Segurança

Audit npm dependencies for security vulnerabilities, outdated packages, and unused dependencies. Use when checking for security issues, updating packages, or cleaning up dependencies.

Review code for bugs, security vulnerabilities, performance issues, and best practices. Use this skill whenever the user asks for a code review, shares code and wants feedback, mentions "review this", "check my code", "what's wrong with this code", pastes a diff or PR, or asks about code quality. Also trigger when users share code snippets and ask general questions that would benefit from a thorou

Android 15/16 compatibility preflight. Evaluates target SDK posture, edge-to-edge signals, predictive back migration risk, large-screen behavior, and 16 KB page-size readiness with explicit version awareness. Triggers on: "compatibility", "android 16", "edge-to-edge", "predictive back", "large screen".

Google Play preflight from source evidence. Evaluates target SDK posture, foreground service declarations, permission surface, and obvious policy red flags without claiming full Play Console compliance. Triggers on: "play store", "target SDK", "data safety", "foreground service", "play policy".

When the user wants to create, optimize, or audit media kit or press page. Also use when the user mentions "media kit," "press kit," "press page," "press resources," "brand assets," "logo download," "press assets," "media resources," or "brand kit." For PR outreach, use public-relations.

Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.

Conduct authorized defensive security audits of codebases and web applications. Use for broad appsec review across OWASP, authz, business logic, SSRF, XSS, CSRF, injection, file upload, secrets, logging, and tenant isolation. Produces structured findings with severity, confidence, evidence, and safe remediation guidance.

Revisa as dependências de pacotes em busca de vulnerabilidades de segurança, versões desatualizadas e conformidade de licença. Use quando o usuário perguntar sobre dependências, auditorias de segurança ou antes de lançamentos.

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltrati

Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypas

Software Composition Analysis (SCA) using Synopsys Black Duck for identifying open source vulnerabilities, license compliance risks, and supply chain security threats with CVE, CWE, and OWASP framework mapping. Use when: (1) Scanning dependencies for known vulnerabilities and security risks, (2) Analyzing open source license compliance and legal risks, (3) Identifying outdated or unmaintained depe

Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls. Use when setting up projects that need cryptographic audit trails, policy-gated tool execution, or compliance-ready evidence of agent actions.