Segurança

Verifica arquivos Markdown (.md) em busca de injeção de código malicioso, incluindo XSS, injeção de prompt, injeção de script, payloads ofuscados e vetores de ataque à cadeia de suprimentos. Utilize ao auditar arquivos .md em busca de ameaças de segurança ou quando o usuário mencionar a verificação de markdown para conteúdo malicioso.

Process audio and video with clipping, conversion, analysis, captions, thumbnails, GIFs, and batch utilities. Use for practical media manipulation workflows.

Conducts a comprehensive security audit covering web application vulnerabilities, API security, OWASP Top 10, and security hardening recommendations. Use when auditing a codebase for security or when the user mentions security audit, penetration testing, or vulnerability scan.

Application security testing coordinator for common vulnerability patterns including XSS, injection flaws, and client-side security issues. Orchestrates specialized testing agents to identify and validate common application security weaknesses.

USE BEFORE committing security-sensitive changes (auth, crypto, routes, user-input handling, secret loading, templates), or when the `security-nudge` Stop hook suggests it. Audits the current diff for OWASP-Top-10-shaped issues + deps typosquatting. Read-only. Delegates to the `security-reviewer` Sonnet subagent shipped here; returns Critical / Important / Nice schema with `file:line`.

Authentication testing skill - automates signup, login, 2FA bypass, CAPTCHA solving, and bot detection evasion using Playwright MCP. Tests authentication security controls. Includes behavioral biometrics simulation, OTP handling, and automated account creation for security assessments.

CVE vulnerability testing coordinator that identifies technology stacks, researches known vulnerabilities, and tests applications for exploitable CVEs using public exploits and proof-of-concept code.

Provides Docker and containerization best practices including multi-stage builds, security hardening, and compose patterns. Use when writing Dockerfiles, optimizing images, setting up containers, or when user mentions 'Docker', 'container', 'Dockerfile', 'docker-compose', 'image'.

Provides dependency management and supply chain security practices for auditing vulnerabilities, checking licenses, assessing dependency health, and managing upgrades safely. Use when auditing packages, reviewing security, managing dependencies, or when user mentions 'audit', 'vulnerability', 'dependency', 'supply chain', 'npm audit', 'license', 'bundle size'.

Applies OWASP Top 10, secrets management, and least-privilege principles before any code ships. Security is a build step, not an afterthought.

Structured code review focusing on correctness, security, and maintainability. Correctness before style. Every reviewer comment must be actionable.

Use when working with any code that handles user input, authentication, authorization, or secrets. Also use when adding or updating dependencies, reviewing infrastructure-as-code, or before claiming security posture is adequate. Covers OWASP Top 10, secrets detection (API keys, passwords, tokens in code), dependency vulnerabilities, IaC security, Docker hardening, and supply chain risks. If code t