Segurança

Vendor-neutral routing guide for choosing the right model tier by task type. Mechanical work uses a smaller/faster model; implementation uses a standard model; architecture, security, and release audit use the most capable model.

Analyze which rules are actively used vs inert. Detect coverage gaps. Recommend pruning to reduce token consumption.

Fetch .claude/ configs from curated repos in sources.yml, compare against dotforge template, report novel patterns.

Maintain calendar of upcoming catalysts for portfolio positions and watchlist. Earnings dates, ex-div dates, regulatory events, macro releases. Triggers on "catalysts", "upcoming events", "earnings calendar", "what's coming up", "catalyst calendar".

Full-stack security posture assessment with 0-100 risk scoring. Scans dependency vulnerabilities (npm audit, pip-audit, cargo audit, govulncheck), dangerous code patterns (SQL injection, eval, command injection, ReDoS, innerHTML, XSS vectors), authentication gaps (missing auth middleware, CSRF, hardcoded JWT secrets, insecure session flags), insecure crypto (MD5/SHA1 password hashing, Math.random

Activates SecurityChief for cybersecurity analysis and threat intelligence. Use when you need STRIDE threat modeling for any system architecture, OWASP top 10 analysis, security log analysis and SIEM triage, incident response playbook execution, SOC2/ISO 27001/NIST CSF control mapping, or vulnerability assessment and remediation planning.

PCI DSS v4.0 compliance audit for payment-handling codebases. Scans for PAN patterns (Visa, Mastercard, Amex, Discover), CVV storage violations, and track data retention. Audits all 12 requirements: network security controls (firewall rules, CDE segmentation, default-deny), secure configurations (default credentials, hardening), stored cardholder data protection (AES-256 encryption, masking first-

Pre-commit verification pipeline — static security scan, baseline-aware quality gates, independent reviewer subagent, and auto-fix loop. Use after code changes and before committing, pushing, or opening a PR.

Compare Claude Code output with full config vs minimal config using standardized tasks per stack.

Audit mobile apps against OWASP Mobile Top 10 (M1-M10): credential hardcoding, supply chain dependencies, insecure auth/token storage (Keychain/Keystore), input validation (deep links, WebView XSS), certificate pinning (OkHttp, TrustKit, Alamofire), privacy (PII in logs, clipboard, screenshots), binary protections (ProGuard/R8, obfuscation, anti-tampering), security misconfiguration (backup, expor

Analyze project dependencies for health, security, and bloat — audit outdated, deprecated, vulnerable, duplicate, heavy, and unused packages across npm, pip, cargo, go mod, and more. Produce a dependency health score, CVE inventory, license compatibility matrix, bundle size impact assessment, and a prioritized update plan with migration paths.

Systematic audit against the OWASP 2021 Top 10 web application security risks with severity-rated, file-level findings. Checks A01 Broken Access Control (IDOR, path traversal, CORS, privilege escalation), A02 Cryptographic Failures (weak algorithms, exposed secrets, missing TLS), A03 Injection (SQL, NoSQL, command, XSS, LDAP, XPath, template injection), A04 Insecure Design (missing rate limiting,