Segurança

Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guidance, cryptography patterns, and security scanning tools. Use when the user asks about security reviews, threat analysis, vulnerability assessments, secure coding practices, security audits, attack surface analysis, CVE remediation, or security

Compliance OS — meta-orchestrator that lets compliance teams CONFIGURE which frameworks apply, COMPUTE cross-framework control overlap, SIMULATE internal audits, and CONSOLIDATE evidence across multiple frameworks. Four decisions: (1) Given a company profile, which of the 12 supported frameworks apply (ISO 27001/13485/42001/14971, EU AI Act, MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA

Use esta skill para auditar implementações OAuth 2.0 / OIDC contra a RFC 9700, revisar código de cliente/servidor de autorização, avaliar o tratamento de PKCE/state/redirect-URI, fortalecer fluxos de troca e atualização de tokens, ou triar vulnerabilidades OAuth suspeitas.

Security auditing skill for web applications and codebases. Scans for OWASP Top 10, dependency vulnerabilities, secrets exposure, XSS/CSRF/injection flaws, auth weaknesses, and misconfigurations. Use when task involves security scan, vulnerability assessment, pen test review, threat modeling, or hardening a codebase.

Application security covering input validation, auth, headers, secrets management, and dependency auditing

Inspect and flush staged audit-trail entries to the remote trail repository. Use when the user asks to "flush audit trail", "show what's pending in audit trail", "dry-run audit flush", "retry audit pending", or when diagnosing why a previous auto-flush was skipped (secret hit, push failure, manual mode).

budi token/cost analytics for Claude Code — dashboard access, CLI queries, cost analysis patterns, session tracking. Trigger on: "budi", "token cost", "how much did that cost", "session cost", "spending", "token analytics", "cost dashboard", "usage stats", or any question about Claude Code token consumption or spending patterns.

Validate, test, and score the quality of skills within the claude-skills ecosystem. Comprehensive meta-skill: structure validation, Python script testing (syntax + imports + runtime + output format), multi-dimensional quality scoring with letter grades and tier classification (BASIC/STANDARD/POWERFUL). Use when authoring a new skill, auditing existing skills for tier promotion, setting up pre-comm

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implemen

Use when adding, retiring, or auditing feature flags. Triggers on "add a flag", "ship behind a flag", "rollout plan", "kill switch", "stale flags", "flag debt", "LaunchDarkly", "GrowthBook", "Statsig", "Unleash", "Flipt", or any progressive-delivery question. Ships flag debt scanner, rollout planner, and kill-switch auditor (all stdlib Python), 4 references on flag taxonomy + provider trade-offs +

Systematic website audit (stack detection, 9 phases). Use when: "audit", "website audit", "site audit", "check website".

Audita código em busca de vulnerabilidades comuns: injeção, segredos, autenticação e CVEs de dependência. Utilize ao revisar a segurança, antes do lançamento ou quando o usuário solicitar uma verificação de segurança.