Loading...
Loading...
Found 95 Skills
Guides secure software delivery and DevSecOps for cleared/classified or high-side programs—disconnected or air-gapped CI/CD, artifact promotion across classification boundaries (conceptual), SBOM/signing/ provenance, SAST/DAST/secrets/IaC/container gates, supply-chain controls, STIG/CIS deploy baselines, IaC for classified landing zones, cleared developer workstations, build/deploy audit logging, and ATO/RMF pipeline evidence (not SSP ownership). Use for classified DevSecOps, cleared pipeline, high-side CI/CD, air-gapped build, cross-domain release, classified software delivery, STIG pipeline, ATO evidence CI, SBOM classified, secure software factory—not portfolio cyber governance (classified-cyber-security-senior-manager), ISSO/SSP (information-systems-security-officer-classified-specialist), commercial-only DevSecOps (devsecops), general DevOps (devops), build-only validation (build-validator), pentest (penetration-tester), or enterprise GRC-only (compliance-specialist).
Use this skill to run a multi-persona expert advisory review on a labelled pull request in microsoft/apm. The panel fans out to five mandatory specialists plus a test-coverage specialist (active on every PR that touches src/) plus two conditional specialists (auth, doc-writer), all running in their own agent threads, and a CEO synthesizer. The orchestrator is the sole writer to the PR: ONE recommendation comment, no verdict labels, no merge gating. The panel is advisory -- it surfaces findings, prioritizes follow-ups, and renders a ship-recommendation that the maintainer and author weigh. Activate when a non-trivial PR needs a cross-cutting recommendation (architecture, CLI logging, DevX UX, supply-chain security, growth/positioning, optionally auth, docs, and test coverage, with CEO arbitration).
Recent drug enforcement actions and recalls for a product or firm, with classification and reason. Called as GET /v1/fda/drug-recall, it takes query, limit and returns count, recalls. Distinct from the neighbouring services in this domain by: drug, recent, actions, recalls, classification. A supply-chain or pharmacy agent must check whether a lot has been recalled before acting on it, and recalls are recent events no model has seen. Reading this schema and dry-running the call are free and need no wallet; a real call costs $0.004, paid in USDC on Base over x402.
Comprehensive security auditor for OpenClaw skills. Checks for typosquatting, dangerous permissions, prompt injection, supply chain risks, and data exfiltration patterns — before you install anything.
Identify make-buy-partner relationships for key activities. Use for strategic alliances, outsourcing decisions, and supply chain optimization.
Expert guidance on securing npm packages, preventing supply chain attacks, and hardening package manager configurations
Analyze supply chain operations using the SCOR model across Plan, Source, Make, Deliver, and Return processes. Use this skill when the user needs to optimize supply chain efficiency, evaluate supplier performance, improve logistics, or design an end-to-end supply chain strategy — even if they say 'our deliveries are slow', 'supply chain costs are too high', or 'we keep running out of stock'.
Analyze and mitigate the bullwhip effect where demand variability amplifies upstream in supply chains. Use this skill when the user needs to diagnose order variability amplification, quantify the bullwhip ratio, or implement dampening strategies — even if they say 'why are our orders so volatile', 'supply chain variability', or 'demand amplification problem'.
When the user wants to forecast using deep learning, LSTMs, transformers, or neural networks. Also use when the user mentions "neural network forecasting," "LSTM," "GRU," "transformer forecasting," "attention mechanisms," "seq2seq," "temporal convolution," "deep learning time series," or complex non-linear patterns. For traditional forecasting, see demand-forecasting. For general ML, see ml-supply-chain.
Reduces JavaScript dependency footprint with pnpm while preserving lockfile, workspace layout, and dependency range style. Runs /check-npm first, then removes unused deps, dedupes versions, ranks transitive closure, and reports Keep/Replace/Remove triage. Use when cleaning up pnpm dependencies, reducing lockfile size, or shrinking node_modules in Grafana plugins; not for Go modules or full GitHub Actions workflow audits.
Secure dependency upgrades with supply chain protection, cooldowns, and staged rollout. Use when upgrading deps, configuring security policies, or preventing supply chain attacks.
Audit project dependencies for risk when the user asks to check dependencies, audit packages, review dependency health, check for vulnerabilities, or assess supply chain risk