Use this skill when reviewing or merging any community PR in unifi-mcp — even if the user just says "take a look at this PR" or "can we merge this." Covers the complete quality gate checklist (f-string logger ban, validator registry registration, doc site update ordering), the fork-edit model for trusted contributors, and PR body standards. Apply this skill before approving any externally-authored PR, before running the merge command, and when auditing recently merged PRs for compliance.
Audit your OpenClaw setup for token waste, context bloat, and cost optimization opportunities
Audit web pages for accessibility issues, WCAG compliance, and screen reader compatibility.
Generate SITF-compliant attack flow JSON files from attack descriptions or incident reports. Use when analyzing supply chain attacks, breaches, or security incidents.
Configure CCA (Continuous Clearing Auction) smart contract parameters through an interactive bulk form flow. Use when user says "configure auction", "cca auction", "setup token auction", "auction configuration", "continuous auction", or mentions CCA contracts.
- 📁 _shared/
- 📁 references/
- 📄 SKILL.md
Use this skill when the user mentions wallet login, sign in, verify OTP, add wallet, switch account, wallet status, logout, wallet balance, assets, holdings, send tokens, transfer ETH, transfer USDC, pay someone, send crypto, send ERC-20, send SPL, transaction history, recent transactions, tx status, tx detail, order list, call smart contract, interact with contract, execute contract function, send calldata, invoke smart contract, show my addresses, wallet addresses, deposit, receive, receive address, top up, fund my wallet, sign message, personal sign, personalSign, eip712, sign data, sign typed data, sign EIP-712, TEE signing, trusted execution environment. Chinese: 登录钱包, 钱包登录, 验证OTP, 添加钱包, 切换账户, 钱包状态, 退出登录, 余额, 资产, 钱包列表, 账户列表, 发送代币, 转账, 交易历史, 交易记录, 合约调用, 我的地址, 钱包地址, 充值, 充币, 收款, 收款地址, 入金, 签名消息, 消息签名, TEE签名, 可信执行环境. Manages the wallet lifecycle: auth (login, OTP verify, account addition, switching, status, logout), authenticated balance queries, wallet address display (grouped by XLayer/EVM/Solana), token transfers (native & ERC-20/SPL), transaction history, smart contract calls, message signing (personalSign for EVM & Solana, EIP-712 for EVM)
General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.
- 📁 docs/
- 📁 scripts/
- 📄 .gitignore
- 📄 CHANGELOG.md
- 📄 COMPATIBILITY.md
Interact with Bitget Wallet API for crypto market data, token info, swap quotes, RWA (real-world asset) stock trading, and security audits. Use when the user asks about wallet, token prices, market data, swap/trading quotes, RWA stock discovery and trading, token security checks, K-line charts, or token rankings on supported chains (ETH, SOL, BSC, Base, etc.).
- 📁 fixtures/
- 📁 references/
- 📁 scripts/
- 📄 .env.example
- 📄 .gitignore
- 📄 CHANGELOG.md
Write SEO pages that rank on Google AND get cited by LLMs. Uses live SERP data, 500-token chunk architecture, and the Reddit Test quality gate.
- 📁 fixtures/
- 📁 references/
- 📁 scripts/
- 📄 .env.example
- 📄 .gitignore
- 📄 CHANGELOG.md
Write SEO pages that rank on Google AND get cited by LLMs. Uses live SERP data, 500-token chunk architecture, and the Reddit Test quality gate.
Expert guidance for FedRAMP certification and compliance. Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core
Audit third-party AI API relay/proxy services for security risks. Detects hidden prompt injection, prompt leakage, instruction override, identity hijacking (Chinese-market substitutes), jailbreak vulnerabilities, context truncation, tool-call package substitution (AC-1.a), error response header leakage (AC-2 adjacent), and SSE-level stream integrity anomalies (AC-1 streaming). Use when: "test relay", "audit API", "audit relay", "detect injection", "relay security", "API relay audit", "is this relay safe", "does it inject prompts", "test proxy API", "check API key", "中转站安全", "测试中转站", "中转站审计".