Credential extraction and capture — LSASS dumping, SAM/SECURITY hive extraction, DPAPI decryption, NTLM relay, Responder poisoning, password spraying, hash cracking.

Attempts ONE alternative fix for a bug, tests it empirically, and reports results. ALWAYS explores a DIFFERENT approach from existing PR fixes. Use when CI or an agent needs to try independent fix alternatives. Invoke with problem description, test command, target files, and optional hints.

Guidance for querying and interpreting Copilot and agentic workflow OpenTelemetry token and execution metrics.

Create/edit/analyze/verify spreadsheet workbooks including XLSX/CSV/TSV.

Turn a sufficiently understood task into an ordered implementation plan with dependencies and verification. Orchestrate CodeWhale’s native plan state; do not build a parallel planner.

Create/edit/inspect Word documents using available managed or host capabilities.

Review and improve documentation with parallel evaluation and iterative improvement loop.

Persistent long-term memory protocol powered by mem0. Evaluate conversations for durable facts worth storing via memory_add. Handles identity, preferences, decisions, configurations, rules, projects, and relationships. Loaded by the openclaw-mem0 plugin when skills mode is active.

Tavily web search, content extraction, and research tools.

OPC-UA (TCP 4840) attack playbook — endpoint enumeration, SecurityPolicy mapping, anonymous/weak-auth abuse, address-space browsing and tag read, HistoryRead exfiltration, Method call for control actions, session-exhaustion DoS. Modern IT/OT DMZ convergence protocol replacing legacy fieldbus.

MEV sandwich attacks — front-run + back-run a victim swap on Uniswap V2/V3, Curve, Balancer; mempool monitoring via Flashbots / private RPC, slippage tolerance exploitation, JIT liquidity sandwich, multi-block MEV.

Microsoft 365 mailbox compromise chain — OAuth consent phishing, delegate access abuse, mail rule persistence, and token theft via device code phishing. Full kill chain from initial access to persistent email collection.

更新飞书云文档。支持 7 种更新模式：追加、覆盖、定位替换、全文替换、前/后插入、删除。

Discard all frames currently held by the Editor Profiler (UnityEditorInternal.ProfilerDriver.ClearAllFrames). Cannot be undone.

Find a specific GameObject in the opened Prefab (preferred when present) or the active Scene. Optionally include editable data, components preview, bounds, and limited hierarchy. Supports token-saving path-scoped reads via `paths` or `viewQuery`.

Review and resolve PR comments from GitHub. Validates each comment, fixes legitimate issues.

How to author custom commands for the server-url-templating-api CLI using the co-generated SDK.

How to author custom commands for the server-sent-events-openapi CLI using the co-generated SDK.

How to author custom commands for the path-param-body-collision CLI using the co-generated SDK.

How to author custom commands for the nullable-request-body CLI using the co-generated SDK.