Segurança

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation, vertical privilege escalation via role manipulation, SQL injection, NoSQL injection, XSS (stored, reflected, DOM), command injection,

Audit retirement planning software for projection model accuracy, asset allocation by age, Social Security optimization, tax-advantaged account strategy, withdrawal sequencing including Roth conversion ladders, Monte Carlo simulation quality, and inflation adjustment methodology. Use when reviewing financial planning tools, 401k platforms, pension calculators, or wealth management systems.

Use when hardening npm supply chain, pinning dependency versions, adding .npmrc security flags, or setting up Renovate and audit workflows. Locks down install-time scripts, registries, version ranges, and CI checks.

Audit agent configuration files for security vulnerabilities and misconfigurations. Covers settings.json, .mcp.json, .codex/config.toml, AGENTS.md, hooks, plugin manifests, and relay config. Classify findings as P0 or P1.

Audit agent configuration files for security vulnerabilities and misconfigurations. Covers settings.json, .mcp.json, .codex/config.toml, AGENTS.md, hooks, plugin manifests, and relay config. Classify findings as P0 or P1.

Pre-launch compliance and security gate for fintech apps: audit PCI DSS payment card handling, review financial API integrations for idempotency and error handling, evaluate fraud detection coverage, validate credit risk models for fairness, then run preflight checks. Use before launching a payments app, neobank, lending platform, BNPL product, or any money-movement system.

Run quantitative or thematic stock screens to surface investment ideas. Supports AR (BYMA, CEDEARs) and US markets. Triggers on "screen", "stock screen", "find stocks", "investment ideas", "what looks interesting".

Audit a government or public services system for compliance, fraud risk, and security — chains benefits processing review, fraud detection analysis, regulatory compliance check (ADA, Section 508, FISMA, Privacy Act), and PII-focused security audit. Use for benefits platforms, eligibility engines, enrollment portals, or inter-agency data systems.

Generate a Claude Code plugin package from the current project's dotforge configuration, ready for marketplace submission.

Deep HIPAA Security Rule technical audit mapping code-level findings to 45 CFR sections. Covers administrative safeguards (164.308 -- risk analysis, workforce security, access management, incident procedures, contingency planning), physical safeguards (164.310 -- facility access, workstation security, session timeout, device controls, crypto-shredding), and technical safeguards (164.312 -- unique

Uninstall the flagrare plugin and remove the marketplace. Use when the user says 'uninstall flagrare', 'remove flagrare', 'disable flagrare skills', or 'remove flagrare-skills'.

Initializes the Claude Code configuration in a new or existing project using the dotforge template.