openclaw-trust
SolidApply OpenClaw’s official threat model and trust guidance (MITRE ATLAS–mapped) when evaluating risky workflows, skills, channel exposure, prompt injection, and tool execution safety.
Install
Quality Score: 82/100
Skill Content
Details
- Author
- OpenCoven
- Repository
- OpenCoven/coven
- Created
- 3 months ago
- Last Updated
- today
- Language
- Rust
- License
- MIT
Integrates with
Similar Skills
Semantically similar based on skill content — not just same category
threat-model
Run a structured threat-modeling pass at the design stage — before code — to find security risks in an architecture or feature. Uses STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) to systematically ask "how could this be attacked?". Use this skill whenever the user is designing a system, planning a new feature, drawing an architecture, defining APIs, or asks "what could go wrong security-wise?" — especially before implementation begins. Defensive only: it identifies risks and mitigations, it does not plan attacks.
trust-issues
Adversarial, attacker-minded security review of ANY untrusted code before you trust it — a GitHub repo, a Claude/agent skill, an MCP server, a plugin, an npm or pip package, or a snippet you are about to base your own skill on. ALWAYS run this BEFORE installing a skill or plugin, BEFORE connecting an MCP server, BEFORE running or importing third-party code, and BEFORE copying external code into a skill you are authoring. Trigger whenever the user says "is this repo safe", "check this skill/plugin/MCP for malware", "review before I install", "audit this code", "can I trust this", or asks you to clone, install, or build on someone else's repo. Assume the code is hostile until the review says otherwise.
threat-modeling
Review a design or architecture for security flaws — trust boundaries, authorization, data flow, and attack surface — before code is written — Applies to: when scaffolding a new feature, service, or endpoint; when writing or reviewing a design doc / RFC / ADR; when introducing a new trust boundary, integration, or data flow; when reviewing an architecture or module at the design level