Segurança

Security auditing skill for web applications and codebases. Scans for OWASP Top 10, dependency vulnerabilities, secrets exposure, XSS/CSRF/injection flaws, auth weaknesses, and misconfigurations. Use when task involves security scan, vulnerability assessment, pen test review, threat modeling, or hardening a codebase.

Generate a structured sync bundle that captures decisions, architecture changes, conventions, bug fixes, and roadmap updates from the current Claude.ai conversation for ingestion into local Project Swarm projects via Claude Code. Trigger when the user says "sync", "sync project details", "generate sync bundle", "save this for Claude Code", "update local projects", "export decisions", or any variat

This skill serve to provide context about a Solidity protocol or a smart contract(s). The skill analyzes the particular smart contract project and builds two level context knowledge — High level ( the summary version ) and In depth level ( the detailed version including diagrams ). Use when the user prompt is about conceptual or general questions regarding a Solidity protocol or a smart contract(s

Usado para configurar, instalar, auditar, atualizar, reparar ou sincronizar um 'AI harness' local do projeto para o repositório atual. A ferramenta inspeciona o repositório, realiza uma breve entrevista para definir padrões e guardrails, e então cria ou atualiza os arquivos AGENTS.md, CLAUDE.md, GEMINI.md, PROJECT_HARNESS.md, harness-contract.json e harness-runtime.json.

Repository audit for non-website projects (CLI, libs, backend, monorepo). Use when: "project-audit", "project audit", "repo audit", "code audit".

Modelo de ameaça quântica e arquitetura de defesa. Ativa-se ao discutir a vulnerabilidade do secp256k1, limiares de qubits lógicos, fortalezas criptográficas 2D vs 6D, defesa dimensional, ativos dormentes ou teses temporais.

Per-session cost and token budget tracking for AI coding agents. Monitors cumulative spend, warns at thresholds, and enforces limits with three modes: reject (stop work), alert (warn and continue), downgrade (suggest cheaper approach). Ported from the LOCO-Agent BudgetManager. Trigger phrases: "set a budget", "track my spend", "cost limit", "how much have I spent", "token budget", "spending cap".

Deep code quality analysis: performance (Big-O, hot paths, resource management), security (injection, secrets, auth, input validation), testability (coverage gaps, untestable design, DI), architecture (SOLID, coupling, abstraction leaks, layering). Language-agnostic with language-specific patterns from references. Trigger on: "code quality", "performance audit", "security review", "OWASP", "SOLID"

Security policy for NEAN apps. Enforces OWASP Top 10 and CWE Top 25 mitigations.

Check and update dependencies safely with security audits and test verification.

/cs:compliance-readiness <program> — Multi-framework compliance officer 6-question forcing interrogation of any compliance program. Use before starting a new framework, planning the annual audit calendar, or preparing for certification stage 1.

Pre-publication audit for repositories about to go public or already public. Catches what other skills miss: secrets in git history (not just HEAD), license compliance, internal references (private URLs, internal hostnames, employee names), trademark exposure, attribution gaps, and community-readiness gaps (CONTRIBUTING, CODE_OF_CONDUCT, SECURITY.md, LICENSE headers). Use when: "open source readin