New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Senior Security

by LeoYeAI in LeoYeAI/openclaw-master-skills

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing.

MITAuto-check passedSecurity

Install Senior Security

skills CLI
$ npx skills add LeoYeAI/openclaw-master-skills --skill senior-security -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install LeoYeAI/openclaw-master-skills senior-security --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/LeoYeAI/openclaw-master-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/senior-security .claude/skills/senior-security && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
senior-security
GitHub stars
2.2k
Token cost
~3.8k tokens
SKILL.md length
1,266 words
Files
7 (incl. scripts, references)
Skills in repo
1,235
Repo updated
First seen
Licence
MIT

At a glance

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing.

  • Works in 8 steps: Define system scope and boundaries → Create data flow diagram → Apply STRIDE to each DFD element (see… → …
  • The user asks about security reviews
  • SKILL.md covers Table of Contents, Threat Modeling Workflow, Security Architecture Workflow and Vulnerability Assessment…, plus 5 more sections
  • Runs Python scripts from its folder

What it does

Senior Security is an agent skill from LeoYeAI/openclaw-master-skills. Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.

Its SKILL.md is about 3.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 8 other files, including scripts and reference files (for example `_meta.json`, `references/cryptography-implementation.md` and `references/security-architecture-patterns.md`).

It sits in Security, covering Threat modeling, Vulnerability scanning and Security review. The repository describes itself as: 🧠 Curated collection of 1209+ best OpenClaw skills — weekly updated by MyClaw.ai. The licence is MIT.

When your agent uses it

  • The user asks about security reviews
  • Threat analysis
  • Vulnerability assessments
  • Secure coding practices

Example prompts

  • “/senior-security”

Requirements

  • Python 3

Workflow steps

8 steps, taken from the first numbered list in SKILL.md.

  1. Define system scope and boundaries
  2. Create data flow diagram
  3. Apply STRIDE to each DFD element (see STRIDE per Element Matrix below)
  4. Score risks using DREAD
  5. Prioritize threats by risk score
  6. Define mitigations for each threat
  7. Document in threat model report
  8. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped

What it can do on your machine

Read from SKILL.md and the folder at commit e5199b5. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Ships 2 files in scripts/ (Python), which the agent can run.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Links to these hosts (documentation or services it may open):

    • owasp.org

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Senior Security loads about 3.8k tokens when it runs, and up to ~21k if it reads all its reference files. Until then it costs about 108 tokens; SKILL.md has 1,266 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~108
When it runs · the whole SKILL.md, loaded when a task matches
~3.8k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~21k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from LeoYeAI/openclaw-master-skills at commit e5199b5, republished under its MIT licence (© LeoYeAI). 1,266 words, ~3,845 tokens.

Download SKILL.mdSave it as .claude/skills/senior-security/SKILL.md (or your agent's skills folder). This skill also uses 6 other files; get the full folder from GitHub.
name
senior-security
description
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security best practices.
triggers
security architecture, threat modeling, STRIDE analysis, penetration testing, vulnerability assessment, secure coding, OWASP, application security…

Senior Security Engineer

Security engineering tools for threat modeling, vulnerability analysis, secure architecture design, and penetration testing.

Table of Contents

Threat Modeling Workflow

Identify and analyze security threats using STRIDE methodology.

Workflow: Conduct Threat Model
  1. Define system scope and boundaries:
    • Identify assets to protect
    • Map trust boundaries
    • Document data flows
  2. Create data flow diagram:
    • External entities (users, services)
    • Processes (application components)
    • Data stores (databases, caches)
    • Data flows (APIs, network connections)
  3. Apply STRIDE to each DFD element (see STRIDE per Element Matrix below)
  4. Score risks using DREAD:
    • Damage potential (1-10)
    • Reproducibility (1-10)
    • Exploitability (1-10)
    • Affected users (1-10)
    • Discoverability (1-10)
  5. Prioritize threats by risk score
  6. Define mitigations for each threat
  7. Document in threat model report
  8. Validation: All DFD elements analyzed; STRIDE applied; threats scored; mitigations mapped
STRIDE Threat Categories
CategorySecurity PropertyMitigation Focus
SpoofingAuthenticationMFA, certificates, strong auth
TamperingIntegritySigning, checksums, validation
RepudiationNon-repudiationAudit logs, digital signatures
Information DisclosureConfidentialityEncryption, access controls
Denial of ServiceAvailabilityRate limiting, redundancy
Elevation of PrivilegeAuthorizationRBAC, least privilege
STRIDE per Element Matrix
DFD ElementSTRIDE
External EntityXX
ProcessXXXXXX
Data StoreXXXX
Data FlowXXX

See: references/threat-modeling-guide.md

Security Architecture Workflow

Design secure systems using defense-in-depth principles.

Workflow: Design Secure Architecture
  1. Define security requirements:
    • Compliance requirements (GDPR, HIPAA, PCI-DSS)
    • Data classification (public, internal, confidential, restricted)
    • Threat model inputs
  2. Apply defense-in-depth layers:
    • Perimeter: WAF, DDoS protection, rate limiting
    • Network: Segmentation, IDS/IPS, mTLS
    • Host: Patching, EDR, hardening
    • Application: Input validation, authentication, secure coding
    • Data: Encryption at rest and in transit
  3. Implement Zero Trust principles:
    • Verify explicitly (every request)
    • Least privilege access (JIT/JEA)
    • Assume breach (segment, monitor)
  4. Configure authentication and authorization:
    • Identity provider selection
    • MFA requirements
    • RBAC/ABAC model
  5. Design encryption strategy:
    • Key management approach
    • Algorithm selection
    • Certificate lifecycle
  6. Plan security monitoring:
    • Log aggregation
    • SIEM integration
    • Alerting rules
  7. Document architecture decisions
  8. Validation: Defense-in-depth layers defined; Zero Trust applied; encryption strategy documented; monitoring planned
Defense-in-Depth Layers
Layer 1: PERIMETER
  WAF, DDoS mitigation, DNS filtering, rate limiting

Layer 2: NETWORK
  Segmentation, IDS/IPS, network monitoring, VPN, mTLS

Layer 3: HOST
  Endpoint protection, OS hardening, patching, logging

Layer 4: APPLICATION
  Input validation, authentication, secure coding, SAST

Layer 5: DATA
  Encryption at rest/transit, access controls, DLP, backup
Authentication Pattern Selection
Use CaseRecommended Pattern
Web applicationOAuth 2.0 + PKCE with OIDC
API authenticationJWT with short expiration + refresh tokens
Service-to-servicemTLS with certificate rotation
CLI/AutomationAPI keys with IP allowlisting
High securityFIDO2/WebAuthn hardware keys

See: references/security-architecture-patterns.md

Vulnerability Assessment Workflow

Identify and remediate security vulnerabilities in applications.

Workflow: Conduct Vulnerability Assessment
  1. Define assessment scope:
    • In-scope systems and applications
    • Testing methodology (black box, gray box, white box)
    • Rules of engagement
  2. Gather information:
    • Technology stack inventory
    • Architecture documentation
    • Previous vulnerability reports
  3. Perform automated scanning:
    • SAST (static analysis)
    • DAST (dynamic analysis)
    • Dependency scanning
    • Secret detection
  4. Conduct manual testing:
    • Business logic flaws
    • Authentication bypass
    • Authorization issues
    • Injection vulnerabilities
  5. Classify findings by severity:
    • Critical: Immediate exploitation risk
    • High: Significant impact, easier to exploit
    • Medium: Moderate impact or difficulty
    • Low: Minor impact
  6. Develop remediation plan:
    • Prioritize by risk
    • Assign owners
    • Set deadlines
  7. Verify fixes and document
  8. Validation: Scope defined; automated and manual testing complete; findings classified; remediation tracked

For OWASP Top 10 vulnerability descriptions and testing guidance, refer to owasp.org/Top10.

Vulnerability Severity Matrix
Impact \ ExploitabilityEasyModerateDifficult
CriticalCriticalCriticalHigh
HighCriticalHighMedium
MediumHighMediumLow
LowMediumLowLow

Secure Code Review Workflow

Review code for security vulnerabilities before deployment.

Workflow: Conduct Security Code Review
  1. Establish review scope:
    • Changed files and functions
    • Security-sensitive areas (auth, crypto, input handling)
    • Third-party integrations
  2. Run automated analysis:
    • SAST tools (Semgrep, CodeQL, Bandit)
    • Secret scanning
    • Dependency vulnerability check
  3. Review authentication code:
    • Password handling (hashing, storage)
    • Session management
    • Token validation
  4. Review authorization code:
    • Access control checks
    • RBAC implementation
    • Privilege boundaries
  5. Review data handling:
    • Input validation
    • Output encoding
    • SQL query construction
    • File path handling
  6. Review cryptographic code:
    • Algorithm selection
    • Key management
    • Random number generation
  7. Document findings with severity
  8. Validation: Automated scans passed; auth/authz reviewed; data handling checked; crypto verified; findings documented
Security Code Review Checklist
CategoryCheckRisk
Input ValidationAll user input validated and sanitizedInjection
Output EncodingContext-appropriate encoding appliedXSS
AuthenticationPasswords hashed with Argon2/bcryptCredential theft
SessionSecure cookie flags set (HttpOnly, Secure, SameSite)Session hijacking
AuthorizationServer-side permission checks on all endpointsPrivilege escalation
SQLParameterized queries used exclusivelySQL injection
File AccessPath traversal sequences rejectedPath traversal
SecretsNo hardcoded credentials or keysInformation disclosure
DependenciesKnown vulnerable packages updatedSupply chain
LoggingSensitive data not loggedInformation disclosure
Show full SKILL.md (503 more words)Show less
Secure vs Insecure Patterns
PatternIssueSecure Alternative
SQL string formattingSQL injectionUse parameterized queries with placeholders
Shell command buildingCommand injectionUse subprocess with argument lists, no shell
Path concatenationPath traversalValidate and canonicalize paths
MD5/SHA1 for passwordsWeak hashingUse Argon2id or bcrypt
Math.random for tokensPredictable valuesUse crypto.getRandomValues
Inline Code Examples

SQL Injection — insecure vs. secure (Python):

python
# ❌ Insecure: string formatting allows SQL injection
query = f"SELECT * FROM users WHERE username = '{username}'"
cursor.execute(query)

# ✅ Secure: parameterized query — user input never interpreted as SQL
query = "SELECT * FROM users WHERE username = %s"
cursor.execute(query, (username,))

Password Hashing with Argon2id (Python):

python
from argon2 import PasswordHasher

ph = PasswordHasher()          # uses secure defaults (time_cost, memory_cost)

# On registration
hashed = ph.hash(plain_password)

# On login — raises argon2.exceptions.VerifyMismatchError on failure
ph.verify(hashed, plain_password)

Secret Scanning — core pattern matching (Python):

python
import re, pathlib

SECRET_PATTERNS = {
    "aws_access_key":  re.compile(r"AKIA[0-9A-Z]{16}"),
    "github_token":    re.compile(r"ghp_[A-Za-z0-9]{36}"),
    "private_key":     re.compile(r"-----BEGIN (RSA |EC )?PRIVATE KEY-----"),
    "generic_secret":  re.compile(r'(?i)(password|secret|api_key)\s*=\s*["\']?\S{8,}'),
}

def scan_file(path: pathlib.Path) -> list[dict]:
    findings = []
    for lineno, line in enumerate(path.read_text(errors="replace").splitlines(), 1):
        for name, pattern in SECRET_PATTERNS.items():
            if pattern.search(line):
                findings.append({"file": str(path), "line": lineno, "type": name})
    return findings

Incident Response Workflow

Respond to and contain security incidents.

Workflow: Handle Security Incident
  1. Identify and triage:
    • Validate incident is genuine
    • Assess initial scope and severity
    • Activate incident response team
  2. Contain the threat:
    • Isolate affected systems
    • Block malicious IPs/accounts
    • Disable compromised credentials
  3. Eradicate root cause:
    • Remove malware/backdoors
    • Patch vulnerabilities
    • Update configurations
  4. Recover operations:
    • Restore from clean backups
    • Verify system integrity
    • Monitor for recurrence
  5. Conduct post-mortem:
    • Timeline reconstruction
    • Root cause analysis
    • Lessons learned
  6. Implement improvements:
    • Update detection rules
    • Enhance controls
    • Update runbooks
  7. Document and report
  8. Validation: Threat contained; root cause eliminated; systems recovered; post-mortem complete; improvements implemented
Incident Severity Levels
LevelResponse TimeEscalation
P1 - Critical (active breach/exfiltration)ImmediateCISO, Legal, Executive
P2 - High (confirmed, contained)1 hourSecurity Lead, IT Director
P3 - Medium (potential, under investigation)4 hoursSecurity Team
P4 - Low (suspicious, low impact)24 hoursOn-call engineer
Incident Response Checklist
PhaseActions
IdentificationValidate alert, assess scope, determine severity
ContainmentIsolate systems, preserve evidence, block access
EradicationRemove threat, patch vulnerabilities, reset credentials
RecoveryRestore services, verify integrity, increase monitoring
Lessons LearnedDocument timeline, identify gaps, update procedures

Security Tools Reference

CategoryTools
SASTSemgrep, CodeQL, Bandit (Python), ESLint security plugins
DASTOWASP ZAP, Burp Suite, Nikto
Dependency ScanningSnyk, Dependabot, npm audit, pip-audit
Secret DetectionGitLeaks, TruffleHog, detect-secrets
Container SecurityTrivy, Clair, Anchore
InfrastructureCheckov, tfsec, ScoutSuite
NetworkWireshark, Nmap, Masscan
PenetrationMetasploit, sqlmap, Burp Suite Pro
Cryptographic Algorithm Selection
Use CaseAlgorithmKey Size
Symmetric encryptionAES-256-GCM256 bits
Password hashingArgon2idN/A (use defaults)
Message authenticationHMAC-SHA256256 bits
Digital signaturesEd25519256 bits
Key exchangeX25519256 bits
TLSTLS 1.3N/A

See: references/cryptography-implementation.md

Tools and References

Scripts
ScriptPurpose
threat_modeler.pySTRIDE threat analysis with DREAD risk scoring; JSON and text output; interactive guided mode
secret_scanner.pyDetect hardcoded secrets and credentials across 20+ patterns; CI/CD integration ready

For usage, see the inline code examples in Secure Code Review Workflow and the script source files directly.

References
DocumentContent
security-architecture-patterns.mdZero Trust, defense-in-depth, authentication patterns, API security
threat-modeling-guide.mdSTRIDE methodology, attack trees, DREAD scoring, DFD creation
cryptography-implementation.mdAES-GCM, RSA, Ed25519, password hashing, key management

Security Standards Reference

Security Headers Checklist
HeaderRecommended Value
Content-Security-Policydefault-src self; script-src self
X-Frame-OptionsDENY
X-Content-Type-Optionsnosniff
Strict-Transport-Securitymax-age=31536000; includeSubDomains
Referrer-Policystrict-origin-when-cross-origin
Permissions-Policygeolocation=(), microphone=(), camera=()

For compliance framework requirements (OWASP ASVS, CIS Benchmarks, NIST CSF, PCI-DSS, HIPAA, SOC 2), refer to the respective official documentation.

SkillIntegration Point
senior-devopsCI/CD security, infrastructure hardening
senior-secopsSecurity monitoring, incident response
senior-backendSecure API development
senior-architectSecurity architecture decisions

© LeoYeAI, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (scripts, references) in skills/senior-security of LeoYeAI/openclaw-master-skills.

  • SKILL.md
  • _meta.json
  • references/cryptography-implementation.md
  • references/security-architecture-patterns.md
  • references/threat-modeling-guide.md
  • scripts/secret_scanner.py
  • scripts/threat_modeler.py

Open the folder on GitHubat commit e5199b5

Compare with similar skills

Senior Security next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Senior Security compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Senior Security this skillLeoYeAI/openclaw-master-skills2.2k—~3.8kAutomated safety check: PassMIT
Security Audit Scannerruvnet/ruflo74k2 repos~823Automated safety check: PassMIT
CSO Security Auditgarrytan/gstack136k—~4.5kAutomated safety check: PassMIT
Security Auditoraiskillstore/marketplace4306 repos~2.6kAutomated safety check: PassNone
Deepsec Documentation Guidevercel-labs/deepsec8.1k—~956Automated safety check: PassApache-2.0
Native Dependency Updatemono/SkiaSharp5.6k—~4.1kAutomated safety check: PassMIT

Similar skills

  • Security Audit Scanner

    ruvnet/ruflo

    Runs claude-flow CLI security scans for input validation, path traversal, SQL injection, XSS, hardcoded secrets and known CVEs, and writes an audit report.

    74k GitHub starsUsed in 2 repos~823 tokens
    SecurityAuto-check passed

  • CSO Security Audit

    garrytan/gstack

    Runs an evidence-first security audit of a codebase through gstack's trusted launcher, with static findings by default and isolated reproduction when enabled.

    136k GitHub stars~4.5k tokensUpdated today
    SecurityAuto-check passed

  • Security Auditor

    aiskillstore/marketplace

    Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks.

    430 GitHub starsUsed in 6 repos~2.6k tokens
    SecurityAuto-check passed

  • Deepsec Documentation Guide

    vercel-labs/deepsec

    Official

    Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.

    8.1k GitHub stars~956 tokensUpdated 10 days ago
    SecurityAuto-check passed

  • Native Dependency Update

    mono/SkiaSharp

    Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.

    5.6k GitHub stars~4.1k tokensUpdated today
    SecurityAuto-check passed

  • Forensify

    alexgreensh/repo-forensics

    Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.

    188 GitHub stars~2.5k tokensUpdated 12 days ago
    SecurityAuto-check: notes

More from LeoYeAI/openclaw-master-skills

All 1,235 skills in this repo

  • DevOps Pipeline Management

    LeoYeAI/openclaw-master-skills

    Manages pipelines on a DevOps quality and efficiency platform through its OpenAPI: list workspaces and templates, create, update, run and cancel pipelines, and read run records.

    2.2k GitHub stars~4.2k tokensUpdated 2 mo ago
    Auto-check: notes

  • Feishu Document Collaboration

    LeoYeAI/openclaw-master-skills

    Patches OpenClaw's Feishu extension so an edited document triggers an isolated agent session that reads the doc and replies inline, turning it into a live chat space.

    2.2k GitHub stars~2k tokensUpdated 2 mo ago
    Auto-check passed

  • Files Memory System

    LeoYeAI/openclaw-master-skills

    Multi-context memory management system for OpenClaw agents with group-isolated storage, global shared memory, workspace organization, and group-specific skills isolation.

    2.2k GitHub stars~3.8k tokensUpdated 2 mo ago
    Auto-check passed

  • GEO-Claw AI Visibility Agent

    LeoYeAI/openclaw-master-skills

    Runs a brand's AI-search visibility work end to end: diagnosing how AI platforms represent it, repositioning it, producing AI-optimized content and monitoring ongoing mentions.

    2.2k GitHub stars~4.7k tokensUpdated 2 mo ago
    Auto-check passed

  • Google Workspace CLI

    LeoYeAI/openclaw-master-skills

    Installs and authenticates the gws CLI, then automates Gmail, Drive, Sheets, Calendar, Docs, Chat and Tasks with ready-made recipes, persona bundles and security audits.

    2.2k GitHub stars~2.6k tokensUpdated 2 mo ago
    Auto-check: notes

  • HealthFit Health Advisors

    LeoYeAI/openclaw-master-skills

    Runs four advisor roles, a fitness coach, nutritionist, data analyst and TCM practitioner, to build a health profile and track workouts, diet and wellness over time.

    2.2k GitHub stars~4.4k tokensUpdated 2 mo ago
    Auto-check passed

Categories

Questions about Senior Security

What does Senior Security do?

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Senior Security is an agent skill from LeoYeAI/openclaw-master-skills. Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing.

When should I use Senior Security?

Senior Security fits situations like: the user asks about security reviews; threat analysis; vulnerability assessments; secure coding practices.

How do I install Senior Security in Claude Code?

Run `npx skills add LeoYeAI/openclaw-master-skills --skill senior-security -a claude-code`. Or copy the skill folder (skills/senior-security in LeoYeAI/openclaw-master-skills) into .claude/skills/senior-security in your project. Claude Code loads it when a task matches its description.

How do I install Senior Security in Codex?

Run `npx skills add LeoYeAI/openclaw-master-skills --skill senior-security -a codex`. Or copy the skill folder (skills/senior-security in LeoYeAI/openclaw-master-skills) into .agents/skills/senior-security in your project. Codex loads it when a task matches its description.

Can I use Senior Security in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add LeoYeAI/openclaw-master-skills --skill senior-security -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/senior-security, .gemini/skills/senior-security, .github/skills/senior-security and .opencode/skills/senior-security in your project.

What does Senior Security need to run?

Going by SKILL.md and its folder, Senior Security needs Python for the scripts in its folder. Our summary lists: Python 3.

Does Senior Security access the network?

SKILL.md names 1 domain. As links in the text: owasp.org. This is read from the text; nothing was executed.

Is Senior Security safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.

What licence does Senior Security use?

Senior Security is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Senior Security use?

About 3.8k tokens (SKILL.md is roughly 15k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 17k tokens, read only when the agent opens those files.

What are the alternatives to Senior Security?

Skills that share tags, products or a category with Senior Security: Security Audit Scanner (ruvnet/ruflo, 74k stars), CSO Security Audit (garrytan/gstack, 136k stars), Security Auditor (aiskillstore/marketplace, 430 stars) and Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Senior Security?

LeoYeAI (a GitHub user) maintains it in LeoYeAI/openclaw-master-skills, which has 2,160 GitHub stars. The repository holds 1,235 skills in this directory. The repository was last updated on July 20, 2026.

Source: LeoYeAI/openclaw-master-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.