Guia completo de conformidade com a LGPD (Lei Geral de Proteção de Dados — Lei 13.709/2018) para desenvolvimento de software e operações de TI no Brasil. Use esta skill sempre que o usuário mencionar LGPD, proteção de dados pessoais, dados sensíveis, consentimento, base legal, titular de dados, ANPD, DPO (Encarregado), ROPA (Registro de Atividades de Tratamento), DPIA (Relatório de Impacto), DSR (requisição de titular), incidente de dados, vazamento de dados, anonimização, pseudonimização, retenção de dados, transferência internacional, privacy by design, privacy by default, ou quando o usuário perguntar "isso está em conformidade com a LGPD?", "preciso de consentimento para isso?", "como implementar LGPD no sistema?", "quais dados posso coletar?", "como responder uma solicitação de titular?", ou qualquer variação relacionada à privacidade de dados pessoais de usuários brasileiros ou de sistemas operando no Brasil.
Full security cycle: threat-model refresh → security-audit (code) → dependency-audit → harden (perimeter/containers) → optional pentest of the project's own app → consolidated report and stories. Use before release or after adding auth/payments/uploads/multiplayer.
Builds or reviews Apple-platform security with Keychain, LocalAuthentication, CryptoKit, Secure Enclave, certificate pinning, key sharing, and secure credential migration. Use for secrets, biometrics, cryptography, trust evaluation, or OWASP MASVS/MASTG mobile controls.
Read Okta ThreatInsight configuration, security events providers (Shared Signals Framework / SSF receivers), SSF stream status, and bot protection settings. Use when asked about suspicious IP handling, whether ThreatInsight blocks or audits requests, SSF/CAEP integrations for cross-app session signal sharing, or bot detection enforcement.
Subsystem-scoped security audit. Use on "audit the gateway", "review trust boundaries of X", "check personality isolation", "audit the skill loader" or any named subsystem. Not per-PR review, not whole-repo. Writes plan/audits/ report; read-only.
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
Run a layered open-source security scan (secrets, SAST, dependency CVEs, container/IaC, malicious packages) over the current repo and produce a prioritized, triaged report. Use when the user asks to security-scan, audit, find vulnerabilities/CVEs, or check for leaked secrets in a codebase.
Runs a full security audit on the codebase and produces a self-contained HTML report under `security/`. Covers OWASP-style issues, secret leakage, dependency vulnerabilities, and weak crypto. Use when the user invokes `/security-scan` or asks for a security review of the project.
Scan a Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions — before committing config changes or onboarding to a repo with existing agent configs.
Security assessment and hardening workflow for EVM smart contracts. Use when Codex needs to audit Solidity or Vyper code, review protocol architecture for abuse paths, validate access control and value-accounting invariants, assess upgradeable/proxy deployments, evaluate oracle/bridge/DEX integration risk, or produce prioritized remediation guidance with reproducible proof-of-concept tests.
Review, harden, and design HTTP APIs against the OWASP API Security Top 10 (2023): object- and property-level authorization (BOLA/IDOR, mass assignment, over-exposure), authentication and JWT/OAuth2 token validation, unrestricted resource consumption and rate limiting, SSRF, misconfiguration (CORS, TLS, headers, error leakage), and endpoint inventory. Produces evidence-backed findings ranked by severity with concrete fixes. Use when the user asks for an API security review, audit, or threat model, asks "is my API secure" or to prepare for a pen test, mentions BOLA, IDOR, broken auth, mass assignment, rate limiting, or the OWASP API Top 10, wants security requirements for a new API design, or asks to fix an authentication or authorization bug in an API.
Use when reviewing changes for security to apply my checklist on top of security-review — input handling, secrets, authz, Supabase RLS, egress limits, server-side PIN enforcement, and the agent-harness surface (config secrets, hook injection, MCP risk, over-broad permissions).
Comprehensive security scanning and vulnerability assessment for code, dependencies, and infrastructure. Includes SAST, DAST, dependency scanning, and security hardening recommendations. Use before deployments, after major changes, or for regular security audits.
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
carreirasSkill
