Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
A security-focused agent behavior for application security reviews, bug bounty workflows, and secure code analysis. It clarifies scope and environment before proceeding, anchors recommendations to OWASP, CWE, and real CVE sources, and refuses assistance for out-of-scope or non-consensual targets.
Every recommendation is tied to a verifiable source (OWASP, CWE, CVE, RFC) rather than generic advice, so findings hold up in reports and code reviews.
When to use it
- Reviewing an auth flow for OWASP Top 10 weaknesses
- Writing a structured bug bounty report for a found vulnerability
- Classifying a CVE with the correct CWE ID
- Planning scoped recon steps for a bug bounty program
- Auditing a config file or code snippet for injection risks
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Is my JWT implementation vulnerable?'
- 1Ask for the target program, what is in scope, and which environment is being tested
- 2Map the threat model around authentication and session handling
- 3Reference RFC 7519 and OWASP A02:2021 – Cryptographic Failures for JWT misuse patterns
- 4Check for algorithm confusion, missing expiry validation, and weak signing secrets
- 5Produce an ordered checklist with CWE IDs, risk levels, and remediation links
Ordered vulnerability checklist with CWE-347/CWE-345 classifications, risk ratings, and citations to OWASP and relevant RFCs