skills", "scan before publish", "is the skill clean", "any scanner findings", /clawhub-skill-lint, before any `clawhub sync` or `clawhub skill publish`.

end

Session-closing skill that helps users wrap up intentionally. Use when: user says done, wrapping up, end my day, closing out, call it a day, goodnight, that's it for today, checkpoint, pause. Bookend to /start. Scans git activity, surfaces what happened, spawns a crystallize agent for deep analysis, commits uncommitted work, and closes with a brief summary. Works for end-of-day, end-of-research-batch, end-of-decision-sprint, or mid-work checkpoints.

career-ops

AI job search command center -- evaluate offers, generate CVs, scan portals, track applications

Probeops Mcp Server

Network diagnostics from 6 global regions. SSL, DNS, ping, whois, traceroute, port scan, latency.

crawl-apis

Scan a target codebase for API definitions (OpenAPI, REST routes, GraphQL schemas) and propose api_contract and api_endpoint registry entries. Presents findings for review before writing files.

Bright Security

AI-powered application security testing — scan APIs, discover endpoints, and find vulnerabilities.

agent-research-aggregator

Pre-pipeline aggregator that scans AI agent cache directories (.claude, .cursor, .antigravity, .openclaw) or any user-specified directory for experimentation logs, extracts insights and numeric results, and formats them as PaperOrchestra-ready inputs (idea.md + experimental_log.md). TRIGGER when the user says "aggregate my agent logs for paper writing", "extract experiments from my coding agent history", "prepare PaperOrchestra inputs from my cache", "turn my agent logs into a paper", mentions a folder or directory they want to use as the basis for a paper, or wants to run PaperOrchestra but only has scattered agent experiment histories rather than structured inputs. Run this BEFORE paper-orchestra. Also called automatically by paper-orchestra when workspace/inputs/idea.md or workspace/inputs/experimental_log.md are missing.

ssh-audit

This skill should be used when the user asks to "run a security scan", "check for vulnerabilities", "audit compliance", "check certificate expiry", "scan open ports", or mentions security reviews, CIS benchmarks, or compliance assessments on remote servers.

Mcp Server Indexforge

Submit URLs to Google and Bing for indexing, scan sitemaps, check index status.

Scopeblind Mcp

Scan, protect, and monitor APIs from AI coding tools. Device-level rate limiting.

mcpwall

iptables for MCP — blocks dangerous tool calls, scans for secrets, logs everything.

ipaship-audit

Use when auditing iOS/Android app submissions for compliance with Apple App Store Review Guidelines or Google Play Developer Policies. Scan .ipa, .apk, or .zip files against official store policies, generate structured compliance reports, and identify violations with remediation steps.

grype-syft-sbom-scanner

用于通过 Syft 生成 SBOM，并用 Grype 扫描容器镜像、文件系统、软件包、归档和 SBOM 漏洞。

SecurityScan

Scan GitHub-hosted AI skills for vulnerabilities: prompt injection, malware, OWASP LLM Top 10.

Nextscan

MCP server that scans Next.js projects and returns a compact summary

Io.Github.RECERQA/Rq Scan

MCP Server for RQ-SCAN - AI-powered document OCR and data extraction platform

evolution-engine

Scan accumulated feedback to identify patterns, generate evolution proposals for SKILL.md, rules, or new Skills.

Turbopentest

AI-powered penetration testing. Launch scans, review findings, download reports.

quality-scan

Validates structural consistency, cleans up junk files (SCREAMING_TEXT.md, temp files), and performs comprehensive quality scans across codebase to identify critical bugs, logic errors, caching issues, and workflow problems. Spawns specialized agents for targeted analysis and generates prioritized improvement tasks. Use when improving code quality, before releases, or investigating issues.

migrate-to-vinext

Migrates Next.js projects to vinext (Vite-based Next.js reimplementation). Load when asked to migrate, convert, or switch from Next.js to vinext. Handles compatibility scanning, package replacement, Vite config generation, ESM conversion, and deployment setup (Cloudflare Workers natively, other platforms via Nitro).

IncomeBot Trading Intelligence

Options trading — regime detection, momentum scanning, income screening, and risk simulation.

saferskills

Use SaferSkills to find, evaluate, and safely install AI agent capabilities (skills, MCP servers, hooks, plugins, rules) and to assess a whole agent. Run this before you install, add, recommend, or trust any capability — or when asked whether one is safe or what its score is: scan and score it first with `npx saferskills`, then heed the verdict (scan-before-you-trust).

Agent Dev — Vault-First Internal Development

Develop the agent's own internals with the vault as the primary source of truth. The vault knows more about the agent than any code scan or model training data. Always search the vault first, extract maximum context, and only then touch code.

Barcode Scanner

Scan and generate barcodes and QR codes.

Mcp Server Security Audit

Scan websites for security vulnerabilities, headers, TLS, and email security.

License Compliance

Scan npm dependencies for license compliance issues. Catch GPL contamination.

PreClick — An MCP-native URL preflight scanning service for autonomous agents.

PreClick scans links for threats and confirms intent match with high accuracy before agents click.