Segurança

Security testing patterns including SAST, DAST, penetration testing, and vulnerability assessment techniques. Use when implementing security testing pipelines, conducting security audits, or validating application security controls.

Meta-skill for auditing and validating skill quality. Use when reviewing skills for consistency, completeness, accuracy, and adherence to standards. Provides structured rubrics, scoring frameworks, and actionable recommendations.

Audit authentication and authorization patterns. Checks JWT, sessions, OAuth2, PKCE implementations for security best practices and common vulnerabilities.

Extract learnings from audit history and conversation, manage memories, clean up stale entries. Use after completing a track, during retrospective (③ memory step), at end of session, or anytime the user wants memory maintenance. Triggers on 'what did we learn', 'memory cleanup', 'review learnings', 'retrospective', 'update memories', '회고', '메모리 정리'.

Supply chain security audit — coordinates real CLI vulnerability scanners (npm audit, pip-audit, govulncheck, cargo audit, etc.) and synthesizes findings with license compliance and risk assessment.

Use when analyzing harness trace logs to surface recurring failure patterns and suggest harness improvements. Scatter-gather pattern across last N runs with mandatory HITL gate before any change is applied. Triggers on /mk:trace-analyze, "analyze traces", "find patterns in harness runs", or after a model upgrade flagged dead-weight-audit-needed.

Pack an EXTERNAL repository into a single AI-friendly file (markdown/xml/json). Use for third-party library analysis, security audits, or handoff to external LLMs. Do NOT use to pack the current project for inbound context — the host runtime already reads files lazily. Triggers: 'pack this repo', 'snapshot of X', 'export codebase', 'repomix'.

Task tracking system for agents via Backlog.md CLI. Use when creating deferred issues during implementation, filing audit findings, working assigned tasks, or managing project work. Optimized for agent workflows: structured issue filing, priority/labeling system, and task completion tracking.

Main security scanning orchestration. Detects language, runs OWASP Top 10 patterns, identifies vulnerabilities, generates structured reports. Use when scanning for XSS, SQL injection, command injection, secrets, or any security vulnerability.

OWASP Top 10 security vulnerabilities with detection and remediation patterns. Use when conducting security audits, implementing secure coding practices, or reviewing code for common security vulnerabilities.

Deep security and performance scan with structured reporting.

Run consensus-loop deterministic analysis tools via CLI — code_map, dependency_graph, audit_scan, coverage_map, rtm_parse, rtm_merge, audit_history, fvm_generate, fvm_validate. Use this skill whenever you need codebase analysis (symbol index, dependency DAG, pattern scan, coverage), RTM operations (parse, merge, query), or FVM operations (generate matrix, validate against server) — even if the MCP