Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Added AI Dev Quality Suite cross-references, ClawHub badges, improved install instructions
What This Skill Does
A structured 6-phase audit methodology for Node.js web projects. It reads the codebase to build 7 project-specific tables covering API endpoints, state machines, timers, numeric values, data flows, resource ledgers, and concurrency hotspots, then verifies each row exhaustively. Supports games, data tools, WeChat apps, API services, bots, and dashboards.
Builds project-specific audit tables from actual code rather than running a generic checklist, so it catches logic bugs and data flow vulnerabilities that automated scanners miss.
When to use it
- Auditing a game backend for exploitable economy or scoring bugs
- Finding race conditions in payment or coupon redemption flows
- Checking a WeChat mini-app for OAuth and session vulnerabilities
- Reviewing an API service for auth bypass and rate abuse
- Verifying state variables reset correctly between game rounds
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: audit my Node.js game backend for bugs and vulnerabilities
- 1Read all project files and identify the project type
- 2Build 7 audit tables: API endpoints, state machines, timers, numeric values, data flows, resource ledgers, and concurrency hotspots
- 3Verify each table row, rating each finding as critical, medium, minor, or OK
- 4Run red team attack chains (universal + game-specific) and verify blue team defenses for each critical finding
- 5Run supplementary generic checks from modules.md matching the project type
Numbered bug list with severity ratings, root causes, fix recommendations, and affected files, plus an archive entry documenting tables built and key pitfalls