007
免费Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新
免费在 GitHub 公开
ag-verificar-seguranca
Auditoria de seguranca, qualidade e conformidade. OWASP Top 10, secrets scan, dependency audit. Use antes de deploy.
中文简介正在准备中。当前显示原文说明。
集成工具GitHub
实测评分 未实测
查看安装方法包含的文件（2）
- SKILL.md3.4 KB
- source.json658 B
SKILL.md（原文）
安装前可以查看交给 AI 代理的指令内容。
ag-verificar-seguranca — Auditar Codigo
Spawn the ag-verificar-seguranca agent to perform a security and quality audit.
Invocation
Use the Agent tool with:
subagent_type:ag-verificar-segurancamode:autorun_in_background:trueprompt: Compose from template below + $ARGUMENTS
Prompt Template
Projeto: [CWD or user-provided path]
Focus: [OWASP, secrets, deps, all]
Executar auditoria de seguranca conforme foco solicitado. Verificar OWASP Top 10, secrets expostos, dependencias vulneraveis, RLS, e conformidade.
Gerar relatorio com severidade e recomendacoes.
Important
- ALWAYS spawn as Agent subagent — do NOT execute inline
- After spawning, confirm to the user
- READ-ONLY audit — does NOT fix issues, only reports findings
- Supports focus modes: OWASP, secrets, deps, or all
Output
- audit-report.md com findings: descricao, severity, localizacao (file:line), remediacao
- OWASP Top 10 checklist (A01-A10)
- Secrets scan (grep: sk_, pk_, api_key, token, password)
- Dependency audit (
bun run audit --production) - RLS verification (para projetos Postgres/Supabase)
Anti-Patterns
- NUNCA auditar sem rodar
bun run audit— ferramenta automatica detecta o que olho humano perde - NUNCA ignorar severity CRITICAL — um CRITICAL bloqueia deploy
- NUNCA confiar no README para avaliacao de seguranca — codigo e a verdade
Escalacao: Issues para Findings P0/P1
Findings com severidade P0 (CRITICAL) ou P1 (HIGH) DEVEM ser registrados como GitHub Issues:
Agent({
subagent_type: "ag-registrar-issue",
name: "issue-registrar",
model: "haiku",
run_in_background: true,
prompt: "Repo: [detectar]\nOrigem: ag-verificar-seguranca\nSeveridade: [P0-critical ou P1-high]\nTitulo: [SECURITY] descricao do finding\nContexto: [finding completo: descricao, localizacao file:line, OWASP category, remediacao sugerida]\nArquivos: [arquivos afetados]\nLabels: security"
})
- P0/P1: SEMPRE criar issue (bloqueia deploy)
- P2/P3: apenas documentar em audit-report.md (nao poluir backlog)
Quality Gate
- Nenhum secret hardcoded encontrado?
- Nenhuma vulnerabilidade CRITICAL sem remediacao?
- OWASP Top 10 coberto (A01-A10)?
- Todas as issues tem remediacao sugerida?
- Findings P0/P1 registrados como GitHub Issues via ag-registrar-issue?
Auditoria de Resiliencia
Para cada dependencia externa (API, DB, servico), verificar:
- Circuit Breaker presente? (evita cascading failure)
- Retry com backoff exponencial? (com jitter, sem retry em 4xx)
- Timeout configurado? (connection + read + total)
- Fallback definido? (cache stale, valor padrao, degradacao)
- Health Check implementado? (liveness + readiness)
- Idempotencia em operacoes de escrita? (retry seguro)
Classificacao de Severidade — Resiliencia
| Achado | Severidade |
|---|---|
| Chamada externa sem timeout | P0 — CRITICO |
| Retry sem backoff (loop infinito possivel) | P0 — CRITICO |
| Sem circuit breaker em dependencia critica | P1 — ALTO |
| Sem fallback para servico opcional | P2 — MEDIO |
| Health check incompleto (so liveness) | P3 — BAIXO |
评价
还没有评价。欢迎分享你的使用感受。
评论
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
同一仓库的技能
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新
10x-team
免费You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
中文简介正在准备中。当前显示原文说明。
aibot88/sec_skill_store62026年5月27日 更新