Conduct comprehensive security audits and vulnerability analysis on codebases. Use when explicitly asked for security analysis, code security review, vulnerability assessment, SAST scanning, or identifying security issues in source code. Covers injection flaws, broken access control, hardcoded secrets, insecure data handling, authentication weaknesses, LLM safety, and privacy violations.
Initial release of security-analysis skill for codebase and SKILL.md vulnerability assessment. - Provides detailed procedures for conducting security audits, vulnerability analysis, and SAST scanning. - Strict "analyze only on explicit request" policy to minimize unnecessary access. - Covers injection flaws, broken access control, hardcoded secrets, insecure data handling, authentication issues, LLM/prompt risks, and privacy violations. - Defines comprehensive review checklist for OpenClaw SKILL.md and agent instruction files to catch instruction injection, data exfiltration, privilege escalation, hidden instructions, unsafe tool use, and social engineering. - Includes report format, severity rubric, and evidence-based reporting requirements to ensure accurate, actionable security findings.