Explorar skills

Symfony / PHP webapp security review — Security Component (firewalls, voters, access_control, role hierarchies), Doctrine ORM injection patterns (raw DQL, QueryBuilder, expr()), Twig auto-escape and |raw, CSRF + session, PHP-specific RCE classes (unserialize, include/require, system/exec, eval, type juggling), configuration discipline (.env, secrets vault, profiler in prod), and recent Symfony CVE

Gera uma planilha de entradas de teste com nomes recém-designados de listas de sanções (OFAC, OFSI, UE) e suas variações, para validar que um sistema de triagem detecta novas designações e está ajustado ao limiar de imprecisão correto. É ideal para dados de teste de atualização de listas de sanções, testes de regressão ou calibração de correspondência imprecisa.

Purple-team operations — structured detection validation against MITRE ATT&CK through planned emulation, measured coverage gaps, joint red+blue debrief, and tracked closure via D3FEND mapping. Bridge between the pentest bundle and the blue bundle.

SAST orchestration for Semgrep, CodeQL and SonarQube. Covers tool selection, ruleset curation, PR-comment integration, noise reduction with baselines, and language-specific linters (bandit, gosec, brakeman, eslint-security) when they add coverage.

SOC alert-tuning workflow — false-positive reduction via targeted suppressions (rule-id + reason + expiry), baseline learning, rule retirement, severity recalibration, and metrics (alert volume, mean-time-to-triage, fatigue index). Prevents detection collapse without losing coverage.

Testing mindset skill for context-driven test strategy, exploratory testing, validation design, acceptance criteria, oracles, weak-test detection, edge cases, heuristics, checklists, and evidence review for code, products, plans, or claims. Use when the user asks what to test, how to test, whether evidence is enough, or to bring a tester mindset. Do not use for merely running an existing test comm

When the user wants to find bugs, test edge cases, stress-test code, or perform adversarial analysis of their codebase. Use when the user says "find bugs," "break this," "what could go wrong," "red team," "hunt bugs," "adversarial test," "edge cases," "stress test," "what did I miss," "pen test this logic," or before any major release. Operates with red team psychology — assumes everything is brok

When ending a session, consolidating memory, or when memory files feel stale or contradictory. Use when the user says "dream," "consolidate memory," "clean up memory," "merge notes," "memory maintenance," "what do you remember," "update your knowledge," "session end," or when memory/context files have accumulated noise over multiple sessions. Performs cross-session memory synthesis inspired by KAI

Create the PHP feature context class that implements step definitions for a domain, and register it in behat.yml. Covers the PHP implementation side of Behat tests. Trigger: "create behat context for {Domain}".

Language-agnostic secure-coding patterns — input validation, injection-safe APIs, authN/authZ, crypto, secrets, dependency hygiene. The default lens when no framework-specific skill applies.

ISO/IEC 27001:2022 ISMS implementation and certification prep — clauses 4-10 (context, leadership, planning, support, operation, evaluation, improvement), Annex A 93 controls across four themes, Statement of Applicability, Stage 1/Stage 2 audit prep, and the certification cycle.

17 habilidades do Claude Code para contexto de IA, testes e desenvolvimento de MCP. Utiliza um formato registrado pela IANA (application/vnd.faf+yaml) para criar o DNA do projeto, pontuar a prontidão da IA, sincronizar com CLAUDE.md, construir servidores MCP e gerar suítes de teste, com mais de 36.000 downloads em npm, PyPI e crates.io.