Segurança

Use this skill when designing backend systems, databases, APIs, or services. Triggers on schema design, database migrations, indexing strategies, distributed systems architecture, microservices, caching, message queues, observability setup, logging, metrics, tracing, SLO/SLI definition, performance optimization, query tuning, security hardening, authentication, authorization, API design (REST, Gra

Use esta skill ao realizar testes de penetração autorizados, avaliações de vulnerabilidade ou auditorias de segurança dentro do escopo de engajamento adequado. Aciona em metodologia de pentest, varredura de vulnerabilidades, guia de testes OWASP, Burp Suite, reconhecimento, exploração, relatórios e qualquer tarefa que exija avaliação de segurança estruturada em engajamentos autorizados ou competições CTF.

Use esta skill para preparação de conformidade com SOC 2, HIPAA ou PCI-DSS, auditorias ou implementação de controles de segurança. Ela é acionada por auditorias de conformidade, controles de segurança, avaliação de risco e planejamento de conformidade regulatória.

aelf Skills Hub é uma meta-skill completa para descobrir, baixar, configurar e rotear todas as skills do ecossistema aelf.

Configures HTTP security headers to protect against XSS, clickjacking, and MIME sniffing attacks. Use when hardening web applications, passing security audits, or implementing Content Security Policy.

REST API security hardening with authentication, rate limiting, input validation, security headers. Use for production APIs, security audits, defense-in-depth, or encountering vulnerabilities, injection attacks, CORS issues.

Code review using Codex MCP. Use when: PR review, code audit, second opinion on changes. Not for: doc review (use doc-review), security audit (use security-review). Output: severity-grouped findings + merge gate.

OWASP Top 10 security review using Codex MCP. Supports review loop with context preservation.

Comprehensive developer workstation security audit — scans for exposed credentials, compromised application data, persistence mechanisms, and supply chain attack indicators. Use this skill whenever the user suspects their machine may be compromised, wants to check for exposed secrets, asks about supply chain attacks, or wants a full security audit of their development environment. Also triggers on

Project health audit with deterministic scoring. Use when: evaluating project quality, onboarding to new codebase, periodic health checks. Not for: runtime performance analysis, security-specific audits (use /codex-security). Output: 5-dimension score + actionable findings.

Security review via Codex MCP. Use when: OWASP Top 10 audit, dependency vulnerability check, security-sensitive changes. Not for: code review (use codex-code-review), test review (use test-review). Output: security findings + audit report.

Feature verification (READ-ONLY, P0-P5). Use when: verifying feature behavior after deployment, validating API responses, diagnosing production issues, post-deploy smoke test. Not for: modifying data (use feature-dev), code review (use codex-review-fast), writing tests (use codex-test-gen), security audit (use codex-security).