Segurança

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

Map identified threats to appropriate security controls and mitigations. Use when prioritizing security investments, creating remediation plans, or validating control effectiveness.

Delegates large-context code analysis to Gemini CLI. Use when analyzing codebases, tracing bugs across files, reviewing architecture, or performing security audits. Gemini reads, Claude implements.

When the user wants to create, optimize, or audit solutions pages. Also use when the user mentions "solutions," "solutions page," "by industry," "industry solutions," "by company size," "SMB," "enterprise," "by outcome," "business outcomes," or "how we solve X." For sitewide page planning, use website-structure.

Defense-in-depth security validation — multi-layered checks for OWASP Top 10, secrets, auth, crypto, and data protection.

API security hardening patterns. Use when implementing rate limiting, input validation, CORS configuration, API key management, request throttling, or protecting endpoints from abuse. Covers defense-in-depth strategies for REST APIs with practical implementations for Express, FastAPI, and serverless, oriented around the OWASP API Security Top 10:2023.

Scans Substrate/Polkadot pallets for 7 critical vulnerabilities including arithmetic overflow, panic DoS, incorrect weights, and bad origin checks. Use when auditing Substrate runtimes or FRAME pallets.

Pre-landing PR review - gstack staff-engineer code review army. CARL TRIGGERS: review the code, audit this branch, check this PR, find bugs, code review, review my changes. SOURCE: garrytan/gstack/review, integrated as gs-review on 2026-05-29.

Verify security considerations were addressed before shipping. Issues result in WARNINGS that strongly recommend fixing.

Sistema de hooks do Claude Code para execução de ferramentas pré e pós. Ele é acionado por hooks, PreToolUse, PostToolUse, scripts de hook, validação de ferramentas e registro de auditoria.

Verify fix commits address audit findings without new bugs

Use when working with authentication, API routes, user input, or sensitive data. Audits code for security vulnerabilities based on OWASP Top 10. Critical for payment processing, auth systems, and data handling.