--- title: "Security Review Pack" description: "Run practical security checks before installing or publishing tools." canonical: "https://hub.ironclaw.com/collections/security-review" markdown: "https://hub.ironclaw.com/collections/security-review.md" type: "collection" entries: 18 --- # Security Review Pack > A focused bundle for app hardening, compliance, access, and risk review. ## Outcome Run practical security checks before installing or publishing tools. ## Included Skills and Tools - [Legal Readiness Check And Contract Kickoff Packet](https://hub.ironclaw.com/marketplace/legal-readiness-check-and-contract-kickoff-packet.md) — When a new partnership or vendor contract is about to take effect, the agent compiles a kickoff packet covering the status of legal review, the obligations the organization just committed to, key dates, named owners, and risk flags. Delivered to the deal owner before the contract effective date so nothing slips on day one. - [Near Rpc](https://hub.ironclaw.com/marketplace/near-rpc.md) — NEAR Protocol JSON-RPC integration. 27 actions covering account state, access keys, contract storage and code, view function calls, blocks, chunks, validators, transaction lifecycle, gas and protocol config, state changes, network status, and light-client proofs. No credentials required for read actions. - [Attio](https://hub.ironclaw.com/marketplace/attio.md) — Attio CRM API v2 read and write access. Queries, fetches, creates, updates, asserts, and deletes records for any object (people, companies, deals, users, workspaces, or custom), reads the object catalog and per-object attribute schemas, lists lists and queries list entries, and lists and creates notes and tasks. Exposes a raw attio_request action for any v2 endpoint bounded by the same host allowlist. Authenticated with an Attio workspace API key presented as a Bearer header against api.attio.com. - [Blog Transaction Log Data Quality](https://hub.ironclaw.com/marketplace/blog-transaction-log-data-quality.md) — Runs a weekly data-quality and hygiene check on the BLOG on-chain bookkeeping ledger. Reads the ledger account's recent transactions, flags missing references, anomalies, and gaps, and writes a findings report to Notion for finance review. - [Bluesky Analytics](https://hub.ironclaw.com/marketplace/bluesky-analytics.md) — Read-only Bluesky (AT Protocol) analytics. Browse public accounts, posts, social graph, and engagement via the unauthenticated AppView. Look up profiles with follower/post counts, read an account's feed with per-post like/repost/reply counts, walk a post's reply (comment) tree, list followers/follows and who liked/reposted a post, and search for accounts. No authentication required. - [Btc Dominance Alert](https://hub.ironclaw.com/marketplace/btc-dominance-alert.md) — Watches Bitcoin dominance (BTC's share of total crypto market cap) and alerts the user on Telegram only when it crosses a key threshold: below 60% reads as a possible altcoin-season signal, above 65% as BTC dominance expanding. Between 60% and 65% it stays silent. Each check is logged to memory as an audit trail, and it only alerts on an actual threshold crossing, never on every run. - [Community Engagement Monitoring And Matchmaking](https://hub.ironclaw.com/marketplace/community-engagement-monitoring-and-matchmaking.md) — Watches community channels for engagement signals (members asking questions repeatedly, members offering help in their domain, members at risk of churning) and produces a daily digest for community leads with suggested actions covering who needs a personal follow-up, who to introduce to whom, and where attention is most needed. All actions go through the community lead, never auto-DM. - [Crypto Ta Engine](https://hub.ironclaw.com/marketplace/crypto-ta-engine.md) — Deterministic technical-analysis engine for Ironclaw. Fetches Binance Spot klines and computes EMA/RSI/MACD/StochRSI/ADX/ATR/Bollinger/OBV/CMF/VWAP plus a weighted multi-timeframe confluence verdict with ATR-based stop-loss/take-profit. Moves all TA math out of the LLM. - [Crypto Wallet Verification](https://hub.ironclaw.com/marketplace/crypto-wallet-verification.md) — Verifies a new crypto wallet on-chain before it is added as a payee, then prepares a small test payment for the user's own wallet to sign. The agent never holds or signs keys; it verifies the address, hands the unsigned test payment to the user's wallet, and confirms the result on-chain. - [Defi Portfolio Monitor](https://hub.ironclaw.com/marketplace/defi-portfolio-monitor.md) — Stores the user's DeFi positions in memory and sends a daily Telegram report: it pulls live TVL for each of their protocols from DefiLlama, rates each position's risk from the 24h and 7d TVL change (a 7-day drop over 20% reads as HIGH RISK), and scans DefiLlama's yield database for the best current stablecoin yields above 5% APY. One report covers position risk, a one-line read per protocol, and where better yield is available right now. - [Defillama](https://hub.ironclaw.com/marketplace/defillama.md) — DefiLlama DeFi analytics — protocol/chain TVL, token prices, stablecoin circulation, yield/APY pools, DEX volumes, and fees/revenue from the free open API. No API key, no auth setup. - [Evm Rpc](https://hub.ironclaw.com/marketplace/evm-rpc.md) — EVM JSON-RPC integration. Read account balances, contract code and storage, call view functions, fetch blocks, transactions, receipts, and event logs. Built-in chain shortcuts for Ethereum mainnet, Polygon, Arbitrum, Optimism, Base, BNB Chain, and Avalanche; accepts custom RPC URLs for any EVM-compatible network. Read-only (no transaction signing). - [Expense Receipt Compliance](https://hub.ironclaw.com/marketplace/expense-receipt-compliance.md) — Scans expense submissions for missing or non-compliant receipts, sends automated follow-up requests to submitters, and triages exceptions into a Notion register for finance review. - [Frankfurter Fx](https://hub.ironclaw.com/marketplace/frankfurter-fx.md) — Foreign exchange (FX) rates, currency conversions, multi-currency portfolio conversion, and historical rate analytics powered by Central Bank data via Frankfurter v2. - [Hubspot](https://hub.ironclaw.com/marketplace/hubspot.md) — HubSpot CRM v3 read and write access. Lists, searches, fetches, creates, updates, and archives contacts, companies, deals, and tickets. Lists contact lists and members, CRM owners, and per-object properties. Exposes a raw hubspot_request action for any CRM v3 endpoint bounded by the same host allowlist. Authenticated with a HubSpot access token (Private App or Service Key) presented as a Bearer header against api.hubapi.com. - [Kyc Renewal Tracking](https://hub.ironclaw.com/marketplace/kyc-renewal-tracking.md) — Tracks KYC and KYB renewal cycles for counterparties and entities in a Notion register, surfaces upcoming or overdue renewals on a daily digest, and drafts outreach to the counterparty when documentation is requested. - [Monday](https://hub.ironclaw.com/marketplace/monday.md) — monday.com API v2 (GraphQL) read and write access. Reads the current account, boards (list/get/groups), items (paginated by board, single get, search by column value, updates), users, and workspaces. Writes: create_item, update_item_column_values (change_multiple_column_values), archive_item, delete_item, move_item_to_group, create_group, create_subitem, create_update. Exposes a raw monday_graphql_query action for any query or mutation against api.monday.com/v2. Authenticated with a personal API v2 token sent as the raw value of an Authorization header (NO Bearer prefix per the monday.com convention). - [Nearcatalog](https://hub.ironclaw.com/marketplace/nearcatalog.md) — Explore the NEAR ecosystem from public NEAR Catalog data. Keyword-search projects, browse and filter the catalog by status/phase, list trending projects, look up full project profiles and related projects, browse categories, find people building on NEAR, and list awesome-near OSS libraries. No authentication required. ## Links - [HTML page](https://hub.ironclaw.com/collections/security-review) - [Marketplace index](https://hub.ironclaw.com/marketplace.md)