Segurança

Deep PHP-specific security audit skill covering injection, deserialization, file operations, auth bypass, POP chain discovery, and CMS-specific patterns. Trigger when auditing PHP code: "audit this PHP app", "find PHP security issues", "check Laravel/WordPress for vulnerabilities", "PHP SAST review", "check for PHP deserialization", "review this WordPress plugin". Includes scripts/rules.json for p

GHSA/CVE variant analysis workflow for finding similar vulnerability patterns across a codebase. Trigger when the user asks to: "find variants of this CVE", "GHSA variant analysis", "find similar bugs", "hunt for the same pattern", "are there other places with this vulnerability?", or when a known vulnerability is discovered and the user wants to know if the same pattern exists elsewhere.

Comprehensive PHP code review with security analysis, performance optimization, and PSR-12 compliance checking for PHP7/PHP8 projects

Deep Python-specific security audit skill with 50+ vulnerability class coverage across 7 categories. Trigger when auditing Python code: "audit this Python app", "find Python security issues", "check Flask/Django for vulnerabilities", "Python SAST review", "check for pickle vulnerabilities", "review this FastAPI code". Covers misconfiguration, injection, crypto, XSS, deserialization, and ML/AI atta

When hardening a web application against Cross-Site Scripting (XSS) and injection attacks.

Use when ANY command fails with 'command not found', when installing CLI tools (ripgrep, fd, jq, yq, bat, etc.), auditing project environments, or batch-updating tools. Triggers on: command not found, install tool, missing binary, environment audit, update tools, which, apt install, brew install.

Security remediation skill for fixing confirmed or likely SAST findings in source code. Trigger when the user asks to: "fix a vulnerability", "patch this security bug", "remediate SAST findings", "harden this endpoint", "make this auth flow safe", or wants code changes that remove a confirmed security issue while preserving intended behavior. Best used alongside eresus-sast-scanner.

Run a comprehensive pre-launch website audit covering technical SEO, AI accessibility, security, performance, and on-page SEO. Detects tech stack, tailors checks to framework, orchestrates 5 sub-audits with parallel execution, and delivers a prioritized report with stack-specific fix recommendations. Use when the user asks to audit a site before launch, check staging, review a site before go-live,

Use ao gerar código Python para aplicações web, APIs ou ao lidar com entrada de usuário, prevenindo vulnerabilidades do OWASP Top 10 em Django, Flask e FastAPI.

Language-specific vulnerability hotspot reference for manual code audit. Trigger when the user asks to: "what sinks should I look for in Java?", "Python security hotspots", "dangerous functions in Go", "JavaScript injection patterns", or when starting a manual audit of a specific language and needing a sink/source checklist.

Use for any iOS security question — whether you're asking about a specific vulnerability, checking if a pattern is secure, or running a full audit. Triggers on: Keychain vs UserDefaults decisions, ATS/NSAllowsArbitraryLoads configuration, certificate pinning implementation, WebView security (UIWebView, WKWebView), hardcoded secrets or API keys, jailbreak/tamper detection, biometric authentication,

Auditor de premissas de primeiros princípios que desconstrói decisões ou crenças em premissas irredutíveis. Classifica as suposições, as ranqueia por fragilidade e impacto, e reconstrói conclusões a partir de verdades fundamentais verificadas.