hmbown/detect-magic
generated/openclaw/detect-magic/SKILL.md
Use this skill when you need a fast, structured scan for where the real magic is hiding in a repo, workflow, or system.
$ install --global
skillsauthnpx skillsauth add hmbown/wizards-of-the-ghosts detect-magicInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 8:36 PM1.9s1 file scanned
SKILL.md
- name:
- detect-magic
- description:
- Use this skill when you need a fast, structured scan for where the real magic is hiding in a repo, workflow, or system.
- user-invocable:
- true
Detect Magic
Surface hidden AI affordances, agents, automations, and tool hooks before acting.
Overview
Detect Magic is interpreted here as a metaphorical spell with a shipping-now execution model.
Canonical source: Detect Magic (spell)
Provider target: OpenClaw
When To Use
- You need a preflight scan of a repo or system before making any changes.
- You need to map where automation, model behavior, and side effects actually live.
- You want to inventory hidden capability surfaces: model providers, tool registries, shell bridges, webhooks, schedulers.
- You need to identify surprising affordances, dangerous edges, or missing observability.
- The request involves AI tooling, agents, starter kits, or model behavior scanning.
Workflow
- Inventory obvious entrypoints: README, package manifests, setup docs, scripts/, CI/CD folders, env templates.
- Trace outward to hidden capability surfaces: model providers, tool registries, function-calling schemas, MCP config, plugin loaders, shell bridges.
- Identify background jobs, cron, schedulers, queues, workers, webhooks, event consumers, notification hooks.
- Call out surprising affordances, dangerous edges, missing observability, and fan-out points.
- Return a compact map of confirmed mechanisms, inferred mechanisms, and unknowns needing follow-up.
- Separate confirmed findings from inference every time — use explicit uncertainty language.
Deliverables
- A concise capability inventory mapping all discovered execution surfaces.
- A risk list covering hidden side effects or untrusted execution paths.
- A shortlist of follow-up skills or next actions (e.g. $identify, $zone-of-truth, $glyph-of-warding).
Guardrails
- Do not claim magic where there is only speculation — separate proof from suspicion.
- Do not execute risky hooks, automations, deploys, rollbacks, webhooks, or billing mutations just to prove they exist.
- Treat dependency or environment artifacts carefully — a binary suggests tooling is installed but does not prove the repo ships that capability.
- Use explicit uncertainty language: Confirmed, Inferred not confirmed, Unknown from repo evidence.
- Do not drift into generic security-review prose — sound like a structured capability-scan ritual.
Default Invocation
Use $detect-magic to scan this repo for hidden AI tooling, agents, MCP servers, and automation hooks before we change anything.
Related Skills
hmbown/zone-of-truth
testing
VerifiedTrustedCommunity
Enter a mode where every assertion is backed by evidence, confidence is calibrated, speculation is flagged, and hallucination is actively resisted.
55SKILL.mdUpdated Apr 5, 2026
hmbown/vicious-mockery
development
VerifiedTrustedCommunity
The bard's cantrip that deals psychic damage through insults. In practice this is adversarial review — the art of finding and articulating exactly what is wrong with something in a way that is impossible to ignore. Unlike polite feedback that gets filed and forgotten, vicious mockery lands. It is the red-team report that makes the PM cancel the launch, the code review that makes the author delete the PR, the roast that makes the founder pivot. The damage is the point.
55SKILL.mdUpdated Apr 5, 2026
hmbown/unseen-servant
tools
VerifiedTrustedCommunity
Use this spell when you need a tireless helper that organizes, tidies, triages, and maintains without requiring your constant attention.
55SKILL.mdUpdated Apr 5, 2026
hmbown/true-strike
testing
VerifiedTrustedCommunity
Use this spell for preflight certainty: dry runs, validation checks, dependency verification, and rehearsals that make the next deploy, query, or command much more likely to succeed. It trades a little time up front for fewer blind swings and fewer expensive misses.
55SKILL.mdUpdated Apr 5, 2026