Security audit
Security checks for vulnerabilities and agentic risk
This skill is a planning helper that writes SPEC documents and optionally coordinates GitHub issue tracking, with the main caveat that it forces Portuguese user interaction.
Install this if you want a pt-BR SPEC-writing workflow that may read repository context and create/update SPEC files. Review before allowing GitHub issue creation or label changes, especially in shared or public repositories, and avoid using it if Portuguese-only interaction would cause misunderstandings.
The skill mandates that all user-facing interaction be in Portuguese without checking the user's language preference or obtaining consent. This can coerce users into a language they may not understand, increasing the risk of mistaken approvals, misunderstood requirements, and consent failures in a workflow that governs specs and downstream issue creation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **No guessing.** If a fact is missing, ask the user. If the user declines, mark it `[A DEFINIR]` in the SPEC.
2. **No implementation.** Never write implementation code. The output is the SPEC only.
3. **Shared understanding first.** The session ends only when the design-tree frontier is empty.
4. **Evidence-based.** Look up repository, docs, and code facts with sub-agents. Do not ask the user for things you can find yourself.
## The Design Tree
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **No guessing.** If a fact is missing, ask the user. If the user declines, mark it `[A DEFINIR]` in the SPEC.
2. **No implementation.** Never write implementation code. The output is the SPEC only.
3. **Shared understanding first.** The session ends only when the design-tree frontier is empty.
4. **Evidence-based.** Look up repository, docs, and code facts with sub-agents. Do not ask the user for things you can find yourself.
## The Design Tree
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Filling gaps with guesses | Use `[A DEFINIR]` or ask the user. |
| Skipping the design tree | Build the tree in rounds to avoid hidden assumptions. |
| Writing a SPEC without user confirmation | The user must explicitly approve. |
| Ending without asking about the GitHub Issue | Always ask after approval, with yes as the recommended answer. |
| Creating the Issue but leaving `Ticket` empty | Update section 0 with the issue number/link right after `gh issue create` returns. |
| Leaving `backlog` on an approved SPEC's Issue | Swap `backlog` → `todo` the moment `Status` becomes `Approved`. |
| Stacking `backlog` and `todo` | Status labels are exclusive — remove the old one when adding the next. |
The template instructs writers to use BDD phrasing in English or specifically pt-BR, which embeds a locale preference into the skill guidance. Because no user choice mechanism or organizational justification for pt-BR is provided in this file, this is a natural-language locale policy concern.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- **Registries:** use only approved corporate/organization registries — never public registries unless explicitly authorized.
- **API headers:** use the organization's standard correlation / authentication headers as defined by the API governance team.
- **Security:** do not log PII/tokens/identifiers; store secrets via the organization's secret manager; no `.env` in commit.
- **Scope:** do not invent requirements or expand scope. Stop and ask on ambiguity.
- **Architecture:** no business logic in controllers/components; domain does not access infrastructure.
## 9. Definition of Done