picoclaw-self-pen-testingPicoclaw-only local posture-review skill focused on read-only findings and safe operator remediation guidance.
Install via ClawdBot CLI:
clawdbot install davida-ps/picoclaw-self-pen-testingGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Calls external URL not in known-safe list
https://clawsec.prompt.securityAudited Apr 27, 2026 · audit v1.0
Generated Oct 2, 2026
A platform team prepares to expose a Picoclaw-based internal assistant to employees. Before launch, they run the self-pen-testing skill against the current posture profile to confirm the Web UI is not publicly exposed and authentication is enabled. Findings feed into a go/no-go checklist signed off by the security lead.
A fintech company running Picoclaw agents under strict compliance requirements schedules the skill to run after every configuration change. The read-only report highlights unsigned verification mode, plaintext secret markers, and scheduler persistence issues. Evidence from each run is archived to support audit requests.
A small MSSP offers monthly posture reviews to clients running Picoclaw locally. Technicians run the skill with each client's profile, translate the findings into prioritized remediation guidance, and deliver a plain-language report. This creates recurring revenue without requiring a full SIEM deployment.
A consulting red team uses the skill as a first-pass, benign enumeration step before deeper manual testing of a Picoclaw target. It quickly surfaces MCP trust-boundary gaps and multi-channel auth weaknesses. The output is used to scope the offensive testing phase and reduce time spent on low-value checks.
Maintainers of a community Picoclaw setup run the skill locally before publishing configuration templates or sharing their profiles publicly. It catches exposure and secret-handling issues that are easy to overlook. The signed artifact verification step also builds trust in the skill package itself before installation.
Security vendors bundle the skill into a recurring subscription that automatically scans clients' Picoclaw profiles on a schedule and delivers prioritized findings. Value comes from continuous coverage and audit-ready reports rather than one-off assessments.
Consultancies use the skill as a fast diagnostic within paid engagements helping regulated firms document and harden their AI agent deployments. The read-only reports reduce assessment time while producing structured evidence for auditors.
A vendor packages the skill alongside branded remediation playbooks and dashboards for enterprises that prefer self-managed tooling. Customers deploy it internally and receive updates, signed releases, and support.
💬 Integration Tip
Run the signed-release verification script before installation, then invoke the skill with your current Picoclaw posture profile path and treat all output as read-only findings to guide remediation.
Scored Oct 2, 2026
Control desktop applications on Windows — launch, close, focus, resize, move windows, simulate keyboard/mouse input, manage processes, control VSCode, read clipboard, and capture screen info. Use when the user wants to interact with any running program, switch windows, type text, press shortcuts, open files in VSCode, manage running processes, or get system display information.
Conduct rigorous, adversarial code reviews with zero tolerance for mediocrity. Use when users ask to "critically review" my code or a PR, "critique my code", "find issues in my code", or "what's wrong with this code". Identifies security holes, lazy patterns, edge case failures, and bad practices across Python, R, JavaScript/TypeScript, SQL, and front-end code. Scrutinizes error handling, type safety, performance, accessibility, and code quality. Provides structured feedback with severity tiers (Blocking, Required, Suggestions) and specific, actionable recommendations.
Pragmatic coding standards for writing clean, maintainable code — naming, functions, structure, anti-patterns, and pre-edit safety checks. Use when writing new code, refactoring existing code, reviewing code quality, or establishing coding standards.
Claude Code integration for OpenClaw. This skill provides interfaces to: - Query Claude Code documentation from https://code.claude.com/docs - Manage subagents and coding tasks - Execute AI-assisted coding workflows - Access best practices and common workflows Use this skill when users want to: - Get help with coding tasks - Query Claude Code documentation - Manage AI-assisted development workflows - Execute complex programming tasks
Plan, draft, version, and refine written content with enforced versioning and quality audits.
Use when writing tests, creating test strategies, or building automation frameworks. Invoke for unit tests, integration tests, E2E, coverage analysis, performance testing, security testing.