Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed requirements-interview and SPEC-writing workflow, with no hidden code execution or persistence found.
Install only if you want a Portuguese-first SPEC drafting workflow that may inspect the current repository and create files under `.specs/`. Before using any generated SPEC for implementation, confirm whether the later workflow should open a PR automatically or wait for explicit approval.
The file explicitly instructs the agent to interview the user in Portuguese (pt-BR) and states that all questions directed at the user must be in Portuguese. This forces a specific language regardless of user preference and matches the locale-policy violation criteria because no user opt-in or alternative is offered.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **No guessing.** If a fact is missing, ask the user. If the user declines, mark it `[A DEFINIR]` in the SPEC.
2. **No implementation.** Never write implementation code. The output is the SPEC only.
3. **Shared understanding first.** The session ends only when the design-tree frontier is empty.
4. **Evidence-based.** Look up repository, docs, and code facts with sub-agents. Do not ask the user for things you can find yourself.
## The Design Tree
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **No guessing.** If a fact is missing, ask the user. If the user declines, mark it `[A DEFINIR]` in the SPEC.
2. **No implementation.** Never write implementation code. The output is the SPEC only.
3. **Shared understanding first.** The session ends only when the design-tree frontier is empty.
4. **Evidence-based.** Look up repository, docs, and code facts with sub-agents. Do not ask the user for things you can find yourself.
## The Design Tree
Line L093 instructs authors to write acceptance criteria specifically in English BDD form or Brazilian Portuguese (pt-BR). This constrains language choices by policy in the template and does not explicitly offer broader user or organizational locale selection.
The template instructs the agent to 'immediately open the PR' once its checklist is complete, which authorizes an external side effect without a fresh, explicit user confirmation at the point of action. In agentic environments, this can cause unintended code publication, premature review requests, or disclosure of incomplete/sensitive changes if the earlier approval is interpreted too broadly.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- **Registries:** use only approved corporate/organization registries — never public registries unless explicitly authorized.
- **API headers:** use the organization's standard correlation / authentication headers as defined by the API governance team.
- **Security:** do not log PII/tokens/identifiers; store secrets via the organization's secret manager; no `.env` in commit.
- **Scope:** do not invent requirements or expand scope. Stop and ask on ambiguity.
- **Architecture:** no business logic in controllers/components; domain does not access infrastructure.
## 9. Definition of Done