本文へ移動
cccskills
無料GitHub で公開

ag-verificar-seguranca

Auditoria de seguranca, qualidade e conformidade. OWASP Top 10, secrets scan, dependency audit. Use antes de deploy.

aibot88/sec_skill_store
インストール方法を見る

含まれるファイル（2）

  • SKILL.md3.4 KB
  • source.json658 B

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

ag-verificar-seguranca — Auditar Codigo

Spawn the ag-verificar-seguranca agent to perform a security and quality audit.

Invocation

Use the Agent tool with:

  • subagent_type: ag-verificar-seguranca
  • mode: auto
  • run_in_background: true
  • prompt: Compose from template below + $ARGUMENTS

Prompt Template

Projeto: [CWD or user-provided path]
Focus: [OWASP, secrets, deps, all]


Executar auditoria de seguranca conforme foco solicitado. Verificar OWASP Top 10, secrets expostos, dependencias vulneraveis, RLS, e conformidade.
Gerar relatorio com severidade e recomendacoes.

Important

  • ALWAYS spawn as Agent subagent — do NOT execute inline
  • After spawning, confirm to the user
  • READ-ONLY audit — does NOT fix issues, only reports findings
  • Supports focus modes: OWASP, secrets, deps, or all

Output

  • audit-report.md com findings: descricao, severity, localizacao (file:line), remediacao
  • OWASP Top 10 checklist (A01-A10)
  • Secrets scan (grep: sk_, pk_, api_key, token, password)
  • Dependency audit (bun run audit --production)
  • RLS verification (para projetos Postgres/Supabase)

Anti-Patterns

  • NUNCA auditar sem rodar bun run audit — ferramenta automatica detecta o que olho humano perde
  • NUNCA ignorar severity CRITICAL — um CRITICAL bloqueia deploy
  • NUNCA confiar no README para avaliacao de seguranca — codigo e a verdade

Escalacao: Issues para Findings P0/P1

Findings com severidade P0 (CRITICAL) ou P1 (HIGH) DEVEM ser registrados como GitHub Issues:

Agent({
  subagent_type: "ag-registrar-issue",
  name: "issue-registrar",
  model: "haiku",
  run_in_background: true,
  prompt: "Repo: [detectar]\nOrigem: ag-verificar-seguranca\nSeveridade: [P0-critical ou P1-high]\nTitulo: [SECURITY] descricao do finding\nContexto: [finding completo: descricao, localizacao file:line, OWASP category, remediacao sugerida]\nArquivos: [arquivos afetados]\nLabels: security"
})
  • P0/P1: SEMPRE criar issue (bloqueia deploy)
  • P2/P3: apenas documentar em audit-report.md (nao poluir backlog)

Quality Gate

  • Nenhum secret hardcoded encontrado?
  • Nenhuma vulnerabilidade CRITICAL sem remediacao?
  • OWASP Top 10 coberto (A01-A10)?
  • Todas as issues tem remediacao sugerida?
  • Findings P0/P1 registrados como GitHub Issues via ag-registrar-issue?

Auditoria de Resiliencia

Para cada dependencia externa (API, DB, servico), verificar:

  • Circuit Breaker presente? (evita cascading failure)
  • Retry com backoff exponencial? (com jitter, sem retry em 4xx)
  • Timeout configurado? (connection + read + total)
  • Fallback definido? (cache stale, valor padrao, degradacao)
  • Health Check implementado? (liveness + readiness)
  • Idempotencia em operacoes de escrita? (retry seguro)

Classificacao de Severidade — Resiliencia

AchadoSeveridade
Chamada externa sem timeoutP0 — CRITICO
Retry sem backoff (loop infinito possivel)P0 — CRITICO
Sem circuit breaker em dependencia criticaP1 — ALTO
Sem fallback para servico opcionalP2 — MEDIO
Health check incompleto (so liveness)P3 — BAIXO

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

007

無料

Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

014-agile-user-story

無料

Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

032-architecture-adr-non-functional-requirements

無料

Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

10x-health-check

無料

Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

10x-team

無料

You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

112-java-maven-plugins

無料

Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project

日本語の概要は準備中です。原文の説明を表示しています。

aibot88/sec_skill_store42026年5月27日 更新

aibot88 のスキルをすべて見る

このスキルの問題を報告する