code-security-audit
Comprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis.
Combines OWASP scanning with dependency analysis in one pass — security review without hiring a consultant.
Finding signal on Twitter is more difficult than it used to be. We curate the best tweets on topics like AI, startups, and product development every weekday so you can focus on what matters.
100+ hand-picked skills across 25 categories.
Comprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis.
Combines OWASP scanning with dependency analysis in one pass — security review without hiring a consultant.
Codebase intelligence — generates structured navigation maps with file:line references so agents stop re-scanning.
Solves a real pain point: agents wasting tokens re-exploring codebases they've already seen. Navigation maps persist across sessions.
Orchestrate multiple AI coding agents (Claude Code, Codex, Aider) from a single config — launch teams, run workflows, track capacity, and manage handoffs.
True multi-agent coding orchestration across three major CLI tools. The capacity tracking and handoff management put it a cut above simpler launchers.
Browser automation via Playwright MCP server.
MCP-server approach to Playwright automation — better suited when you want a persistent browser process managed outside the agent lifecycle.
Complete Motion.dev documentation - modern animation library for React, JavaScript, and Vue (formerly Framer Motion).
Motion.dev (formerly Framer Motion) is widely used but its API changes often. This skill keeps agents current.
Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics.
Actively fights the homogenized look of AI-generated UIs. Results in sites that don't look like every other vibe-coded product.
Search Google, scrape web pages, Amazon product pages, YouTube subtitles, or Reddit (post/subreddit).
Multi-platform scraper covering the most common research targets in one skill. Broad enough to be a go-to research tool.
Universal AI-powered web scraper for any platform.
Backed by Apify's battle-tested infrastructure. Handles scale and anti-bot measures better than DIY scraping approaches.
Connect 850+ apps (Gmail, Slack, GitHub, Calendar, Notion, Jira, and more) to OpenClaw via Composio.
850+ app integrations through one skill. The connector-of-connectors for agents that need to talk to many services.
Production-grade agent DevOps toolkit — Docker, process management, log analysis, and health monitoring.
The most complete DevOps skill available. Docker, logs, health checks, process management — all in one place.
Search the web with AI-powered answers via Perplexity API.
Perplexity API access in a single skill. Cleaner than web_fetch for research queries that need synthesis across multiple sources.
An autonomous research agent for OpenClaw that searches, synthesizes, and stores findings with full source tracking.
Full autonomous research loop with source tracking. Produces verifiable research, not hallucinated summaries.
Command-line interface for Deepgram speech-to-text.
Deepgram offers the best accuracy-per-dollar for speech transcription. This skill makes it usable from any agent workflow.
Automatically switch between fast (haiku) and powerful (sonnet) models based on task complexity.
Cost-optimized model routing based on task complexity. Trivial tasks don't need Opus; this enforces that automatically.
Generate images, videos, icons, audio, and more using Freepik's AI API.
Freepik's commercially-safe content library plus AI generation. Relevant for anyone building assets for business use.
Download videos from YouTube, Instagram, TikTok, Twitter/X, and 1000+ other sites using yt-dlp.
yt-dlp is the definitive video downloader. 1000+ sites, best quality selection, actively maintained.
Script-free Govee OpenAPI setup and control guide.
Govee is one of the most popular smart light brands. Script-free control removes a significant setup barrier.
Proof collaborative editor — human+AI document editing with comments, suggestions, and provenance tracked in a shared doc.
Dan Shipper's collaborative editor built for the AI age. Tracks document provenance and combines human and AI edits in one surface. Featured must-include from the product owner.
108 skills
Comprehensive code security audit toolkit combining OWASP Top 10 vulnerability scanning, dependency analysis.
Combines OWASP scanning with dependency analysis in one pass — security review without hiring a consultant.
Codebase intelligence — generates structured navigation maps with file:line references so agents stop re-scanning.
Solves a real pain point: agents wasting tokens re-exploring codebases they've already seen. Navigation maps persist across sessions.
Systematic debugging that prevents patch-chaining and workaround addiction in AI agents.
Addresses one of the most common failure modes in AI coding: layering fixes on top of fixes. Enforces root-cause discipline.
Scan codebase for environment variables, generate .env.example, validate .env, and ensure .gitignore safety.
Essential DevEx helper. Every project needs .env hygiene and this automates the boring but important parts.
Generate a production-quality README.md by analyzing project structure, framework, and code.
Generates real README files by reading actual code — not template-filled junk. Developers will use this constantly.
Senior Python Developer operating in strict mode.
A well-scoped persona skill that enforces professional coding standards. Useful when you need the agent to stop cutting corners.
Expert Haskell development skill.
Haskell expertise is rare and hard to approximate from base models. This specialized skill fills a real gap for functional programmers.
Generate visual flow diagrams, architecture diagrams, and system maps as SVG/PNG.
Visual architecture documentation that outputs real image files. Pairs perfectly with README generation for complete project docs.
Write decision-oriented engineering RFCs with strict template enforcement.
Enforces proper RFC structure rather than producing freeform documents. Strict template mode is exactly what eng teams need.
Orchestrate multiple AI coding agents (Claude Code, Codex, Aider) from a single config — launch teams, run workflows, track capacity, and manage handoffs.
True multi-agent coding orchestration across three major CLI tools. The capacity tracking and handoff management put it a cut above simpler launchers.
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running actual verification.
Forces agents to actually verify claims before declaring done. Solves the hallucinated 'it works' problem that plagues AI coding sessions.
Use when facing 2+ independent tasks that can be worked on without shared state or sequential dependencies.
Concise, practical guidance on when and how to run agents in parallel. Reduces both time and cost on multi-file changes.
Use when completing tasks, implementing major features, or before merging to verify work meets requirements.
Structures the code review request process so agents surface the right context. Pairs well with other finishing-workflow skills.
Browser automation via Playwright MCP server.
MCP-server approach to Playwright automation — better suited when you want a persistent browser process managed outside the agent lifecycle.
Complete Zod validation library documentation.
Zod's API surface is large enough that agents regularly get it wrong without reference. This fills that gap cleanly.
Complete Motion.dev documentation - modern animation library for React, JavaScript, and Vue (formerly Framer Motion).
Motion.dev (formerly Framer Motion) is widely used but its API changes often. This skill keeps agents current.
Create distinctive, production-grade frontend interfaces that avoid generic AI aesthetics.
Actively fights the homogenized look of AI-generated UIs. Results in sites that don't look like every other vibe-coded product.
Create award-winning, memorable websites with advanced animations, creative interactions, and distinctive visual identity.
Goes beyond functional to beautiful. Useful when a project needs to stand out and the agent needs a higher aesthetic bar.
UI/UX design intelligence and implementation guidance for building polished interfaces.
Encyclopedic UI/UX reference that covers patterns, accessibility, and implementation. Raises the ceiling on what agents produce by default.
Best practices for Stripe payment integration.
Stripe's correct integration paths are non-obvious. This skill prevents the expensive webhook-handling mistakes agents commonly make.
Ship a complete web app from idea to public deployment in one session.
End-to-end shipping in a single turn. Captures the entire build-deploy loop for fast prototyping and demo apps.
Senior-level Clerk authentication expertise for Next.js 15/16+ applications.
Clerk auth in Next.js App Router is notoriously tricky. This skill gets agents past the common session/middleware gotchas.
Enhances agent-built websites with proper schema.org structured data for SEO, rich snippets, and search engine visibility.
Structured data is consistently omitted from AI-built sites. This skill adds it correctly and improves search visibility without manual work.
Search Google, scrape web pages, Amazon product pages, YouTube subtitles, or Reddit (post/subreddit).
Multi-platform scraper covering the most common research targets in one skill. Broad enough to be a go-to research tool.
Universal AI-powered web scraper for any platform.
Backed by Apify's battle-tested infrastructure. Handles scale and anti-bot measures better than DIY scraping approaches.
A general-purpose webhook receiver that routes incoming webhooks from any source to appropriate handlers.
Essential glue infrastructure. Any agent that needs to react to external events needs a webhook router.
Connect 850+ apps (Gmail, Slack, GitHub, Calendar, Notion, Jira, and more) to OpenClaw via Composio.
850+ app integrations through one skill. The connector-of-connectors for agents that need to talk to many services.
Design AWS architectures for startups.
AWS architecture guidance tuned for startup constraints — not enterprise patterns that don't fit a 5-person team.
Production-grade agent DevOps toolkit — Docker, process management, log analysis, and health monitoring.
The most complete DevOps skill available. Docker, logs, health checks, process management — all in one place.
AI-powered incident triage for PagerDuty.
PagerDuty integration that turns alerts into structured triage workflows. Reduces the chaos of first response.
Manage Cloudflare domains, DNS records, SSL settings, zone configuration, firewall rules, tunnels, and analytics.
Comprehensive Cloudflare coverage including analytics and tunnels. For teams where Cloudflare is a core infrastructure piece.
Define and manage cloud infrastructure with code.
IaC best practices from an author with several high-quality DevOps skills. Guides agents toward reproducible infrastructure.
Create, debug, and manage CI/CD pipelines with GitHub.
CI/CD pipeline creation and debugging from the same trusted author. Actionable, not theoretical.
Search the web with AI-powered answers via Perplexity API.
Perplexity API access in a single skill. Cleaner than web_fetch for research queries that need synthesis across multiple sources.
Comprehensive research capabilities using Exa AI MCP tools.
Exa's semantic search surface is larger than Google for many technical queries. This skill makes all of it available.
Web search without an API key using DuckDuckGo Lite via web_fetch.
Zero-config web search. The 'no API key' requirement makes this the perfect fallback for any agent.
Model-driven arXiv retrieval workflow for building a paper set with manual language parameter.
Structured arXiv research with collection-building and language control. Better than one-shot paper lookups for literature review work.
Query 14+ biomedical databases for drug repurposing, target discovery, clinical trials, and literature research.
14 biomedical databases in one skill. Serious depth for drug researchers, clinicians, and science journalists.
An autonomous research agent for OpenClaw that searches, synthesizes, and stores findings with full source tracking.
Full autonomous research loop with source tracking. Produces verifiable research, not hallucinated summaries.
[BETA] Deep research that actually reads pages instead of summarizing search results.
The key distinction is actually reading pages vs. summarizing snippets. Results are meaningfully more accurate for nuanced topics.
Real-time web search and AI-powered answers using the official Brave Search API.
Official Brave Search API — indexed independently from Google. Different results for different perspectives.
Use the GitHub CLI (gh) to perform core GitHub operations: auth status, repo create/clone/fork, issues, pull.
Clean gh CLI wrapper with broad coverage. Every agent touching GitHub needs this as a foundation.
Advanced git operations beyond add/commit/push.
Covers the git operations agents most often mess up — rebasing, cherry-picking, stash management, and branch gymnastics.
Essential Git commands and workflows for version control.
Well-organized git reference from a consistently high-quality author. Great for newer agents or as a reliable fallback.
Format commit messages using the Conventional Commits specification.
Enforces the commit message standard that makes changelog generation, semantic versioning, and PR review so much cleaner.
Command-line interface for Deepgram speech-to-text.
Deepgram offers the best accuracy-per-dollar for speech transcription. This skill makes it usable from any agent workflow.
OpenClaw skill for ElevenLabs APIs: text-to-speech, speech-to-speech, realtime speech-to-text, voices/models.
Full ElevenLabs API coverage including realtime STT. The most capable TTS/STT skill available.
Comprehensive guide for Telegram Rich UI features (Inline buttons, formatting, media, reactions, and message threading).
Unlocks the full Telegram UX potential that most bots ignore. Inline buttons and threading dramatically improve bot usability.
Comprehensive Lark/Feishu API skill for OpenClaw agents.
Lark/Feishu is dominant in Asian tech companies and underserved by Western skill directories. Comprehensive coverage.
Real phone calls from your bot.
Actual outbound phone calls from an agent. Rare capability that opens up appointment booking and verification workflows.
Structured project/task management for OpenClaw agents — markdown-first authoring, SQLite-backed querying.
The rare combination of human-readable markdown authoring with database-backed querying. Works well for solo developers and small teams.
Generate an energy-optimized, time-blocked daily plan based on circadian rhythm research and GTD principles.
Science-backed daily planning using actual circadian research. More actionable than generic 'plan my day' prompts.
Enterprise-grade ClickUp project management integration.
ClickUp has become a serious PM tool for growing teams. Enterprise-grade coverage including time tracking and advanced views.
Curated collection of 25+ battle-tested prompts for engineering leaders — 1-on-1 prep, team health, incident review.
25 prompts refined through real engineering leadership work. Immediately usable for any eng manager or tech lead.
Create, list, cancel, and snooze reminders using OpenClaw cron jobs (one-shot or recurring).
Native OpenClaw reminder system using cron as the backend. No external service dependency.
Zero-LLM one-shot reminders (<48h) via nohup sleep + openclaw message send.
Clever zero-LLM approach for short-horizon reminders. Extremely low overhead for the most common reminder use case.
Automatically switch between fast (haiku) and powerful (sonnet) models based on task complexity.
Cost-optimized model routing based on task complexity. Trivial tasks don't need Opus; this enforces that automatically.
Benchmark token generation speed across multiple LLM API providers.
Objective latency benchmarking across providers. Cuts through marketing claims with actual measured token generation speeds.
Optimize prompts, design prompt templates, evaluate LLM outputs.
Systematic prompt optimization from an author with multiple strong skills. Applies real evaluation methodology, not guesswork.
Comprehensive tools for designing, implementing, and optimizing RAG systems.
RAG system design from architecture through optimization. Covers retrieval strategies, chunking, and evaluation methodologies.
Use trash-cli to safely delete files by moving them to the system trash instead of permanently removing them.
Safety-first file deletion. Avoids the rm -rf disasters that even experienced developers occasionally inflict on themselves.
Interact with the system clipboard (text only) using `xclip` from any OpenClaw session.
Clipboard access from a headless agent session is surprisingly useful. Paste into active applications without file intermediaries.
A cat clone with syntax highlighting, line numbers, and Git integration.
bat is a better cat in every way. Syntax highlighting and git diff integration make file inspection dramatically more readable.
Command-line fuzzy finder for interactive filtering.
fzf transforms CLI workflows. Fuzzy finding in file lists, history, and process selectors is 10x faster than grep.
Scans files, repos, and directories for leaked secrets — API keys, tokens, passwords, connection strings, private keys.
Leaked credential scanning before a commit or PR review. Catches what .gitignore and code review both miss.
A clean, reliable system resource monitor for CPU load, RAM, Swap, and Disk usage.
Clean, dependency-free system monitoring. Answers 'what's using my server's resources' without installing anything.
Diagnose and triage cron job failures.
Cron failure diagnosis is frustrating and time-consuming. This skill structures the investigation so agents find root causes faster.
Semantic Versioning 2.0.0 reference guide.
SemVer gets misapplied constantly. Having the spec as a skill prevents the 'is this a patch or a minor?' debates.
Generate images, videos, icons, audio, and more using Freepik's AI API.
Freepik's commercially-safe content library plus AI generation. Relevant for anyone building assets for business use.
Generate AI images via ImaginePro API (Midjourney, Flux, Nano Banana, Lumi Girl, video).
Midjourney-quality via API, plus alternative models. Fills the gap Midjourney's API refusers have long wished for.
Generate images, videos, audio, and more using HuggingFace Spaces and Inference Providers directly.
Direct HuggingFace Spaces access — run essentially any public model without API keys for many endpoints.
Generate beautiful, hand-drawn Mermaid diagrams with robust syntax (quoted labels, ELK layout).
Mermaid with ELK layout engine produces significantly better diagrams for complex graphs. The quoted label handling prevents common syntax errors.
Remove image backgrounds using the remove.bg API with API-key auth and transparent PNG output.
remove.bg produces consistently better results than open-source alternatives. Clean implementation with transparent PNG output.
Audit page SEO, check on-page issues, SEO score, page optimization.
Actionable on-page SEO audit from an author with a full SEO toolkit. Goes beyond meta tags to real optimization opportunities.
Find content gaps, what you're missing, topics to cover, content opportunities.
Systematic content gap analysis from a specialist author. Turns competitor research into a prioritized content roadmap.
Find keywords, keyword research, what to write about, identify ranking opportunities.
Part of an impressive SEO toolkit suite. Keyword research that goes beyond volume to intent and competition analysis.
Extract or build a distinct brand voice profile that AI agents can use to produce on-brand content every time.
Voice profiling that outputs reusable profiles rather than one-time analysis. Persistent brand consistency across all content.
Schedule, compose, and publish social media posts across X (Twitter), LinkedIn, and Instagram from OpenClaw.
True cross-platform publishing with scheduling. Eliminates the need for Hootsuite or Buffer for teams already in OpenClaw.
End-to-end lead generation and CRM pipeline automation for OpenClaw agents.
Full funnel from lead generation through CRM in one skill. Reduces the tool sprawl that kills small sales operations.
Quick conversion audit for any homepage or landing page.
CRO analysis specifically for homepages, the highest-value page on any site. Actionable recommendations, not just observations.
Extract text, search inside PDFs, and produce summaries.
Clean PDF extraction with search and summarization. Works without external API keys for basic document intelligence.
Convert PDF/images to Markdown/JSON/HTML using Mistral OCR API.
Mistral's OCR produces cleaner structured output than most alternatives. Multiple output formats including JSON make downstream processing easy.
Merge multiple user-provided PDF files by uploading them to Cross-Service-Solutions, polling until completion.
PDF merging from the same reliable provider as compress-pdf. Handles the async upload-poll-download pattern cleanly.
Convert Markdown text to DOCX, PPTX, XLSX, PDF, PNG, HTML, IPYNB, MD, CSV, JSON, JSONL, XML files.
Markdown to any format. The 11 output formats make this the single most versatile document conversion skill available.
OpenClaw agent skill for converting documents to Markdown.
Any document to Markdown using Microsoft's MarkItDown library. Clean output that agents can actually read and process.
Extract structured JSON data from invoice images or PDFs.
Invoice parsing to structured JSON is one of the highest-value document intelligence tasks. Eliminates manual data entry.
Manage Apple Notes via the `memo` CLI on macOS.
Apple Notes integration from a prolific and reliable skill author. The memo CLI is well-maintained and broadly compatible.
Manage Apple Reminders via the `remindctl` CLI on macOS.
Native Reminders integration for macOS users who live in Apple's ecosystem. Siri-visible reminders from your agent.
Homebrew package manager for macOS.
Homebrew is the foundation of macOS development environments. Every macOS agent needs this.
X/Twitter CLI for reading, searching, and posting via cookies or Sweetistics.
Twitter/X via CLI without fighting the API cost structure. Cookie-based access works when API keys are too expensive.
Full CRUD for Notion pages, databases.
Complete Notion access from a high-quality author with strong Apple ecosystem skills. Covers the full read-write surface.
Interact with Anki flashcard decks via the AnkiConnect REST API.
Anki is the gold standard for spaced repetition learning. Agent-generated flashcards from research sessions is a powerful workflow.
Monitor blogs and RSS/Atom feeds for updates using the blogwatcher.
Blog monitoring for content researchers. Automated feed watching that triggers agent workflows when new content appears.
Apple Calendar.app integration for macOS.
Native macOS Calendar integration from a reliable Apple ecosystem author. Works with all CalDAV-synced calendars.
Download videos from YouTube, Instagram, TikTok, Twitter/X, and 1000+ other sites using yt-dlp.
yt-dlp is the definitive video downloader. 1000+ sites, best quality selection, actively maintained.
Summarize YouTube videos into structured Markdown with youtube2md, including chaptered notes, timestamp links.
Structured YouTube summaries with timestamps and chapter links — much more useful than flat transcripts.
Control Music Assistant (Home Assistant music server) - playback, volume, queue management, and library search.
Music Assistant is the leading open-source whole-home music solution. This skill completes the smart home music experience.
Script-free Govee OpenAPI setup and control guide.
Govee is one of the most popular smart light brands. Script-free control removes a significant setup barrier.
Transcribe audio/video with AssemblyAI.
AssemblyAI has best-in-class accuracy for technical and domain-specific vocabulary. Important for developer content transcription.
RAM-safe voice transcription with auto-chunking — works on 16GB machines without crashes.
The RAM-safe framing solves the real problem: Whisper crashes on long audio on normal developer machines. Auto-chunking handles it.
Access and manage Bitwarden/Vaultwarden passwords securely.
Bitwarden is the leading open-source password manager. Agent access enables automated credential retrieval for workflows.
Audit and harden OpenClaw configuration for security.
OpenClaw-specific security hardening from a reliable author. Security hygiene for the platform itself, not just hosted code.
Send push notifications via Gotify when long-running tasks complete.
Self-hosted push notifications without cloud dependency. Perfect for homelab users who want agent alerts without Pushover fees.
Ship packages with AI — compare rates across USPS, FedEx, and UPS, buy discounted labels, track shipments.
Multi-carrier shipping comparison with discounted label purchasing. Genuinely saves money on every shipment.
Interview prep, mock interview, practice questions, behavioral questions, technical interview.
Comprehensive interview coaching covering both behavioral and technical. Structured practice sessions that adapt to feedback.
A skill to lookup video game information, prices, compatibility, and duration.
Cross-platform game lookup covering prices and compatibility. The 'duration' feature (how long to beat) is the standout differentiator.
Build high-performing OpenClaw agents end-to-end.
Meta-skill for building better agents. From a high-quality author with multiple well-regarded skills.
Proof collaborative editor — human+AI document editing with comments, suggestions, and provenance tracked in a shared doc.
Dan Shipper's collaborative editor built for the AI age. Tracks document provenance and combines human and AI edits in one surface. Featured must-include from the product owner.
OpenClaw skills are plug-in capabilities for AI agents built on the OpenClaw platform. Each skill extends your agent with a specific ability — from running Claude Code in tmux sessions to managing Linear issues or scraping the web. Install them with `npx skills add <name>`.
Run `npx skills add <skill-name>` in your terminal. Each skill card in this directory shows the exact install command. Click the command to copy it to your clipboard.
Our editors have highlighted 19 featured skills with the star indicator. Top picks include claude-code-orchestrator for AI-assisted coding, giga-coding-agent for multi-backend coding workflows, and browser-use for web automation.
Most OpenClaw skills are open-source and free to use. Each skill links to its source on clawskills.sh where you can find licensing information and contribution details.
The OpenClaw Skills Directory is curated and updated regularly by the Tech Twitter team. We review new skills and add editorial notes to help you quickly evaluate which skills belong in your agent workflow.