JoySafeter

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

Use when you have a written implementation plan to execute in a separate session with review checkpoints

OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.

AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.

Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.

Business logic vulnerability testing — workflow bypass, payment manipulation, state machine abuse, and function limit circumvention per WSTG-BUSL.

Advanced client-side attacks — CORS misconfiguration, WebSocket security, clickjacking, postMessage abuse, CSS injection, and browser storage vulnerabilities.

Cloud security posture management and container security assessment for AWS, Azure, GCP, and Kubernetes.

Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification.

Binary exploitation (Pwn) and reverse engineering tools for CTF challenges and software analysis.

Cryptography tools for solving CTF challenges involving ciphers, hashing, and weak encryption.

Digital forensics, steganography, and packet analysis for CTF challenges and investigation.

Professional web application and API security testing workflows using OWASP Top 10 methodologies.

Proof-driven exploitation with 4-level evidence system, bypass exhaustion protocol, mandatory evidence checklists, and strict EXPLOITED/POTENTIAL/FALSE_POSITIVE classification.

HTTP request smuggling, desync attacks, cache poisoning, and protocol-level vulnerability testing.

OWASP Mobile Top 10 security testing for Android and iOS — local storage, certificate pinning bypass, IPC abuse, and binary protections.

Internal network penetration testing, Active Directory enumeration, and lateral movement simulation.

Open Source Intelligence gathering and attack surface management for external reconnaissance.

Concurrency exploitation — race conditions, TOCTOU vulnerabilities, and parallel request abuse in web applications.

White-box attack surface mapping — correlate external scans, browser exploration, and source code into structured endpoint inventory, role architecture, and authorization vulnerability candidates.

Discover hardcoded credentials, leaked API keys, exposed configuration files, sensitive data in artifacts, and information disclosure via error handling.